Oura collects your sleep data. It won't say who else gets to see it.

What happened

Oura, the $5.2B Finnish smart-ring maker with roughly 2.5 million rings sold, told *This Week in Security* that it does in fact receive government and law enforcement demands for user data. What it would not do is say how many, from which jurisdictions, or how often it complies. The company has no transparency report, no published process for handling subpoenas, and no commitment to issue one.

The reporting comes from Zack Whittaker, who put the same question to Oura that he routinely puts to every consumer tech company that touches sensitive data: how many government demands did you receive last year? Apple, Google, Microsoft, Meta, Cloudflare, Reddit, Discord, and Automattic all answer that question in public, semiannual filings. Fitbit (now Google) is folded into Google's report. Whoop and Garmin do not publish one. Oura now joins that second list, but with an explicit acknowledgment that the demands exist.

Oura's data set is not trivia. The ring continuously logs heart rate variability, resting heart rate, skin temperature deviation, blood oxygen, sleep stages, and — for users who opt in — menstrual cycle prediction. Two years ago, after the *Dobbs* decision, period-tracking apps became a live concern for prosecutors in states that criminalized abortion. Oura's data is more granular than any standalone cycle tracker, and unlike app-based trackers it is collected passively, 24/7, from a device the user almost never takes off.

Why it matters

Transparency reports are not a legal requirement. They are a norm — one established by Google in 2010 in the aftermath of the first wave of National Security Letter disclosures, and rapidly adopted by every infrastructure provider that wanted to be taken seriously on user trust. The norm exists precisely because companies that hold sensitive data have leverage to push back on overbroad requests, and the public has a right to see whether they're using it.

The wearables industry has quietly opted out. Whoop, Garmin, Oura, Eight Sleep, and most fitness trackers publish nothing. The reasoning, when companies are pressed in private, is some version of: we're a hardware company, not a platform; the volume of requests is too low to be meaningful; publishing numbers would invite scrutiny we'd rather avoid. None of these arguments survive contact with the data itself. Oura's ring generates a higher-resolution biometric record than any phone, and any volume of requests above zero is meaningful when the data can establish location, sleep schedule, pregnancy, and physiological response.

The community reaction on Hacker News (108 points, ~200 comments at time of writing) split predictably. One camp argued that the request volume is probably small and that publishing a report would be performative. The counterargument, made well by several commenters with security and legal backgrounds, is that the size of the number is the point: if it's small, publish it; if it's large, the public has a right to know. Whittaker's reporting also notes that Oura's terms of service include a broad cooperation clause with no notice-to-user commitment. Apple, by contrast, notifies users of government requests unless legally prohibited. Oura makes no such promise.

There is a second-order issue here that the developer audience should care about specifically. Oura has an API. It has a developer platform. Third-party integrations — fertility apps, performance coaching tools, corporate wellness programs — ingest Oura data and store derived versions of it. When a government demand lands on Oura, what happens to the partner data is undefined. There is no model contract clause covering it, no published retention policy for subpoena-touched accounts, and no audit log a user can request.

What this means for your stack

If you're integrating consumer biometric APIs into a product, the absence of a transparency report is a procurement signal. Treat it the same way you'd treat a SaaS vendor with no SOC 2, no published incident history, and no DPA: a risk that has to be priced in or designed around. Specifically:

- Minimize what you sync. If your app only needs sleep score, don't pull HRV and temperature deviation. The data you don't hold can't be subpoenaed from you, and the data your vendor doesn't have to hand over on your behalf is data your users don't have to worry about. - Document the chain. When a user asks where their data lives, you should be able to answer: Oura's servers, your servers, your analytics provider, your backup. Each hop is a separate subpoena target. - Push the vendor. Procurement leverage is the only thing that has historically moved companies to publish transparency reports. Google did it after enterprise customers asked. Cloudflare did it after the EFF made it a competitive issue. Oura will do it when enough developer-platform customers make it a condition of integration.

For individual users in the audience: if your threat model includes a hostile state actor — and post-*Dobbs*, for a meaningful slice of the US population, it does — a ring that logs your body temperature every minute is not a neutral device. The mitigation is not to stop wearing it. The mitigation is to know what's collected, where it goes, and to choose vendors whose answer to "how many government requests did you get last year" is a number rather than a shrug.

Looking ahead

The wearables transparency gap is going to close, but not because the companies want it to. It will close because a high-profile case — a prosecution that turns on ring data, a civil discovery dispute, a leaked subpoena — forces it. The companies that get ahead of that moment by publishing voluntarily will look like they had principles. The companies that are dragged into it will look like Oura looks today: a company that knows the answer, has chosen not to share it, and is hoping nobody keeps asking.