[Closed] Strava T&C update

GDPR innit?

There was a few stories going around that social media were getting ahead of EU rules around the world this week.

For Strava they have just taken the legal advice, nothing to stop you setting up a MyName_Jnr account though which is probably sensible for an 8 year old on social media anyway

I was planning to set my 8 Year old up an account

Most social media companies have this rule - it avoids issues with consent by minors for data gathering.

Everyone ignores it on every other platform so I wouldn't let it stop you, either, just don't use your kids real name.

I assume all the (public) ride data is made public via the API where you can pretty much take it and do what you like with it. How much further than that it goes, I don't know.

How much further than that it goes, I don’t know.

Strava sell the data onto local authorities and planning types (aggregated and annonomyesed) so they will be flagging that up and making sure you have opted in for sharing. In the end why wouldn't you if it's showing where people are riding and how frequently. It's the sort of stuff that can lead to good policy making

Probably GDPR - I've been getting several emails recently from various marketing companies plus smaller companies like Cotic asking if I want to remain on their distribution list. One (not Cotic) had several big green buttons "Keep me informed" and buried in the small print at the bottom was the unsubscribe link.

A lot of CYA whilst they try and sell on what they already have got.

Edit: The Strava email came through whilst I was typing the above

In the end why wouldn’t you if it’s showing where people are riding and how frequently

Because: Cheeky Trails.

Because: Cheeky Trails.

You are putting your cheeky trails on the internet. Perhaps something like this can lead to some evidence based policy that shows the popularity of some areas and that they need better facilities. If you want o skulk around in the shadows don't expect anything to get better.

Oh and on the GDPR it's double opt in now so you need to confirm you want to be on the list

No the GDPR does not require a double opt in, it's purely optional but is a good practice for larger companies to adopt.

Just like you don't need to ask everyone to resubscribe to your mailing lists unless you've been adding people to the list historically without their consent.

Thanks for the clarification, just back in the UK in the middle of this so getting caught up. Of course you may have had consent to add people but you just mis filed the records of that 😉

Ah but then there's the soft-opt in clause which means you can market people who have purchased or enquired from you without an opt-in as long as you ensure there is an opt out on the marketing. TBH this doesn't differ much from the existing data protection act. Larger companies (who are currently compliant to the existing acts) are being extra careful purely because of the fines involved post 28th May

You are putting your cheeky trails on the internet.

Other people are putting my cheeky trails on the internet

I don't ever expect that tolerated trails on private land are going to somehow be given official status because they appear on a Strava heatmap.

My personal view on all strava heatmaps is that they don;t necesarily tell the full story, a case in point:

I'm on the local LAF a council officer made a presentation about access in a local riding area and pointed to a specific path as being 'the most popular with mountain bikers so we'll look at improving that one'. The trail pointed to was the only off road route between two separate areas that contain, between them, over 50km of singletrack. Yet it was this 500m section that was the focus because it 'was popular' when there was no real 'desire' for it to be ridden, it just gave access to desirable stuff.

It's the same on the road - just because a lot of cyclists use a certain road it doesn't mean they want to, it just that there may be no alternative available that isn't full of motorists who want to kill them - not that the road being ridden is the best way to reach a destination.

So I'm very sceptical of the use of heat maps in isolation as a policy tool.

1) Use of a specific piece of road/trail does not necessarily mean approval
2) Strava use itself implies a degree of commitment to riding. Utility/occasional riders will tend not to be Strava users so their route choices will never show.

anyway this is getting a bit off topic.

So I’m very sceptical of the use of heat maps in isolation as a policy tool.

Me too, it's part of, it gives you a start and some data to work with. Whatever data you have needs using properly. For a better application/implementation take a look at trail forks - it links to strava but owners can delete areas/trails and it will give you stats over use of an area served by a link trail etc.

So I’m very sceptical of the use of heat maps in isolation as a policy tool.

I agree, it's <i>one</i> possible data source, but it should be used in combination with others to build more a detailed/accurate picture when developing infrastructure.

The other thing I note from Starva's T&Cs is that they appear to say they treat the information you have marked as "Private" differently to that shared publicly...

I never tick the Commute box (they've had this option for a long time) on my commutes and I always keep them as private, so those rides might show up in a more general heat map, but not if data filtered for that "commuting" field...

An awful lot of the options you have when recording and subsequently sharing an activity affect the accuracy of the data, if you put in the type of bike/bike ride they can filter out MTB/Road/Cross/etc rides, they've got riders age group and other demographic data, very detailed information on times/days you ride and any patterns that can then be inferred... they could build quite a picture of an individual if they choose to.

I'm a bit less concerned about public bodies trying to use strava to plan infrastructure, more about how tailored marketing/advertising might be derived from it, and if marking my information as "Private" really limits it's use for marketing or simply prevents me being stalked as easily...

Never been sure just what the commute box does for the user, it doesn't make the ride "private" or anything similar. Ideally it would be private but the distance and height gain count towards any of the challenges you might enter. Unless it's used by Strava themselves when they sell the data on to filter out commutes.

If a particular "cheeky" trail is prominent on the heat maps then you need to figure out why it's popular as in @wwaswas' examples, i.e. context. It could just be someone and their mates riding a "trail" on their own land!

the commute box tags the data with another field that is in theory useful when selling it on, either as a "commuting heatmap" for an area or for targeted marketing if you have a product that would suit that particular market, just like putting in ride/bike type, your age/gender/height/weight...

All of this information has the potential to be useful to a third party.

the commute box tags the data with another field that is in theory useful when selling it on, either as a “commuting heatmap” for an area or for targeted marketing if you have a product that would suit that particular market, just like putting in ride/bike type, your age/gender/height/weight…

All of this information has the potential to be useful to a third party.

I often vary my commute home - the Ickornshaw Moor option might be an interesting one 🙂

And right on queue an email for Garmin to inform me of changes to their privacy policy... More bullet points:

Here is some information you can expect to see in the updated policies:

• Why we process personal data

• Legal grounds for processing personal data

• Data privacy user rights and how to exercise them

• How to contact Garmin about data privacy

All seems to be in a similar vein... May is looming.

that last bullet point suggests they might have been doing more with my data than I’d necessarily given consent for….

May have or may not. At the very least GDPR requires making it clear what they're doing and if not clear before or no consent acquired before, they should provide an opt in. Not sure also if there was no previous opt out, does it automatically have to become an opt in, as opt out is not generally an option going forward.

Because: Cheeky Trails.

Makes you wonder if a built cheeky trail is information not intended to be published and thus covered by GDPR and you should seek permission to post a ride involving any 😀

Anyway, I've got to the point now of setting enhanced privacy, careful control over followers, and default to not contributing to either heat maps or leaderboards. I'm not interesting in competing against people. However I still don't set private as I want to share with friends, but still concerned the settings are not enough. Strava don't have a concept (despite being asked for a long time) or private groups or clubs where you can share with a limited set of people without your ride data ending up on public leaderboards (once on leaderboards you can click a segment time and see the entire ride).

Trailforks is better in a lot of ways, but cheeky trail policies goes to the extreme of your entire ride cannot be shared at all if one tiny part of it went on a sensitive trail or near it. Even just to share with friends.

But then maybe that's still a good thing, and I should get away from considering sharing with anyone at all, or otherwise only ride sanctioned dull trails at trail centres.