Whose data is it anyway?

In October, Dexcom users in the US were asked to accept new app terms before carrying on, through a pop-up over their glucose screen, and UK users have also reported encountering a similar prompt. Shortly afterwards the Libre 3 app asked me to accept updated terms too. Those terms say a lot about who owns CGM data and what you’re allowed to do with it, and much of what’s been said about them online is either overstated or misses the parts that matter. This piece starts with a short version, then goes through it in detail, and there’s a lot of detail:

• What happened, and who spotted it first
• Accept or uninstall: why the way agreement was asked for matters, legally and for safety
• Which documents, and what we can say changed, since the dates are easy to muddle
• What Dexcom’s app terms claim about owning your readings
• What the restrictions say, and who they could reach, including open-source looping
• What Abbott’s app terms say, and how they’ve changed
• What the law makes of all this, in the UK, the US and the EU
• Where you live, because the terms differ by country
• What this means for the Diabetes Data Rights Charter, which launches next month
• Open questions for both companies, and whose data it is, on what we know so far

The short version

How bad is it, really?

Less bad than some of what’s been shared online, though not something to be ignored. In mid-October, Dexcom users in the US started seeing a pop-up over their glucose screen saying the terms had changed and to uninstall the app if they didn’t agree. Their reading stayed visible behind it, but we don’t know whether it blocked updates or alarms. Members of the UK GBDoc community have since reported seeing the same pop-up here, though we don’t yet know which terms it presented to UK users. Abbott asked me to accept updated terms in the Libre 3 app too, but I had no sensor running.

What’s actually changed?

• Dexcom’s app terms, dated November 2025, call your sensor readings “Dexcom Data” and say Dexcom owns that data. The 2023 terms called the same readings “User Data”.
• They restrict using the data for research, with other companies’ AI, to build or test other products, or to publish assessments of how Dexcom’s products perform, without Dexcom’s written approval.
• They take a broad, permanent licence over the information you enter and the app collects about you.
• For US users, the terms require most disputes with Dexcom to go to individual arbitration rather than a court, and restrict class actions, unless you use the 30-day opt-out or an exception applies. Small claims court stays open, and there are extra procedures if large numbers of people bring similar claims. The arbitration requirement itself isn’t new; the opt-out is. More on arbitration below.
• Abbott’s newest Libre licence, dated August 2026, adds a licence to use your data to train AI. It still says Abbott doesn’t claim ownership of the data you send it, and it restricts far less than Dexcom’s.

What the evidence doesn’t establish

• Dexcom’s claim to own your readings doesn’t remove your legal rights over them. In the UK and EU they remain protected personal health data whatever a contract calls them, and for US users whose glucose information falls within Dexcom’s HIPAA-covered activities, its own notice recognises a right to a copy. Those protections don’t necessarily give you unrestricted access to your readings, or freedom to use them however you like, and that gap is what most of this piece is about.
• Nothing in these documents shows Dexcom selling your data or training AI on your readings, and Dexcom says its privacy notice hasn’t changed. A lot of what’s been circulating is either old cookie wording or speculation about insurers, as Fiesler pointed out.
• If you loop with xDrip+, AAPS, Loop or Trio, the rule against unofficial apps has been in Dexcom’s terms since at least 2023, and I haven’t seen any sign of Dexcom enforcing the new wording against anyone. That doesn’t mean it couldn’t, or that the wording is harmless.
• US federal law already voids contract terms that stop consumers publishing reviews, so the ban on publishing assessments is weaker than it reads.

What is worth paying attention to

• The way agreement was asked for. An accept-or-uninstall prompt over a live glucose screen leaves very little real choice, and nobody outside Dexcom knows yet how it was risk-assessed.
• The direction of travel. Both companies have written AI into their terms, and Dexcom has written in restrictions on research, AI and publication that could reach the kind of independent analysis and open-source work this community depends on, even if some of them wouldn’t survive a court.
• Unclear versions, in two different ways. Dexcom’s app presented terms that weren’t published on its website, which still shows the 2023 terms, while another link inside the app pointed to a 2021 version. Abbott’s app presented an older licence than the one on Abbott’s own document server. Either way, it isn’t easy to know what you’ve agreed to.
• How this measures up against the Diabetes Data Rights Charter, which launches on 16 November. The roundtables behind it asked, among other things, for consent that isn’t all or nothing and for openness about how AI is trained. October’s prompt was all or nothing, and both companies’ terms contain language anticipating AI-related uses without clearly establishing which identifiable glucose data, if any, is actually used for training.
• Uninstalling doesn’t end it, on paper. Dexcom’s terms say the ownership, research, AI and publication clauses are meant to survive deleting the app, which was the only alternative the pop-up offered.

