Smartwatches and fitness trackers: the security basics official guidance covers

Smartwatch security and privacy mostly comes down to a few settings: updates, a passcode or screen lock, the account behind the watch, finding a lost watch, and app and privacy permissions. Smartwatches and fitness trackers sit on the wrist all day. They can show messages, make payments and record heart rate, sleep and location. That makes the data they collect personal, and the watch itself worth protecting. This guide explains the main smartwatch security and privacy settings, what each one does and how it’s turned on.

The steps below cover Apple Watch and watches running Google’s Wear OS, based on Apple’s and Google’s own help pages. Many fitness trackers use their maker’s own app instead, and the maker’s help pages and privacy policy describe those. Guidance from the Australian Institute of Sport (AIS), the Australian Digital Health Agency and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) is included where it applies.

Why it matters

A watch is usually paired with a phone and linked to an account, such as an Apple Account, a Google Account or a tracker maker’s account. The account may hold months of health and location history. The AIS wearables privacy guide notes that wearables can collect personal details, health data, location and activity data, and that “Wearables have differing data privacy policies”, and describes reading and understanding them. The AIS guide says the maker privacy policies it links to were viewed in November 2020, so each maker’s current policy is the one to read.

Location data can also reveal patterns. In a 2019 blog post, the Australian Digital Health Agency gave the example that sharing “the location and time of your daily run” online “could represent a physical security risk.” And a watch that unlocks easily may show messages or allow payments to whoever picks it up.

How to update an Apple Watch

The Australian Digital Health Agency’s 2019 post, which names smartwatches and fitness trackers, describes keeping software current and turning on automatic updates where available. The ACSC’s tips for connected (“Internet of Things”) devices say devices without security updates “will not be protected” against new weaknesses.

Apple says an Apple Watch can be updated from the paired iPhone or on the watch. When an update is offered, Apple also describes an Update Tonight option, with the watch and iPhone left charging overnight.

Based on Apple’s instructions (checked October 2026). Menus can change between versions; Apple’s watch update guide has the latest steps.

1. Update the iPhone first. Apple says the iPhone needs the latest iOS.
2. Put the watch on its charger. Apple says it needs at least 50 percent charge, and the iPhone needs to be on Wi-Fi and nearby.
3. On the iPhone, open the Apple Watch app and tap My Watch.
4. Tap General, then Software Update.
5. Download the update, entering a passcode if asked, and leave the watch on its charger until it finishes.

Apple also describes updating on the watch itself: connect it to Wi-Fi, open Settings > General > Software Update, then tap Install.

How to update a Wear OS watch

Google says Wear OS “System updates are automatic”, and that they often install overnight while the watch charges and is on Wi-Fi. Google also says the steps “may vary based on your manufacturer, device, and software version.”

Based on Google’s instructions (checked October 2026). Google’s Wear OS update guide has the latest steps.

1. Wake the watch and press the Power button to open the app list.
2. Tap Settings, then System, then About.
3. Scroll down and tap System updates.
4. For apps, open the Play Store on the watch, swipe down, tap Settings and turn on Auto-update apps.

For other watches and trackers, the ACSC’s updates guide says to “check with the manufacturer for guidance.”

How to set a passcode on Apple Watch

A lock stops someone who picks up the watch from seeing messages or using payment features. Apple says: “With Wrist Detection, your Apple Watch locks automatically when you’re not wearing it.” Wrist Detection is on by default. Apple notes the watch passcode can be different from the iPhone passcode (“in fact, it’s better to use different passcodes”), and that turning the passcode off stops some features working, such as Apple Pay.

Based on Apple’s instructions (checked October 2026). Apple’s passcode guide and lock guide have the latest steps.

1. On the watch, open Settings, then tap Passcode.
2. Tap Change Passcode and follow the prompts. (Simple Passcode on gives a four-digit code.)
3. Check that Wrist Detection is on.
4. Optionally, turn on Erase Data. Apple says this erases the watch after 10 consecutive wrong passcode attempts.
5. Optionally, on the iPhone, open the Apple Watch app > My Watch > Passcode and turn on Unlock with iPhone. Apple says the iPhone has to be within about 10 metres of the watch for this.

