Garmin says you control your data, but their dash cam app tracks your location in the background, reads your call history and contacts, can send text messages and make phone calls on your behalf, and scans every app on your phone — far beyond what a dash cam needs.
high
Garmin's privacy policy lists only basic data like your email and location, but their app can actually access your microphone, camera, phone call history, contact list, and text messages — none of which are mentioned in the policy.
high
Garmin says they only store footage you save, but when hackers locked all of Garmin's systems with ransomware in 2020, nobody could access their stored dash cam videos for days. Garmin had to pay $10 million to get their own systems back — showing your "saved" footage is only as secure as Garmin's servers.
Garmin says they do not share your data with third parties unless you ask them to. But the Garmin Connect app has Facebook tracking code built in that automatically sends information about your app usage to Facebook. You never asked for your fitness app activity to be reported to Facebook.
critical
Garmin says they do not sell your data and only share anonymous group statistics. But they have partnered with insurance companies like John Hancock to use your Garmin health data to adjust your insurance rates. Insurance companies need to know YOUR specific data, not anonymous group averages. If your step count and heart rate affect YOUR insurance premium, that is individual data sharing, not anonymous statistics.
critical
In 2020, Russian hackers broke into Garmin and shut down all their services for 5 days. Garmin reportedly paid $10 million to get their systems back. Garmin said no customer data was stolen, but they never released the full investigation results. For 5 days, hackers had access to the systems that store millions of people's heart rate data, GPS location history, sleep patterns, and other health information. We have no proof data was safe — only Garmin's word.
In July 2020, Russian hackers shut down every Garmin service for five days. Garmin reportedly paid $10 million to a group linked to Evil Corp, sanctioned by the US Treasury. Paying sanctioned entities may violate US law. Garmin never confirmed whether attackers copied user data — years of GPS tracks, home addresses, and daily routes for millions of athletes. They paid the ransom, restored services, and hoped everyone would forget. Whether Russian criminals have your cycling routes remains unanswered.
high
In 2018, a 20-year-old Australian student discovered Strava's heatmap was revealing secret US military bases in Afghanistan — soldiers' fitness trackers drew glowing lines around classified installations. Garmin Edge data feeds identical ecosystems. Your daily commute, weekend rides, coffee stops — they paint a heatmap of your life as detailed as anything that exposed military operations. The difference is soldiers had security clearances and you have a cycling hobby. The data exposure is the same.
medium
Garmin doesn't "sell" your data. Instead, it "partners" with insurance companies and wellness programs offering discounts for sharing fitness metrics. Your employer buys a Garmin program. You join for the $500 insurance discount. Now your boss's insurer knows your resting heart rate, exercise frequency, and whether you actually ride that bike. Garmin didn't sell your data — your employer bought a program that happens to include it. The distinction is legal. The result is the same.