Researchers at North Carolina State University in Raleigh (United States) have discovered that global activity maps or heat maps from the Strava application are capable of revealing where is the address from some active users.
Strava is a platform that has more than 30 types of activities with features that help athletes explore, socialize and monitor their progress. This service has a global activity map or heat map, a feature introduced in 2018 that marks users’ physical activity anonymously. Thanks to it, they can find out which are the most traveled cycling routes or practicable trails, which allows them to improve brands or compare times with those registered by other users.
The study that has been carried out shows that, with these heat maps, the privacy of these users is violated. According to what they say, it is possible to know where your home is located, knowing the place of start and end of the registered physical activity.
Specifically, in a document that explains how they have reached this conclusion, the analysts indicate that the app allows the address of some users of the application to be identified. very active residing in remote areas.
While it is true that these heat maps record activity anonymously, researchers have found that “in areas with few active Strava users, the heat generated by an individual may be clearly visible.”
Therefore, the addresses of the houses of specific users can be discovered “effectively” based on the activity of the users and the amount of heat that is generated in that city, according to the signatories of this research.
To reach this conclusion, the recorded data was collected for a whole month and publicly available through the Strava heat map, belonging to the states of Arkansas, Ohio and North Carolina, in the United States.
Once this information was collected, image analyzes were carried out to detect areas of beginning and end of physical activity. In this way, it was possible to link the houses with the sources of activity, that is, with the users.
After comparing these data, the researchers They created maps with various zoom levels, using OpenStreetMap. Thus they were able to identify the individual addresses of these residences.
Next, a section of the user application was accessed that they had registered a specific city as their location. This could have been done unknowingly when downloading and configuring the platform.
Once this data has been gathered and accessed to public data of these users, such as timestamps or distances traveled, they were able to filter to rule out matching profiles. Furthermore, their identities could be correlated with the location of their homes by extracting information from their accounts, such as real registration names and profile photos.
From this report, in addition, they clarify that the users with the greatest probability of being located in a certain house were those who registered increased physical activity in heat maps. This is because more information about them could be collected.
So much so that, after combining the data with the OpenStreetMap maps, the researchers point out that “with the threshold of 100 meters and the publication of 308 activities, the possibility of being discovered is 37.5 percent.”
The Strava Clarification
As a result of this investigation, Strava wanted to clarify in a statement sent to BleepingComputer that “does not track users or share data without their permission” and that heat maps don’t show that heat “unless multiple people have completed an activity in a given area.”
Likewise, it has been recalled that any platform user who does not wish to contribute to these global activity maps they can deactivate it through data usage control.
However, he has said that is “continually strengthening privacy tools” and offering more information to users about features to control their privacy experience.
