Oura says it gets government demands for user data
this.weekinsecurity.com
this.weekinsecurity.com
Illinois has a tight biometric-privacy law [1]. I’d bet Oura isn’t particularly careful about prohibiting e.g. a Texas police department querying the protected information of Illinois residents.
[1] https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...
I’m assuming that Oura are assuming that this—the Illinois BIPA is toothless—is true. It is not [1].
[1] https://www.wilmerhale.com/en/insights/blogs/wilmerhale-priv...
Your cynicism is at odds with reality.
I got a check for nearly $500 because when I was an Illinois resident, one of the SV tech companies violated that law.
All it takes is one or two people to get in the ear of the right class action lawyer, and ignoring the rules quickly becomes expensive.
Or you could just grouse on HN and accomplish effectively zero.
Very strange -- it seems to be conflating end-to-end encryption with encryption-in-transit.
Encryption in transit means that network intermediates can't read the data. The two endpoints of the network communication can.
E2E encryption is more context-sensitive, and its context mostly comes from messaging. It means that the data is encrypted and that operational intermediates cannot read it. So in the context of messaging, the servers that run the messaging system cannot read the messages. Or, for an email, only the sender and recipient, not any of the intermediate email servers.
There's a big difference -- you can't really control or predict your network intermediates, but you can in theory know the operational intermediates. Whether something is E2E encrypted often depends on what intermediates you bring in to scope.
For example:
> That means that an Oura user's health data can be unscrambled at certain points as it travels from a person's ring, through their phone app, over the internet, and as it lands on Oura's servers.
If the ring uses Bluetooth to sync the data to your phone and the phone syncs data to the Oura servers, but the data is in the clear on your phone, then by this definition, it is not E2E encrypted. However, that's a pretty reasonable setup, depending on how the data on the phone is stored.
Yet another angle would be that both the phone and the ring are in one's material possession, whereas the cloud is someone else's computer, and to display a nice web UI it has to have the data unencrypted over there.
In that case, the cloud is the potentially untrusted intermediate between the data and one's eyeballs.
All of these are equally valid, it all depends on what is your threat model.
I have to disagree. It's the same thing that happened to terms such as open source. It's perfectly clear what it means but marketers intentionally attempt to mislead people for the sake of their own bottom line.
> but the data is in the clear on your phone, then by this definition, it is not E2E encrypted.
False. E2EE is centered on a given user. So long as the phone would be viewed as "yours" (ie inside your personal security boundary) by a reasonable person then it is clear that the data is E2E encrypted.
As the sibling comment notes the common issue is providing a web interface. It isn't so simple to have a remote server dish up a nice UI with lots of convenient functions while only decrypting the data on the client side. It can certainly be done but it requires developers that know what they're doing and management willing to budget for it.
I would agree with your definition that E2E means "operational intermediates cannot read it", but I would define intermediaries as people/organizations, not as devices. If my phone can read my data from my ring, that's not an intermediary because it's my phone. If a cloud server can read the data, then that is an intermediary because it's not my cloud server.
Take a messenger app using a server as middleman. E2EE means only the 2 users get to see the content, not the middleman company server. For Oura there’s only a user and the company server and a lot of people assume Oura can’t read the data, like the Signal or WhatsApp servers can’t read the data because of E2EE. The marketing usually allows or encourages this misunderstanding.
If they claim E2EE though, the interface between the user and the service (the ring or at worst the app) should mandate the encryption and the data should be decrypted only at the other end on Oura’s servers. If at any point in between these 2 ends the data is decrypted then it’s not E2EE.
Oura is not claiming E2EE and Oura is not E2EE. E2EE in the health apps would mean that Oura would not see the data. Only user could see the data in their app. Oura's privacy policy states that they do not sell your data, they limit internal access using strict safeguards (like pseudonymization, where your name is separated from your health stats), and they pledge to push back against overbroad government data requests.
Contrast Oura to Apple Health that is true E2EE. Only you and your trusted devices have the keys, Apple can't see the keys, and Apple has noting to give is it gets government request.