What to do

Save a copy of whatever you’re asked to accept. If you’re in the US and don’t want disputes to go to arbitration, you can opt out by emailing DexcomLegal@Dexcom.com within 30 days of accepting. And don’t uninstall your CGM app in protest mid-sensor unless you have another way of getting your readings and alarms.

The rest of this piece goes through how agreement was asked for, what both companies’ terms actually say, and what the law makes of them.

What happened

Around 12 October, Sam Andrews, a Dexcom user in the US, opened the Dexcom app and got this:

Our Terms of Use and/or Privacy Policy have changed.
By tapping continue you agree to the updated Legal Agreements.
Please uninstall app if you don’t agree.

There were two buttons, CONTINUE and View Agreements. Andrews posted an Instagram reel about it on 14 October, captioned “Dexcom users are under attack for our health and our privacy rights”. It’s one of the earliest public accounts I’ve found, it was very widely shared, and a lot of the attention this story has had started there. People were also discussing the new terms on Reddit at around the same time, so I wouldn’t claim anyone was first, but Andrews deserves the credit for getting it in front of a lot of people.

Sam Andrews on Instagram, 14 October 2026

On the night of 16 October, Casey Fiesler got the same dialog. Fiesler is a technology ethics and privacy researcher with a law degree who lives with type 1 diabetes, and did the thing most of us don’t, which was to tap View Agreements and copy out the whole document before accepting it. It runs to 15,907 words. Fiesler’s thread on Bluesky the next day picked out the ownership and AI clauses, and Dexcom put out a statement apologising for “any confusion or stress this may have caused”.

A few days after all of this I had a smaller version of the same experience with Abbott. I opened the Libre 3 app, which is on a UK account, and was told I needed to accept updated terms to carry on, and that not accepting would close the app. I read the terms before accepting, and noted that they were the September 2025 version of Abbott’s licence. I didn’t have a sensor running at the time, so nothing stood between me and a live reading, and I didn’t press decline to see what actually happened. Andrews and Fiesler both had sensors in use.

The Dexcom pop-up appears to have reached the UK at around the same time. Members of GBDoc, a UK online community of people with diabetes, reported seeing it around 15 October, give or take a couple of days, and it was discussed in several UK groups. The only screenshot shared in those posts was a copy of a US one, not one taken on a UK account, so I can’t confirm the UK prompt was identical, and none of those reports tells us which terms it presented. The November 2025 app terms are written with US law and US arbitration in mind and have no UK section, so it’s possible UK users were shown a different document. If you’ve seen the pop-up in the UK and saved what was behind View Agreements, I’d really like a copy.

Most of the arguments I’ve seen online mix up what the contracts claim with what the law would actually let a company enforce, and those two can be a long way apart. Separate from both is the way people were asked to agree, which is where I want to start, because it’s the part with a medical device on the other end of it.

Accept or uninstall

Being asked to accept new terms is usually an irritation. You tap through, or you don’t, and if you don’t you lose an app you can probably live without. A CGM app is different. For a lot of people it’s the screen they look at to decide whether to dose or to treat a low, and plenty of them don’t carry a receiver. Dexcom’s own 2023 terms said that if its apps were unavailable “you must rely upon direct use of the User Device” for monitoring. The terms define User Device as the Dexcom product the service works with, not specifically a receiver, so it isn’t obvious what someone with only a sensor and a phone is meant to look at instead.

So think about the choice as it was actually presented. The dialog sat over the glucose screen. It offered CONTINUE, which meant agreeing to 15,907 words, or View Agreements, which meant reading them on a phone. The only alternative to agreeing that it mentioned was “Please uninstall app if you don’t agree”. In the screenshot from Andrews’s reel, the last reading, 168 mg/dL with its trend arrow and the graph, is still visible behind the alert, dimmed. Most people with a sensor running aren’t going to experiment to find out whether the app keeps working with the alert in place, or what happens if they decline. They’re going to tap CONTINUE, because the stated alternative is losing the app they monitor their glucose with. In a Reddit thread from around 19 October, someone posted the same dialog on Android, over a reading of 111 mg/dL, and noted that View Agreements showed the terms as last updated in November 2025, which matches Fiesler’s copy. One reply says “Just close the ap and reopen. Agreement gone”. That’s a single unverified comment, and it doesn’t provide evidence whether the dialog came back or whether the terms were treated as accepted, but it’s a reason not to assume there was no other way back to the readings.

