Quick answer: Whoop says it does not sell your data. Its privacy policy states “We do not sell Personal Data” and that it does not sell your consumer health data. But there are two catches. First, Whoop itself says that because California’s privacy law defines a “sale” so broadly, it uses third-party cookies and tracking, and its website works with advertising partners. Second, a proposed class action filed in August 2025 claims the Whoop app sent names, emails and heart rate data to an analytics tool without consent. Those claims aren’t proven. Below, we explain what Whoop collects, what it shares, and what you can switch off.
Table of Contents
What Data Does Whoop Collect?
Whoop is a screenless strap that tracks you around the clock and sends the data to its app and cloud. According to Whoop’s privacy policy (last updated August 3, 2026), that includes:
- Body signals: heart rate, heart rate variability, breathing rate, skin temperature, blood oxygen and movement.
- Activity and sleep: workout and sleep data, the type and length of your activities, and your strain and recovery scores.
- Your profile: birthday, gender identity, weight, height and fitness level.
- App activity: how you use the app. The lawsuit below also mentions the titles of videos members watched in the app.
Whoop calls this “wellness data.” Like other wearables, most of its value comes from Whoop’s servers, not the strap itself.
Does Whoop Sell Your Data?
On paper, no. Whoop’s privacy principles say: “we never sell our members’ personal data. This is our promise.” Its full policy repeats that “We do not sell Personal Data” and “We do not sell your consumer health data to third parties.”
But the same principles page adds an important line: “Because of how broadly the CCPA defines ‘sale,’ we want to be clear that we use third party cookies and other tracking technologies.” The CCPA is California’s consumer privacy law, and it can count some ad-tracking cookies as a “sale” or “sharing” of data. So Whoop isn’t selling your heart rate to data brokers, but its website does take part in ordinary online ad tracking.
Whoop also says that “any personalization based on your health data occurs within WHOOP and is not used for third-party advertising.” In short, your health data stays out of the ad system, but your web browsing on whoop.com doesn’t.
What Whoop Does Share
“We don’t sell” doesn’t mean “nobody else sees anything.” Here’s what Whoop’s own policy says it shares or keeps:
| What | What it means for you |
|---|---|
| Advertising partners | Whoop says it works with “third party advertising companies and social media companies” to advertise its services, using cookies on its website. You can opt out of interest-based ads. |
| Research | Whoop uses “de-identified wellness data for research purposes” with research partners, and says it typically shares only aggregated data with them. |
| Service providers | Outside companies run parts of Whoop’s service. Its policy lists Segment, a customer data platform, as a provider used to “facilitate data collection and analysis.” |
| Coaches and teams | If a coach, team or organization manages your account, your data may be shared with them with your consent. |
| Advanced Labs | If you sign up for Whoop’s blood testing service, data may be shared with the third parties involved, with your explicit consent. |
| Legal requests | Whoop says it may respond to “law enforcement requests” and court orders. |
| After you delete | Whoop may keep some records, plus aggregated or de-identified data “that does not identify you,” after you update or delete your information. |
The Whoop Data-Sharing Lawsuit, Explained
In August 2025, Whoop user Steven Lomeli filed a proposed class action against Whoop in federal court in the Northern District of California. According to Milberg, the law firm representing him, the complaint claims that:
- Whoop built a third-party tracker called Segment into its app.
- Whoop sent Segment members’ full name, email, height, weight, birthday, city, gender, username and device details.
- It also sent vitals like heart rate and the titles of videos members watched, without telling them or asking for consent.
- This broke the federal Video Privacy Protection Act and California’s medical privacy law, the complaint says.
What this does and doesn’t mean: these are one side’s claims, not court findings. When we checked in October 2026, we couldn’t find a ruling or settlement. Segment does appear in Whoop’s own list of service providers, so the dispute is mainly about what was sent and whether members were properly told and asked. We’ll update this section if the case moves.
Whoop Coach: What the AI Sees
Whoop Coach, the AI feature, combines your strain, recovery and sleep scores to answer questions. Whoop’s policy says it uses an outside AI company and that:
- Only de-identified Whoop metrics are sent to that AI partner.
- The partner has a “Zero-Retention/Zero Training Policy,” so it can’t store your data or use it to train its AI.
- Whoop itself keeps your chat history so you can see past conversations. You can delete chats by swiping left on them in Whoop Coach, or by asking Membership Services.
