Fitness-tracking platforms, such as Strava and Garmin Connect, are increasingly popular and are reshaping how people monitor and share their physical activity. Given the sensitive nature of the data users share, these platforms implement a series of privacy features, including controls for profile visibility, activity sharing, and the specification of sensitive locations. In this paper, we present the first large-scale study aiming to quantify user adoption of privacy features on fitness-tracking platforms and to shed light on the reasoning behind identified trends. We apply a mixed-method. First, we provide a systematic categorization of the privacy features implemented across major fitness-tracking platforms. We then quantify their adoption, using the Strava and Garmin Connect platforms as our case studies, by analyzing 197,873 public activity records, revealing a gap between available controls and actual adoption. We complement our empirical evaluation by surveying 182 participants, confirming low adoption and identifying barriers. Our findings highlight limited use of privacy features and provide insights into the reasons for this trend, including a lack of awareness, perceived low necessity, concerns about functionality, and difficulties adjusting settings. We also discuss potential strategies to overcome these challenges.

Browsers have become the most popular and used platform for accessing the web. Their wide and exclusive usage as a medium for doing several tasks in the Internet comes with serious security and privacy risks for the users. For example, it has been shown that web sites can employ browser fingerprinting and cross-device tracking techniques to de-anonymizing or profiling a user’s browser. On the other hand, browsers become richer in functionality by the years. One very convenient feature, introduced recently and being available to most major web browsers, is synchronizing the browsers on different devices. Browser synchronization allows users to share settings and preferences of their browser running on multiple devices (e.g., on their laptop and smartphone).In this paper, we are the first to deliver a framework that can be used by web site operators to detect if different HTTP requests, issued from different browsers, are actually requests performed by the same user through multiple synchronized browsers running on different devices. For detecting this, we reconstruct different sessions based on their requested resources, timestamps and cookies. In addition, we evaluate our methodology by conducting a user study that collects anonymized HTTP requests from several users, and we prove that the detection of synchronized sessions is possible with a success rate higher than 75%. Our results indicate a serious implication to users’ privacy that has not been studied before.