I can’t say what Dexcom intended, and Dexcom might well say this was a standard update flow. The effect, though, is predictable, and the law mostly looks at the choice as it was presented and its effect rather than at intent.

Where that matters legally depends on where you are, and it’s worth being clear about this before going further. The first reports, with sensors running, came from the US, where the relevant rules are US consumer, health privacy and medical device law, which I come to below. UK users have since reported the same pop-up, so the UK law in the next few paragraphs applies to it here, with the caveat that we don’t yet know which terms UK users were shown. It applies to Abbott’s prompt as well, which I saw here.

On data protection, there’s a distinction that matters. Tapping CONTINUE accepted Dexcom’s legal agreements. Accepting a contract isn’t the same thing as giving consent under data protection law, and the ICO’s guidance is that consent should be unbundled from other terms and conditions and given for particular uses of your data. Dexcom’s app terms do say that by using the products “you consent to our practices as set forth in our Privacy Policy”, but whether Dexcom treats that as consent under data protection law, and for which uses, isn’t clear from its documents. It only matters where consent is the basis a company relies on, because GDPR doesn’t require consent for everything. If it is relied on for anything beyond what’s needed to provide the service, though, the way it was asked for becomes the whole question. The UK GDPR says “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment”, and Article 7(4) adds that utmost account should be taken of whether a service is made conditional on consent to processing it doesn’t need. The ICO’s consent guidance lists the signs that consent isn’t valid, and several of them describe this dialog closely: the person “would be penalised for refusing consent”, “there is a clear imbalance of power”, “consent was a precondition of a service, but the processing is not necessary for that service”, and “the consent was bundled up with other terms and conditions”.

On consumer law, the question is fairness. The ICO and the Competition and Markets Authority set out their joint view in 2023, in Harmful design in digital markets, that the way choices about personal information are presented can itself breach data protection and consumer law, and bundled consent is one of the practices they name. The Consumer Rights Act also lists as potentially unfair a term that binds a consumer to terms they had “no real opportunity of becoming acquainted with” before the contract was made. I’d argue that an opportunity which comes with your glucose readings dimmed behind it isn’t much of one.

The same placement is also a safety question, and it’s the one a regulator of medical devices would ask. What’s documented is narrower than some of the coverage suggested: the reading stayed on screen, and I haven’t seen anyone confirm whether it kept updating behind the alert, whether alarms still sounded, whether the dialog could be dismissed and come back, or whether a paired pump or a follower kept receiving data. Nobody I’ve seen has reported a missed alarm, and I’m not suggesting anyone was harmed. But medical device makers are expected to manage risk across the life of a product, which in practice means following standards such as ISO 14971 for risk management and IEC 62366-1 for usability engineering. The US Food and Drug Administration has already recognised the wider problem: in February 2025 it warned that phone settings and software changes can stop critical alerts from smartphone-connected diabetes devices being delivered, and that missed alerts may have contributed to serious harm. That doesn’t mean Dexcom’s dialog stopped an alarm, but a modal dialog over the main glucose screen while a sensor is running, with “uninstall” as the only stated alternative, is the kind of change those processes exist to consider. That makes the placement of the dialog a legitimate risk-management and usability question. Dexcom should be able to explain how it assessed the consequences of presenting it during active sensor use, what functions remained available, and how users could continue safely if they didn’t accept the terms.

Abbott raises similar questions. Its app licence says that “depending on the update, You may not be able to use the Libre App until You have downloaded the latest version of the Libre App and accepted any new terms that may apply”, and the prompt I got offered accepting or having the app close. I had no sensor running, so there was no reading behind it. Whether Abbott’s prompt can appear while a sensor is running is one of the open questions at the end of this piece.

Which documents, and what we can say changed

Before getting into what the terms say, it’s worth being clear about which documents we’re talking about, because the dates are easy to muddle.