Whoop Privacy Checklist
These steps come from Whoop’s privacy policy. App menus change, so look for the closest match.
- Limit ad tracking on whoop.com. Reject marketing cookies when you visit, or clear them in your browser. Whoop’s policy also points to the industry opt-out tools from the Digital Advertising Alliance and the Network Advertising Initiative.
- Turn off ad tracking on your phone. In your phone’s privacy settings, limit or reset your advertising ID.
- Delete Whoop Coach chats you don’t want kept: swipe left on a conversation in Whoop Coach.
- Be careful with coach and team accounts. Only connect your Whoop to a team or organization you trust, since they can see your data.
- Request your data or deletion. Whoop’s policy says you can ask to access or delete your personal data. Expect a verification form, and remember that de-identified data may be kept.
Whoop vs Oura: Privacy Compared
Oura is the other big subscription wearable people compare with Whoop. Here is how their own policies line up. We cover Oura in detail in our Oura ring privacy guide.
| Whoop | Oura | |
|---|---|---|
| Says it sells personal data? | No | No |
| Website ad cookies? | Yes, with advertising partners | Yes, to build ad audiences |
| Health data used for ads? | No, per Whoop | No, per Oura |
| Anonymized data for research? | Yes | Yes |
| AI feature | Whoop Coach (de-identified data to an AI partner) | Oura Advisor (data may improve Oura’s own AI) |
| Privacy lawsuit or controversy | Proposed class action over Segment (2025, unresolved) | Backlash over Palantir and defense work (2025) |
Is Whoop Safe to Use?
From a privacy point of view, Whoop’s written promises are solid: no data sales and no health data in ads. The weak spots are the website ad tracking it openly admits to and an open lawsuit claiming it shared app data with an analytics tool without consent. If you’re comfortable with a company holding your health data in the cloud, Whoop is a reasonable choice, especially after you work through the checklist above. If the lawsuit worries you, wait to see how it ends or pick a device that keeps more data on the device.
(This guide covers privacy and data security only. We haven’t researched the strap’s physical or electrical safety here.)
Want to go deeper? Our Wearable Scam Bible looks at the gap between what fitness trackers promise and what the evidence shows, and at what happens to the health data your device collects once it leaves your wrist. See the ebook →
Comparing trackers? Our Fitbit Air review looks at a cheaper, subscription-free alternative and its own privacy trade-offs with Google. And if you want less of your personal information online in general, start with our guide to removing yourself from data brokers.
Prefer a ring with no monthly fee? See our guide to the best Oura Ring alternatives without a subscription, including what each brand’s privacy policy says.
Thinking of leaving Whoop? We compared screenless bands with no required membership in our guide to the best Whoop alternatives without a subscription.
Frequently Asked Questions
Does Whoop sell your data?
Whoop says no. Its privacy policy states that Whoop does not sell personal data or consumer health data. But Whoop also says that, because California’s privacy law defines a “sale” broadly, it uses third-party cookies and tracking technologies, and its website works with advertising partners.
Does Whoop share data with advertisers?
Not your health data, according to Whoop. Its policy says personalization based on health data stays inside Whoop and isn’t used for third-party advertising. Its website does use marketing cookies and advertising partners, and you can opt out of interest-based ads.
Was Whoop sued over privacy?
Yes. In August 2025, a proposed class action filed in federal court in Northern California claimed the Whoop app sent user details and heart rate data to an analytics tool called Segment without consent. These are allegations, not findings, and we found no ruling or settlement as of October 2026.
Does Whoop use my data to train AI?
Whoop says its AI coach partner gets only de-identified Whoop metrics and has a zero-retention, zero-training policy for them. Whoop keeps your coach chat history so you can see past conversations, and you can delete it.
Is Whoop HIPAA compliant?
For most members, HIPAA doesn’t apply, because it covers doctors, hospitals and health plans, not a fitness membership you buy yourself. The FTC says a lot of health-related information falls outside HIPAA. Whoop’s policy instead lists rights under state privacy laws.
Sources
- Whoop: Full Privacy Policy (last updated August 3, 2026), checked October 13, 2026
- Whoop: Privacy principles and legal policies, checked October 13, 2026
- Milberg: Whoop Health Privacy Lawsuit Alleges Unauthorized Data Sharing (August 26, 2025)
- FTC: Updated Health Breach Notification Rule (April 26, 2024)
