Strava is a handy app for recording your rides and keeping up-to-date with rides your mates have completed, and it’s also an impressive training tool for tracking and analysing your performance, but a new report suggests that the Global Heatmap feature – which anonymously aggregates all activities onto a single map – could lead to the identification of users’ home addresses in certain circumstances.

Strava has many features designed to help users connect with each other, the aim being to help athletes find places to ride, run and walk. 

A few years ago Strava unveiled its Global Heatmap feature which lets you explore where other people are riding and running around the world. The Strava Heatmap takes the last 13 months of GPS data from participating users and aggregates it onto a single map that highlights the most active routes.

The default setting is that your GPS data will be included on the Heatmap, but you can opt-out. Assuming you don’t object, the idea is that your rides are anonymous on the Heatmap. 

> Check out our review of Strava’s Premium subscription

Strava denied that the Global Heatmap posed a security risk but went on to tweak this feature in response to military security concerns. 

Strava heatmap Anna.JPG
Strava heatmap Anna (Image Credit: Farrelly Atkinson)

> How to make the most of Strava’s exploring features for your next adventure

Now computer scientists at North Carolina State University have expressed new privacy concerns with this Heatmap function, claiming that Strava users are susceptible to other people finding their personal information, including home addresses, in certain circumstances.

“[The heatmap feature] allows users to find hot spots and active trails while simultaneously opening up the platform to deanonymization attacks like inferring users’ home addresses,” say Kevin Childs, Daniel Nolting and Anupam Das in a report called Heat Marks the Spot: De-Anonymizing Users’ Geographical Data on the Strava Heatmap.

“By crawling the publicly available heatmap and through manual validation, we have demonstrated that the home address of highly active users in remote areas can be identified, violating Strava’s privacy claims and posing as a threat to user privacy.”

Strava says that the crawling or scraping of data violates its Terms of Service. Additionally, it says, there are many toggles you can enable to: prevent timestamps from appearing to non-followers, hide photos on activities and profile, and hide additional information. 

 

“In areas with many highly active Strava users, the Strava heatmap data is difficult to tie to a specific user due to the fact that potentially hundreds of athletes are contributing to the heat in that area. No name or account information is tied to the heat generated,” says the report.

All good, then? Not quite.

The researchers go on to say, “However, in areas with only a few active Strava users, the heat generated by one individual can be clearly visible… In some situations, these areas of high heat can be used in conjunction with user metadata to reveal the home addresses of Strava users.” 

> Strava adds privacy features for editing map visibility and hiding data including heart rate 

2021 Strava 3d view Global Heatmap
2021 Strava 3d view Global Heatmap (Image Credit: Farrelly Atkinson)

> How to use Strava to make you fitter 

According to Strava, several users must have been active in a given area for data to be shared on the heatmap, but the researchers describe a possible mode of attacking user privacy and say that “an automated approach using crawling and public voter records was developed”.

The automated approach is described as “a four-step pipeline, including screen capture, image analysis, user crawling, and inference analysis”. It’s fairly complex but you can read about it in the paper.

The researchers say, “The ability to identify the home address of Strava users is a violation of user privacy. It demonstrates that seemingly anonymous data is not truly private and can leak information about users. In addition to contradicting the privacy claims made on registration for the heatmap, the matching of a Strava user to a home address can build a complete profile of an individual, including their workout habits and the paths they frequently travel on. This information can be used for stalking or other invasions of the privacy of individuals.”

Strava says that this statement is misleading and the premise is only accurate if someone does not use any privacy settings, and this is not true for many users.

The researchers go on to say, “Additionally, on a wider scale, instead of ‘John Doe’ being just a name tied to an address, ‘John Doe’ can be categorised as an active individual living with certain workout behaviour. This information can be utilised for targeted advertising and individual profiling and is potentially being collected without consent.”

The researchers add that their methods of attack rely heavily on identifying houses that are clearly the starting point of a large amount of heat, and offer solutions to avoid identification in future. They say that one of these methods would be to apply Strava’s existing hidden zone feature, which is intended to allow users to hide the start and end points of their activities before sharing them publicly, to Heatmap data.

Strava points out that areas around addresses can be hidden using Edit Map Visibility controls and are also hidden from the Global Heatmap. If you’d rather not have your data included on Strava’s Global Heatmap, you can go into your Strava settings, clicking on Privacy Controls and then opt out of Aggregated Data Usage. 

Addendum

Strava has now responded with the following statement:

“The safety and privacy of our community is our highest priority. We’ve long had a suite of privacy controls (including Map Visibility Controls) that give users control over what they share and who it’s shared with.

“Strava does not track users or share data without their permission. When users share their aggregated, de-identified data with the Heatmap and Strava Metro, they contribute to a one-of-a-kind data set that helps urban planners as they develop better infrastructure for people on foot and bikes, and makes it easy to plan routes with the knowledge of the community.

“The Global Heatmap displays aggregated data from a subset of Strava activities and will not show ‘heat’ unless multiple people have completed an activity in a given area. Any Strava user who does not wish to contribute to the Heatmap can toggle off the Aggregated Data Usage control to exclude all activities or default their Activity Visibility to be only to themselves (`Only You`) for any given activity. 

“We are consistently strengthening privacy tools and offering more feature education to give users control over their experience on Strava. This includes simplifying our Privacy Policy with our Privacy Label at the top.”