No, they don't. You're spreading misinformation. If the service provider can see the data then it is not E2EE. There is no room for negotiation here. Let me be perfectly clear that any service provider that claims E2EE while having access to user data is committing blatant fraud.
That said, it does not appear that Oura ever claimed E2EE. The author is merely making it clear to the reader that this is not the case.
It's only weird for the people in that middle ground where they know "something" about it, but really not much at all. There are ways to get educated and at least acknowledge the misunderstandings but who has time for that [0].
E2E explicitly means from one end to another. Obviously when the provider is one of the ends, as sender or final recipient of the data, they can have access to the data and not violate the principle of E2EE. When the provider is just an intermediary they should not be able to decrypt the data because they are not one of the ends.
Some companies slap the E2EE sticker on their product even when it's meaningless because it makes the product sound more secure. Like when they were slapping "blockchain" on everything. Or "AI" and "agentic" these days. It means nothing, it's misleading, but not factually wrong.
[0] https://www.researchgate.net/publication/342621891_Improving...
That obviously makes no sense as it renders the term entirely pointless. The entire reason for the term to exist is the difference from encryption in transit. It specifically means that one or more of the intended recipients (generally the service provider) do not have default access to the data.
The "meaningless" usage you describe is fraud seeing as it's an intentional attempt to deceive the consumer. It is factually wrong in the exact same way that slapping an open source label on something made available on github under a proprietary license is.
You can confidently say that everyone is qualified enough and understands E2EE the same way you do? Is it magic or an LLM whispered in your ear?
Because by the nature of my job I talk every 2 days with someone who doesn't really understand what E2EE is, what it does and more importantly what it doesn't do. They learn from marketing materials nit from reading technical info, you know, like almost all users out there.
Usually it's much less of a headache to luks/bitlocker/SED the whole drive so that you don't have to worry about swap files and logs
What I mean is, say I am a b2b service provider and I have a single database for some subset of my clients. That is, multiple clients data are held in the same database. There are many ways to do this but one way I have see is BYOK (Bring Your Own Key). You can have your clients give you secure access to a public/private key pair (e.g. through AWS secrets manager). Then you encrypt anything that gets written into the database using their key.
This means that if there is some security hole in your software that accidentally allows data to be exfiltrated from your servers (e.g. one malicious client sends API requests that allow for a query of data from another target client), the data the API returns will be encrypted using the target clients public/private key.
My own experience with security is that nothing is perfect and good security is like an onion. Encryption at rest isn't perfect and won't handle every possible malicious attack, but it is a layer in the broader strategy. The attacker has to both find a way to exfiltrate the data and trick the server into revealing the shared key. The idea being it is harder to do both than it may be to do either individually.
The best way to prevent the Feds from getting access to customer data is to not collect it in the first place.
Apple is subject to the same laws Oura is. The competition is too.
It doesn't really matter that the data is encrypted end to end if Apple backs up the encryption key based on a factor they already know (your password).
Apple has a great PR (propaganda) department that has convinced many people they respect your privacy. In truth, they do not. They're "better" than Google, but only slightly. And only so slightly that realistically it doesn't matter.
"Apple is taking the unprecedented step of removing its highest level data security tool from customers in the UK, after the government demanded access to user data."
https://www.bbc.com/news/articles/cgj54eq4vejo
It happened in the UK; it will not be long before it happens in the US.
--
Also, USA: https://www.bbc.com/news/technology-36084244
--
Also, France, Germany, Australia, Brazil, Japan: https://www.apple.com/legal/transparency/pdf/requests-2024-H...
--
Also, Russia: https://www.bloomberg.com/news/articles/2019-02-04/apple-fil...
--
Also, China: https://www.article19.org/resources/apple-cares-about-digita...
--
Also in general: https://proton.me/blog/iphone-privacy
Also, the US Government has already demanded that Apple weaken device encryption.
