Fitness tracker and smartwatch data in court: what heart rate, steps and sleep logs can actually prove

Steps counted, sleep windows, heart rate spikes, GPS run traces, and now continuous glucose readings: the modern phone and watch quietly log a detailed physiological timeline of their owner. Litigators have noticed. A sleep record that contradicts a defendant's claim of being home asleep, a heart-rate trace that shows a stress event at the time of an alleged assault, a step count that places someone walking when they said they were bedridden. This data is increasingly offered in court, and it increasingly survives challenge, but only when the proponent can answer the three questions judges actually ask: is this what the device really recorded, has it been preserved intact, and does it prove what the party says it proves?

Where this data has mattered

The landmark most practitioners cite is a 2015 Pennsylvania case where a woman's Fitbit data was tendered to contradict an insurance claim: she asserted she could not sleep and could barely move, while the tracker's logs showed a normal activity pattern. That matter settled before a ruling on the data, but it set the template. Since then, fitness-tracker evidence has featured in murder prosecutions (step counts contradicting claimed timelines), personal-injury claims (activity data before and after an alleged injury), and employment disputes (GPS jogging routes placing an employee somewhere other than their claimed location). Courts have not created special rules for this category. It is treated as digital evidence under the ordinary rules, which is precisely why chain of custody, not the technology, decides most fights over it.

The three hurdles

Authentication. The proponent must show the record is what it claims to be: data genuinely exported from the device or the vendor's cloud account, tied to the wearer. This is where the defence attacks. Was the watch actually worn by the accused, or left on a charger, or given to a child? Vendors do not verify wearers, so the authenticating evidence is usually circumstantial: pairing records, account login history, the consistency of the heart-rate signature with the person's baseline, and corroborating signals such as paired-phone GPS. A bare export file proves nothing about whose wrist produced it.

Integrity and chain of custody. App data lives in three places: on the device, in an encrypted vendor cloud, and in whatever export the party produces. The fragile point is the export. Screenshots of a dashboard are almost worthless; they are unverifiable, easily cropped, and routinely challenged. A court will want the underlying export, the account's API-obtained data if the vendor provides it (Apple Health via the clinical export, Google Fit via Takeout, Garmin and Fitbit via their account portals), plus documentation of who exported it, when, from which account, on which machine, and a hash of the files at acquisition. The same discipline as any digital forensic acquisition: document, image, hash, and never work on the original.

Reliability of interpretation. Even authentic, intact data needs an expert to say what it means. Consumer heart-rate sensing is optical and noisy; step detection miscounts driving, housework, and wrist fidgeting; sleep staging from a watch is an algorithmic estimate, not a clinical measurement. An expert who overclaims ("the data proves she was asleep") invites exclusion under reliability scrutiny; one who properly bounds the inference ("the data is consistent with sustained sleep between 23:40 and 06:10, with the method's known error rates") survives. This is where most proffered fitness data fails, not at authentication but at overinterpretation.

Practical acquisition protocol

For practitioners, a defensible sequence is:

1. Preserve early. Vendor retention varies; some platforms keep granular second-level heart data for limited windows, and a factory reset or account deletion can end the record permanently. Send a preservation demand to the vendor and, where a device is seized, isolate it from network and pairings immediately, airplane mode on, charger provided, before biometric lockouts or remote wipes intervene.
2. Acquire from the authoritative source. Prefer the vendor's official export over screenshots or the device screen: Apple Health's XML clinical export, Google Takeout, the vendor account portal, or a validated forensic tool that parses the on-device database. Record account identifiers and export timestamps.
3. Hash and duplicate. SHA-256 of every exported artifact at the moment of acquisition, working copies only, originals stored read-only.
4. Document the gap. State plainly which party exported the data, because opposing exports deserve heightened scrutiny: the party controlling the account controlled what was exported and what was quietly left out.
5. Retain a qualified expert. Sensor-data interpretation is a discipline of its own; the same expert who handles device recovery and examination is usually the right profile, since pairing and account records live on the phone.

The counterargument playbook

Challenging this evidence, the recurring themes are: the device was not worn (charger logs, phone-motion records showing the watch stationary while the phone moved); the wearer is not the account holder (shared family accounts are common); the algorithm's error rate is undisclosed and unvalidated for evidential purposes; and the export is incomplete or cherry-picked, which the hash-and-documentation trail exists to expose. A proponent who cannot answer the "was it actually on the wrist" question should expect the data to be given little weight even if admitted.

Where this is heading

As watches add ECG, fall detection, and blood-oxygen readings, the physiological record gets richer and the authentication problem does not change. What changes is volume: continuous multi-year timelines will make the "what was the person doing at 02:14" question answerable more often, and the party who acquired the data properly, early, and documented, will be the one whose version of 02:14 the court hears. The same chain-of-custody principles we apply to CCTV footage examination govern here: the technology impresses juries, but the paperwork convinces judges.