How to set a screen lock on a Wear OS watch

Google says a Wear OS watch can be locked with a pattern, PIN or password, and that it “also locks automatically if it loses its Bluetooth connection with your phone.”

Based on Google’s instructions (checked October 2026). Google’s watch lock guide has the latest steps.

1. Wake the watch.
2. Swipe down from the top of the screen.
3. Tap General > Security > Lock (on Wear 2 watches, Settings > Personalization > Screen Lock).
4. Choose a pattern, PIN or password and follow the instructions.

How to protect the account behind the watch

The ACSC’s multi-factor authentication guide describes MFA as “one of the best ways to protect against someone breaking into your account.” For Apple Watch, that account is the Apple Account; for Wear OS, usually a Google Account. Our guides to iPhone security settings and Android phone security settings give Apple’s and Google’s steps for turning on two-factor authentication and 2-Step Verification. For a tracker that uses its own app and account, the maker’s help pages describe what sign-in protection is available. Our guide to how to secure your online accounts covers the general idea.

How Apple Watch backups work

Apple says Apple Watch data is backed up to the paired iPhone “automatically as long as your iPhone and Apple Watch are near each other”, and is then included in the iPhone’s iCloud or computer backup. Apple lists what’s included, such as settings, watch faces and Health and Fitness data, and what isn’t, such as Bluetooth pairings, Apple Pay cards and the watch passcode. Apple also says unpairing the watch backs it up to the iPhone first.

Based on Apple’s watch backup guide (checked October 2026), the backup depends on three things:

1. Keep the watch paired and near the iPhone.
2. Have the iPhone itself backed up, to iCloud or a computer. Our guide to backing up an iPhone with iCloud covers this, and the 3-2-1 approach to backups explains keeping more than one copy.
3. For Health and Fitness data, use iCloud or an encrypted computer backup. Apple says Health and Fitness data needs one of these.

For Wear OS watches and other trackers, the maker’s help pages describe whether data is stored on the phone, in an app or in an online account.

How to get ready to find a lost watch

Apple Watch. Apple says that if Find My is set up on the paired iPhone, “it’s automatically set up on your Apple Watch.” Apple also says that if Find My isn’t on before the watch goes missing, “there is no other Apple service that can find, track, or otherwise flag your device.” Apple describes seeing the watch on a map, playing a sound and turning on Lost Mode, which locks it and shows a contact number. With Activation Lock, Apple says the owner’s Apple Account and password “are required before anyone can erase your Apple Watch and use it with their iPhone.” Apple’s lost watch guide explains the steps, and our guide to turning on Find My on an iPhone covers the setup.

Wear OS. Based on Google’s instructions (checked October 2026); Google’s lost watch guide has the latest steps.

1. Check the watch is signed in to a Google Account.
2. On the watch, swipe down, tap Settings > Location and turn it on.
3. Tap Settings > Security > Device Administration and turn on Find Hub.
4. On a phone or computer, go to android.com/find, sign in with the watch’s Google Account and check the watch appears.

Google says Find Hub shows the watch’s current location if it’s connected to a phone, or the last place the phone and watch were connected. If the paired phone is missing too, our guide to what to do if a phone is lost or stolen covers the next steps.

How to review app permissions

The ACSC’s connected-device tips describe removing app permissions that are no longer needed, and disabling unneeded features “where possible.”

On a Wear OS watch, based on Google’s permissions guide (checked October 2026):

1. Wake the watch and swipe down from the top.
2. Tap Settings, then Apps & notifications > App permissions. (On other watches, Google describes swiping left instead, then Settings > Permissions.)
3. Tap an app.
4. Tap a permission to turn it on or off.

Google warns that “Turning off permissions may cause apps on your device to lose functionality.”

Health data on iPhone. Apple says apps must ask before reading or writing Health data, and that “you can view which third-party apps you have granted access to your Health app data anytime.” Apple’s Health privacy page says this is managed under Settings > Health, where permissions given to third-party apps can be removed. Apple also says each app is required to have a privacy policy describing its use of health data.

How to check privacy settings

Privacy settings on wearables are mostly in the companion app or online account, and they differ between makers. The AIS wearables guide describes:

• reading the device’s privacy policy
• checking privacy settings, noting that some devices are public by default
• using a privacy zone to hide a home address on shared routes
• opting out of personalised advertising where possible.