Apple fought it in court, and the government dropped their demand rather than set a privacy precedent they wanted to avoid.
I'm not even much of a fan of Apple but I really don't think you can hold it against them when they loudly protest but ultimately comply with legal demands.
They did exactly what they should have. Their choices were build a backdoor or disable the advanced data protection feature in the UK. They also made it incredibly public.
All it takes is a political sea change for E2EE to go away.
Apple already has to hand over a wealth of information when asked by the feds.
Previously, they refused US government demands for a backdoor that would allow them to unlock locked devices.
Does that mean that instead of UK government accessing the data (through a backdoor), UK government can now access to data (because it's not encrypted at all)?
They offer standard encryption by default, where they hold a copy of your encryption key and can assist you if you lose access to your key.
They also allow you to opt into advanced data protection, where they do not have a copy of your encryption key, so you need to be sure you protect it yourself.
If a company has a copy of the customer's encryption key on their server, you have no choice but to hand it over in response to a warrant, as we recently saw with Microsoft handing over the bitlocker key for a customer's computer.
After Apple's announcement that they would remove encryption from UK users rather than weaken it, the bad press and public pressure forced the UK government to back down.
> UK backs down in Apple privacy row, US says
That makes it very nearly meaningless.
We've never had so many threats to our privacy and liberties heaved upon us, and the rate is accelerating.
> Cook conveyed to lawmakers that device-level age assurance proposals should not require the collection of sensitive data like birth certificate or social security number, and that parents should be trusted to provide the age of a child when creating a child's account. Any data used for determining age should not be kept by app stores or developers, according to Apple.
https://www.macrumors.com/2025/12/10/tim-cook-age-verificati...
They have also abided by the UK's demand to disable E2EE.
Apple's resolve is quickly overcome by any threat to their revenue. They're one law away from handing over all of your data to the feds.
https://www.mintpressnews.com/apple-israel-unit-8200-hiring/...
Wonder what makes you you think so. Care to elaborate? Really hope it's not their ubiquitous ads showcasing how they "treat privacy seriously".
You’re more concerned about privacy when it comes to TV viewing than medical data? What a strange hijacking of a serious thread…
Thinking more on this I think a business opportunity in the future will be companies that design hardware stacks that can go in random appliances that can gather usage information in the name of telemetry.
I give it +/- 5 years before an OTS coffee maker at walmart phones home.
AFAIK, they even have some watches with no radio hardware so that they can be used in sensible environments.
I wish Casio, Polar, Suunto and others provided this functionality.
There is some community software for Polar that enables offline data exchange, but it is a bit hacky, and OFC no firmware updates.
Suunto used to have a really good offline solution, but they discontinued that and moved to the cloud.
I’m probably missing something, but I can’t think of anything you lose if you don’t use the phone app.
I'm only a casual fitness tracker so the Apple Watch fits my needs better.
I suppose one option would be to enable data syncing to Apple Health, and periodically delete/create new Oura accounts to purge historical health data. Not a great workflow, but would let you benefit from E2EE with Apple Health while using Oura (assuming Oura’s “delete account and all data” does what it claims)
"Mr Smith has been running again, we better bring him in for questioning!"
Edit: to be clear, the government is requesting the data, so clearly they're doing something with it... But what? I don't see it!
Tech companies when they speak to VCs: look at all the creepy things we can infer with ooodles of aggregated data and AI to maximize targeted ad revenue, we're worth 50x what an equivalent non-tech company in our sector is valued, because of all the things we can do with all that data from all those people together
Tech companies when they speak to their customers: oh you're so silly to even ask about privacy, what possible utility could there be in that single isolated variable?
What could they possibly do from this single variable???
Bad health? Raise the insurance premiums? Or anything more evil I can't think of.
edit: grammar
A capitalist, or as in this case, fascist, state might figure out all sorts of interesting things from mass surveillance, such as who might be disloyal, who is eligible for eugenic culling, who might be fun to deport, and who is vulnerable to sticks or carrots or both and could do something for the state that the state does not want to do directly.
