Fitbit, Jawbone, and other fitness wristbands will imminently be hit with formal complaints from Norway's consumer watchdog for breaking European privacy laws, Ars can reveal.

It comes after the Norwegian Consumer Council filed a complaint against fitness app Runkeeper in May for illegally sending users' personal data to a third party in the US, even when not in use.

The new complaint against Fitbit, Jawbone, Garmin, and Mio will be sent on Thursday to both the data protection authority and Norway’s consumer ombudsman.

None of the four companies gives users proper notice about changes in their apps' terms and conditions, the complaint claims, and all of them collect more data than is strictly necessary to provide their service. Nor do the companies fully explain who they may share user data with, or for how long they retain that data.

As part of its AppFail campaign earlier this year, the Norwegian Consumer Council analysed the terms and conditions and privacy policies of dozens of everyday mobile phone applications. It found that fitness trackers were particularly bad at looking after personal data. Following the 24-hour readout of those T&Cs—designed to shame companies into behaving better—some did update their policies.

"An increasing number of devices come with data-collecting sensors and are connected to the Internet. Consumers have little access to information about where their personal data are being sent, and how this is used. We fear that this information can be exploited for direct marketing and price-discrimination purposes, and that basic privacy principles are being neglected," the council's digital services director, Finn Myrstad, told Ars.

However he was optimistic that the new complaint might lead to better results, because—unlike apps—the wearables are physically sold in Europe.

Users shouldn’t have to surrender basic consumer and privacy rights when using these wristbands, and—although the complaints related specifically to the apps—the wearable and app are complementary, Myrstad said. "A user cannot make full use of the wristband without downloading the app and vice versa."

"We see this as a way of testing the waters for the Internet of things," Myrstad added.

Connected household and other devices are entering the market rapidly, and many of the service providers are based in the US. Since these devices usually require an app to function, there is a question of jurisdiction, as the physical products are sold in European countries, while the app stores are based in the US. We want to demonstrate that the apps should be bound by the same rules as the products they are connected to, in order to avoid that consumer data processed by these apps disappear into the legally muddled waters of software and licences.

The consumer rights' body has a list of demands for companies: it wants users to be able to change privacy settings in the app itself, and public sharing of information should be off by default.

It also wants apps to make data available for the user to download or upload in a universal machine-readable format.

Finally its says that "it should not be more difficult to delete an account than it was to create it," and once deleted, users' data should be removed as well.

According to Google Play figures, Fitbit's app has been downloaded anywhere between 10 and 50 million times, Jawbone one and five million, Garmin five and 10 million, and Mio up to 500,000 times.

Ars sought comment from the four wristband firms named in the complaint. At time of publication, only Fitbit had responded with a statement. It told us:

We share the Norwegian Consumer Council’s commitment to protecting consumer privacy, and we look forward to working with them and regulators to continue to ensure strong privacy practices are in place. Fitbit is committed to protecting the privacy of our users' data and the trust of our customers is paramount. It has always been our policy not to sell user data; we have never sold personal data and we do not share personal data unless a user specifically directs us to do so, or under the limited exceptions described in our privacy policy. Furthermore, Fitbit tries to employ clear, non-legalese language in our policies so our users understand what data we collect and how we use it, and we continually look for ways to improve our written policies.

Fitbit, which has a registered European headquarters in Ireland, submitted its self-certification of adherence to the much maligned Privacy Shield framework on September 29.

Privacy Shield—the successor to the jettisoned Safe Harbour deal—allows personal data to be transferred from the European Union to the US on the understanding that it will be treated in accordance with the bloc's data protection laws.

Norway’s national law also falls under the EU Data Protection Directive.

Update

Jawbone gave Ars the following statement after this story was published: