Data Privacy in Consumer Health Wearables

Data Privacy in Consumer Health Wearables

Introduction

A continuous glucose monitor (CGM) is a small sensor worn on the skin that measures glucose in the fluid between cells, and it can log up to 1,440 readings a day [1]. That stream says more than a glucose number. A 2026 review in the Journal of Diabetes Science and Technology points out that a CGM trace can reveal meal times, sleep patterns and alcohol use, and that the data usually travels from the sensor to a phone app, then to commercial cloud servers, and sometimes on to third parties with no role in the wearer's care [1]. Since March 2024, people in the U.S. can also buy a CGM without a prescription [2]. Here we look at who holds that data, what can go wrong with it, and which U.S. rules apply as of October 2026.

Key Players and Patents

Dexcom, Abbott and MiniMed (historically part of Medtronic) all sell CGM systems in the U.S. [2][3][7]. Patents protect how the sensors are built. For privacy, the question that matters is whose app and cloud account the readings flow into. Two over-the-counter (OTC) sensors widened that circle in 2024. The FDA cleared Dexcom's Stelo on March 5, 2024 as the first OTC CGM, for adults who don't use insulin, so buyers no longer need a health care provider involved [2]. Abbott's Lingo is intended for adults 18 and older who aren't on insulin, and Abbott publishes a separate Lingo privacy notice, dated July 2026 [3]. We compare the two in more detail in our look at the over-the-counter CGM market.

Data Collection and Storage

A CGM sensor sends its readings to a phone app or receiver, and from there the data usually moves to the manufacturer's cloud servers [1]. Stelo, for example, shows glucose values and trends every 15 minutes in its smartphone app [2]. The glucose readings are only part of what gets collected. Dexcom's privacy notice, which the Stelo website links to, lists technical data such as IP addresses, device type and the advertising IDs that Apple and Google assign to phones [4]. The same notice says Dexcom may create de-identified data, meaning data stripped of the details that tie it to a person, and that it won't try to re-identify anyone from it [4]. Service providers that host websites or run IT systems for the manufacturer can also handle parts of the record [5].

Potential Risks

Three risks came up again and again in the sources we read:

• Data breaches: CGMs and insulin pumps that communicate wirelessly can be exposed to data interception. Voluntary security standards exist, including the Diabetes Technology Society's DTSec and IEEE 2621, but as of the 2026 review neither the U.S. nor the EU required diabetes devices that transmit health data to be certified against them [1].
• Data sharing: Dexcom's consumer health data policy allows sharing with service providers and, during a business transaction such as a merger, with the other party [5]. Its general notice tells U.S. users that, depending on their state, they may be able to opt out of the sale of their data or its use for targeted advertising [4].
• Lack of transparency: A 2021 study of 497 Android diabetes apps found that 28.4% offered no website for a privacy policy and 40% contained advertising; some apps that claimed to be ad-free actually showed ads [6]. Even when a policy exists, the 2026 review notes that users are often required to grant broad data-use permissions just to activate their CGM, which makes that consent less meaningful [1].

Regulatory Frameworks

The Health Insurance Portability and Accountability Act (HIPAA) protects health information held by health care providers, health plans, clearinghouses and their business associates [1]. It follows the type of organization, not the type of data. Wearable manufacturers and consumer app makers generally aren't covered, so glucose data sent to a manufacturer's cloud or to a wellness app can fall outside HIPAA entirely [1]. Here's what surprised us in Dexcom's own policy: it says HIPAA governs its G7 and other prescription CGM products when a health care provider supplies them and insurance pays, and Stelo isn't on that list [5].

Federal and state rules fill part of the gap. The Federal Trade Commission (FTC) brings enforcement actions under Section 5 of the FTC Act, and in 2024 it finalized an updated Health Breach Notification Rule that explicitly includes health apps and connected devices [1]. Washington's My Health My Data Act (2023) lets individuals sue companies that collect or share their consumer health data without authorization [1]. Nevada has its own consumer health data law (SB 370), and Dexcom publishes a combined Washington and Nevada policy that explains how residents can ask to see or delete their data [5]. Connecticut and other states have introduced similar legislation, so as of October 2026 a CGM user's protections can depend on the state they live in [1].

Conclusion

The same glucose reading can fall under HIPAA in a clinic's health record, under the FTC Act inside a manufacturer's app, and under state consumer protection law once it reaches an analytics vendor, or under none of them [1]. For anyone weighing a prescription CGM against an OTC sensor like Stelo or Lingo, the product's privacy notice is the document that spells out where the data goes [3][4]. One question no law has settled yet is who owns this data in the first place; the 2026 review found ownership legally ambiguous in most jurisdictions [1].