(Note 1:"Dr. Bootlicker, the defendant wants the court to believe that she calmly placed herself between the agent and the minor he was trying to apprehend, and asserts that the agent's claim, that the defendant's actions constitute assault, is, in her words, 'ridiculous'. But am I correct in understanding that you view minutes 8 and 9 of the biometric data submitted to the court as characteristic of significant physical exertion that might be similar to that undergone by an assailant while commiting an assault?")
For example, A is known to have been an associate of B. B died violently at a certain time and date. Phone data put both of them in the same general area around that time. A seems evasive and won't talk. But A's biometric data reveals intense physical activity around the time of B's death...
Other suggestions in this thread like algorithmically making things worse for people in general are predicated on continual availability for a whole deanonymized population.
It's not in isolation. It's in aggregation. So you end up with
"Mr. Smith's heart rate goes off the charts for six minutes every time his phone visits this apartment building in the middle of the night and is within radio range of Ms. Jones' phone."
Social media, mostly.
So, why are we seeing articles like this, which raise suspcision that maybe a wearable smart-device company _might_ be sharing _some_ data, _sometimes_? Or expectations of voluntary transparency?
Yes, the government spies on you. Not because you're important, but because they spy on everybody. It's cheap, convenient and has no negative political consequences (so far).
References:
* https://en.wikipedia.org/wiki/National_security_letter
* https://www.pcmag.com/news/the-10-most-disturbing-snowden-re...
It is incredible to read "I believe company A only!". They need to educate themselves otherwise noone would be able to stop the government machine.
Government can already get ALL your celltower locations without a warrant
AND read all your emails and text messages that are over 6 months old, without a warrant
Assuming you meant directly from the telcos and not from the data broker loopholes - in which case pretty much anyone should be able to do that. Emails and texts they still need a warrant for.
Source for this? Was it big news? First I've heard of it.
Why do you think she had a personally owned email server in her basement instead of using a 3rd party?
Bill Clinton signed 1986 Electronic Communications Act into law
https://en.wikipedia.org/wiki/Electronic_Communications_Priv...
Any communication, email, sms, etc. on a 3rd party like Gmail that is 180 days old is simply considered "abandoned" under that law and can be read without any judicial oversight, no warrant needed. Major services even have portals for law enforcement to just browse away
Congress purposely never updates the law, it's 40 years out of date
Clinton signed the 1996 Telecommunications Act which also had problems but which didn't change this specific legal norm.
Why do you think she had a personal email server in her basement instead of using a 3rd party?
Bill Clinton signed 1986 Electronic Communications Act into law
https://en.wikipedia.org/wiki/Electronic_Communications_Priv...
Any communication, email, sms, etc. on a 3rd party like Gmail that is 180 days old is cleverly considered "abandoned" under that law and can be read without any judicial oversight, no warrant needed. Major services even have portals for law enforcement to just browse away
Congress purposely never updates the law, it's 40 years out of date despite people having years of email, SMS, DMs in their accounts as typical behavior
And a reminder that the cloud is someone else's computer, and your data in someone else's computer won't only be yours.
But every one of these devices demands some Android/Apple app, and shipping all my health data to basically non-HIPAA data brokers.
Id be all over a local-only no-data-exfiltration health tracker. But the companies do NOT want to provide that.
I, uh, guess, "go surveillance capitalism", for more choices?
In overly simple terms, if insurance is not involved, then it’s not subject to HIPAA.
Everything about that company is disgusting.
Such a shame, too. I was eager to learn more about my health.
As has been noted on HN several times, there are cars that monitor when you have sex in them. You might be surprised what is known and by whom.
There is no proof they actually have that capability, it is just mentioned in their privacy policy.
Can you share some links?
We own a Kia. I'd offer to do a GDPR data request, but my data would not give us any useful signal here lol.
But oh don't worry, since they are selling the tokens at a loss, this data sale doesn't matter.
My non-training data should be such that I pay them to extract it from me.