Company	Document	Date on the document	Where it’s been seen
Dexcom	Terms of Use (general)	25 February 2021	Linked from a menu inside the app as of 17 October 2026 (Fiesler)
Dexcom	Terms of Use (general, “Web Terms”)	26 January 2023	Published on dexcom.com, including the UK site, as of 22 October 2026
Dexcom	App Terms of Use	“Last Updated: 1 November 2025”	Presented in the app from around 12 October 2026; available on the app’s About page; not on the website as of 22 October
Dexcom	Privacy Notice	October 2025	dexcom.com, including the UK site, as of 22 October 2026
Abbott	Libre app End-User Licence Agreement and Terms of Use	“Version Date: September 2025”	The version the Libre 3 app presented for acceptance and linked to, read by me before accepting and copied in October 2026
Abbott	Libre app End-User Licence Agreement and Terms of Use	“Version Date: August 2026” (file dated 10 September 2026)	LibreView document server, UK English version, retrieved 22 October 2026
Abbott	LibreView patient terms	September 2026	LibreView document server, UK English version
Abbott	Libre global privacy notice	September 2026	Abbott’s server, UK English version

Some limits matter here. The Dexcom app terms I’m quoting are the copy Fiesler made on the night of 16 October, which I’ve no reason to doubt but which Dexcom hasn’t published. Their 2025 date tells us when Dexcom says the text was last updated, not when each clause was written or first shown to anyone, and I haven’t found any app-specific Dexcom terms between 2023 and 2025. So “not in the 2023 terms” below means not in the last publicly available document. Fiesler noted that much of the 2025 language resembles Dexcom’s terms for Stelo, its over-the-counter sensor. The relationship between the two Dexcom documents is at least written down: the 2025 app terms incorporate the 2023 terms, say they “will govern and control with respect to the use of the Dexcom Products” where the two conflict (§1.7), and supersede earlier agreements on the same subject (§15). So for the app, the 2025 wording wins as a matter of contract.

Abbott has a version mismatch of its own, and it’s worth separating three things. What Abbott has published: its document server returns a licence dated August 2026, in UK English, US English and German alike. What the app displayed: the Libre 3 app presented, and still links to, a licence dated September 2025. What I accepted: the September 2025 version, which I read before tapping accept. I don’t know what other users were shown, or why the app still presents the older version. Where I quote Abbott’s licence below I say which version I’m quoting.

What Dexcom’s app terms claim

The first thing that caught my eye is in the definitions. In the 2023 terms, the data generated by your Dexcom product was called “User Data”, and Prescription Device Users “are entitled to provide, or direct the Data Service to provide, such data and reports to others as they determine”. The 2025 app terms split this in two. A category called “Dexcom Data” includes “without limitation, the sensor readings and data from sensor readings and the glucose readings provided to you from your Dexcom Products”. User Data is now defined as information other than Dexcom Data, which is essentially what you type in or what the app collects about you. On sharing, the 2025 wording is that the Data Services “may also permit you to share certain Dexcom Data”.

Then, in the intellectual property section, Dexcom and its licensors “own all right, title and interest in and to the Dexcom Products and Dexcom Data”. What you get back is a personal, non-commercial, revocable licence to access, use and display in the Dexcom App the Dexcom Data that Dexcom displays to you. The 2023 IP clause claimed the services, apps, content and methods, but didn’t list the data. Dexcom has claimed IP in its products for years. In the documents we can compare, glucose readings are now named in the category it says it owns as well.

Separately, you grant Dexcom “a non-exclusive, worldwide, royalty-free, transferable, irrevocable, sublicensable (through multiple tiers), perpetual, fully paid up right and license” over User Data and Personal Data, to provide the products, to “maintain, support, enhance, train, and improve” Dexcom’s products and services, and to generate de-identified metrics that Dexcom then owns. It’s worth reading carefully, because it’s not obvious what it covers. Glucose readings have been moved out of User Data, but Personal Data is defined (§4.2) as User Data “and other personal information that you provide to us in connection with your use of the Dexcom Products”, and a glucose reading tied to you is plainly personal information. Whether you “provide” it, when your sensor generates it, is the kind of question a contract lawyer could argue either way. So I can’t say this licence excludes your readings, and equally the word “train” in it isn’t evidence that Dexcom trains AI on them. Perpetual licences aren’t new either; the 2023 terms took a “perpetual, irrevocable” licence over any feedback you gave. What’s different is that the licence now reaches the data you enter and the app collects about you.

None of this tells us what Dexcom actually does with anyone’s data. Dexcom says its privacy notice hasn’t changed, and Fiesler makes the point that a lot of the public alarm has been about the wrong things, such as cookie language that’s been there for years and speculation about selling data to insurers. The contract tells us what Dexcom has given itself room to do and what it says you can’t do. That’s what the rest of this is about.

What the restrictions say, and who they could reach

Many readers of this site don’t use the manufacturer’s app as the main way they see their glucose. They use xDrip+, AAPS, Loop or Trio, often with Nightscout behind them, and some do analysis on years of their own data.

