Your runs are a map of your life.

Troops were still exposing CENTCOM base routines in the Middle East through public Strava posts.

A sailor's logged run on Strava revealed the position of an aircraft carrier at sea.

Samsung Health told users to share medications and menstrual data with its AI or lose synced data.

The FBI director testified the FBI had resumed buying Americans' location data from brokers.

1,400 Strava activities from seven bodyguards exposed the Swedish prime minister's home and movements.

Broker Gravy Analytics was hacked, leaking about 17 terabytes of precise location data on millions.

A jury found Meta liable for using period-app data to target ads.

Le Monde found French nuclear-submarine crews leaking patrol dates through their Strava runs.

Ransomware leaked about 72 million Under Armour customer records, including names and locations.

Oura's deal with a defense contractor raised fears over access to health and reproductive data.

A lawsuit alleged Whoop shared users' health data with a third-party tracker without consent.

The FTC banned brokers Gravy Analytics and Venntel from selling sensitive location data.

Reporting found ICE moving to buy a tool tracking hundreds of millions of phones every day.

The FTC acted against a carmaker for selling drivers' precise location without consent.

Le Monde tracked the bodyguards of Biden, Trump, Macron, and Putin through their Strava posts.

Researchers pinned Bumble, Hinge, and Grindr users to within about two metres.

A regulator banned a broker from selling sensitive location data, the first ban of its kind.

Strava's new terms banned third parties from using its data to train AI, after an API crackdown.

A broker's tool tracked a phone to an abortion clinic with no warrant needed.

A broker sold the location data of visitors to 600 reproductive-health clinics.

Senate documents confirmed the NSA buys Americans' internet browsing records from data brokers.

A stalkerware breach exposed data from 2.4 million customers of a covert phone-surveillance app.

Automakers were found secretly sharing driving data with insurers through a data broker.

A Senate probe found carmakers selling driver data for as little as 26 cents per car.

A study de-anonymized Strava heatmap users and found their home addresses.

A regulator found GoodRx shared prescription and health data with Facebook and Google.

BetterHelp was found to have shared mental-health data with Facebook and Snapchat.

The 23andMe breach exposed genetic and ancestry data on about 6.9 million users.

A regulator found a fertility app shared data with Google and overseas analytics firms.

A man used Strava to monitor a jogger's routes; a court granted a stalking order against him.

A privacy review called cars the worst product category it had ever reviewed for privacy.

Reuters found workers at a carmaker privately sharing intimate videos from customers' car cameras.

Researchers bought about 5,000 US servicemembers' records for as little as 12 cents each, sortable by base.

SafeGraph sold a week of location data on abortion-clinic visitors for about 160 dollars.

Records showed a US agency buying vast quantities of cellphone location data without warrants.

Two US agencies contracted a broker selling location data harvested from dating apps.

A regulator sued a broker for selling data that traced visits to abortion clinics.

A company was found selling app-sourced location data cheaply to local police.

Gay and bisexual dating apps and prayer apps sold users' location data to a broker.

A woman was tracked on Strava and murdered by a rival who followed her routes to find her.

Fake Strava segments were used to surveil about 100 personnel at six secret Israeli military bases.

Researchers defeated Strava's privacy zones and located users' homes with up to 85% success.

A firm demonstrated tracking the phones of CIA and NSA staff using ordinary app location data.

Google paid $391.5 million to 40 US states over misleading location-tracking practices.

A woman used an AirTag to find her boyfriend, then ran him over and killed him.

A sex trafficker used a family-tracking app as an electronic leash on a teenage victim.

A broker sold timestamped location data from 61 million unique devices in a single week.

Life360 sold precise location data on tens of millions of people, including children.

A Catholic priest was outed after a publication bought his Grindr location data.

A regulator found the Flo app shared fertility and pregnancy data with Facebook, Google, and others.

A prayer app sold user location data through a broker.

The US Treasury bought a location-data app to investigate people.

An unsecured third-party database exposed 61 million Fitbit and Apple Health records.

Peloton's unauthenticated API let anyone pull riders' private profile and workout data.

Researchers found Nike Run Club, Runkeeper, and MapMyRun lacked two-factor login and allowed weak passwords.

A US intelligence agency admitted buying Americans' phone location data without warrants.

One broker advertised 11,000-plus data attributes on 2.5 billion people.

The Untappd beer check-in app was used to track military and intelligence staff at the Pentagon and Camp Peary.

The Muslim Pro app, with 98M+ downloads, sent location data to a broker that reached the US military.

Venntel sold app location data to ICE, CBP, and the FBI, who tracked phones worldwide.

Garmin's fitness services were knocked offline for days by a ransomware attack.

Strava turned its Flyby feature off for everyone after it exposed nearby strangers and enabled stalking.

US special operations bought location data drawn from Muslim prayer-app users.

The Secret Service bought a phone-tracking tool built on app location data.

An antivirus company was found selling users' browsing data through a subsidiary.

The New York Times tracked named Secret Service and Pentagon staff from a leaked 12-million-phone dataset.

The Flo period app sent menstruation and pregnancy data to Facebook.

A pregnancy app sold aggregated employee pregnancy data to their employers.

Los Angeles sued a weather app for covertly selling users' location data.

A study found 99.98% of Americans could be re-identified from almost any dataset.

Google's location store was found feeding police geofence warrants that snared innocent people.

Strava's global heatmap exposed the perimeters and patrol routes of secret military bases.

Polar Flow exposed names and home addresses of 6,500+ personnel at 200+ military and intelligence sites.

The US military said it was refining wearable-device rules after the Strava heatmap exposed base activity.

Grindr shared users' HIV status and location with two third-party firms.

Under Armour's MyFitnessPal breach compromised about 150 million accounts.

Analysts traced Russian soldiers' movements inside bases, including in Crimea, through Strava.

Google was found storing location data even when users turned Location History off.

Researchers found flaws in a fertility app that let attackers reach users' sensitive data.

Four points re-identified 90% of people in a set of credit-card records on 1.1 million people.

Runtastic left live workout maps unsecured by default, letting attackers track runners in real time.

Tinder's API leaked distances, letting anyone triangulate a user's exact location.

Strava began selling athletes' data to transport agencies; one paid $20,000 for cyclists' movements.

Four location points were enough to uniquely identify 95% of 1.5 million people in phone data.

Anonymized Netflix ratings were de-anonymized using a little outside knowledge.

The New York Times re-identified an anonymous searcher from a released AOL dataset.

A researcher showed 87% of Americans are identifiable from ZIP, birth date, and gender alone.