The AIS guide also notes that linking a device to social media can make data more accessible. The Australian Digital Health Agency’s 2019 post describes using privacy settings and turning off sharing features. Apple says that when an iPhone is locked, Health data is “encrypted and inaccessible by default”, except for Medical ID.

Pairing and Bluetooth. A watch usually pairs with a phone over Bluetooth. The ACSC’s mobile phone guide describes turning off Bluetooth and Wi-Fi when they aren’t being used, and its connected-device tips describe removing pairings with other devices before getting rid of a device.

Things to watch for

• Public activity feeds. The AIS notes some devices share activity publicly by default.
• Routes that start at home. The Australian Digital Health Agency’s example of a shared daily run shows how location data can reveal where someone lives or trains.
• Linked apps and social media. The AIS says linking a device to social media can make data more accessible.
• A watch with no lock. Apple says turning the passcode off stops some features working, such as Apple Pay.
• Watches that no longer get updates. The ACSC’s connected-device tips describe considering a newer device when updates stop.
• Selling or giving away a watch. The ACSC’s tips describe removing pairings first. Our guide to selling, giving away or recycling a device covers this.

Common questions

What are the security and privacy risks of a smartwatch?

A smartwatch collects personal data, so its settings matter. The AIS notes that wearables can collect personal details, health data, location and activity data, and that some devices share activity publicly by default. A 2019 Australian Digital Health Agency post gives the example that sharing “the location and time of your daily run” online “could represent a physical security risk.” A watch that unlocks easily may also show messages or allow payments to whoever picks it up. See why it matters.

How do I set a passcode on my Apple Watch?

Apple describes setting it on the watch under Settings > Passcode > Change Passcode, then following the prompts. Apple says that with Wrist Detection on, which is the default, the watch “locks automatically when you’re not wearing it.” It notes the watch passcode can be different from the iPhone’s, and that turning the passcode off stops some features working, such as Apple Pay. Steps: how to set a passcode on Apple Watch.

Can I find a lost Apple Watch?

Yes, through Find My, if it was set up before the watch went missing. Apple says Find My is set up on the watch automatically when it’s on the paired iPhone, and describes seeing the watch on a map, playing a sound and turning on Lost Mode. Apple also says that if Find My isn’t on beforehand, “there is no other Apple service that can find, track, or otherwise flag your device.” See how to get ready to find a lost watch.

Is my Apple Watch Health data backed up?

Yes, with conditions. Apple says Apple Watch data is backed up to the paired iPhone automatically while the two are near each other, then included in the iPhone’s iCloud or computer backup. Health and Fitness data is included, but Apple says it needs iCloud or an encrypted computer backup. Bluetooth pairings, Apple Pay cards and the watch passcode aren’t included. See how Apple Watch backups work.

How do I stop my fitness tracker showing where I live?

The privacy settings in the tracker’s companion app or online account are the place to look, and they differ between makers. The AIS wearables guide describes checking privacy settings, noting that some devices are public by default, and using a privacy zone to hide a home address on shared routes. It also notes that linking a device to social media can make data more accessible. See how to check privacy settings.

What do I do if my health or personal data has been misused?

IDCARE offers free support if personal information has been misused, and its contact page lists 1800 595 160 for individuals. The AIS wearables guide also mentions IDCARE for suspected breaches. For cybercrime, the ACSC runs a 24/7 hotline on 1300 CYBER1 (1300 292 371), and reports can be made through ReportCyber. Our guide to identity theft and where to get help has more.

Where to get official help

• Apple Support (support.apple.com) and Wear OS by Google Help (support.google.com/wearos) have current steps. Other makers have their own support sites and privacy policies.
• IDCARE (idcare.org, 1800 595 160) offers free support if personal information has been misused.
• ASD’s ACSC runs a 24/7 hotline on 1300 CYBER1 (1300 292 371), listed on its where to get help page. Cybercrime can be reported through ReportCyber.

Related guides

• Your iPhone: the security basics
• Your Android phone: the security basics
• If your phone is lost or stolen
• How to secure your online accounts
• Backups for personal devices: the 3-2-1 approach