The restriction on unofficial apps was already there in 2023. Those terms said you mustn’t “enable unauthorized third-party applications to access DexCom Products”, nor use an automated process to copy or scrape data, and the 2025 text carries a similar rule. Whether any particular setup breaches that depends on which agreement the person accepted, how the data is obtained and where they live. Reading a sensor directly over Bluetooth and pulling readings from Dexcom Share into Nightscout are quite different things technically, and I wouldn’t say everyone doing either is in breach. The fair statement is that this wording looks capable of being applied to some unofficial integrations.

Compared with the 2023 terms, the 2025 app terms add a set of restrictions on what you can do with the data itself.

Section 2 says you must not use Dexcom Products, Dexcom Data or User Data “in connection with any Artificial Intelligence Technology” that isn’t provided by or on behalf of Dexcom, nor to train or prompt one. Fiesler’s example was asking a language model to look at your graphs for trends, and on the wording that’s caught. The definition is much wider than chatbots, though. Artificial Intelligence Technology means machine-based systems that “infer, from the input received, how to generate predictions, recommendations, data, content or decisions that influence physical or virtual environments”, and it expressly “includes, but is not limited to, large language models, generative AI systems, algorithms, neural networks”.

It’s worth separating three questions here. Technically, most open-source dosing algorithms aren’t what an engineer would call AI. oref is a set of rules built around glucose predictions and Loop uses a model-based prediction. Machine learning turns up in only some systems and add-ons. Contractually, though, Dexcom’s definition doesn’t depend on what an engineer would call it: a system that takes glucose readings, predicts where they’re going and decides how much insulin to deliver seems to fit the words “decisions that influence physical … environments” and “algorithms” without much stretching. And whether Dexcom could enforce that against someone is a third question, which depends on the law where they live. I also don’t know how Dexcom treats the commercial pumps that use its sensors. They may count as technology “made available to you by or on behalf of Dexcom”, but that’s for Dexcom to say rather than for me to assume.

Section 6(g) says you must not use the products or data “to develop, optimize, create, train, enhance, test, or improve (directly or indirectly) any other product or service, including other software products, algorithms, applications or related services” without Dexcom’s written approval. Tuning an open-source dosing algorithm against your own Dexcom data reads like testing and improving another algorithm.

Sections 2 and 6(r) prohibit using the products or data for “research purposes, including clinical research, market research, engineering studies or other forms of research” that Dexcom hasn’t authorised in writing.

Section 6(s) says you must not “disclose, publish, share or otherwise make available any information, feedback, suggestions, benchmarking information about or related to your use of the Dexcom Products other than to Dexcom and with Dexcom’s prior written approval”. And Section 5.5 says that any “survey responses, reviews or feedback” you give Dexcom become Dexcom’s, with all the intellectual property in them assigned to it. On a plain reading, 6(s) covers a good deal of what gets posted on this site and on every forum where people compare how their sensors perform. I come back below to why it may not be enforceable.

The terms say you end the agreement by deleting the app, which is also what the dialog told you to do if you didn’t agree. Section 7.3 then lists Sections 2, 5.2 and 6 among the clauses intended to survive termination. That’s what the contract says it intends. Whether those clauses validly survive, how far they could reach data you’d already exported, and whether your statutory rights override them are separate questions, and I don’t think the text answers them.

What Abbott’s app terms say

Abbott’s Libre app licence takes a different line on ownership, though it doesn’t go as far as it might first appear. Both versions say “Abbott does not claim ownership of the data You transmit or submit to LibreView” (§13). The August 2026 version adds that “You own the data (such as your information and photos) uploaded to the Libre App and to LibreView (‘Input’)”, together with the output of the app’s AI features (‘Output’), and takes a worldwide, royalty-free, non-exclusive licence to use both “including to provide the Libre App and LibreView, improve its products and develop new products (including to train AI models)”. What it doesn’t say is whether the glucose values the app calculates from the sensor (§2 describes the app using sensor data “to calculate Your glucose and/or other analyte values”) are part of your Input. Abbott expressly recognises that you own the Input and Output it defines. Its position on the calculated readings themselves isn’t spelled out, although there’s a reasonable argument that it’s covered anyway: the licence says the calculated values “may be uploaded to and stored in LibreView”, and the ownership disclaimer applies to data you “transmit or submit to LibreView”. So the fair contrast is that Dexcom expressly claims the readings, while Abbott expressly disclaims ownership of what you send to LibreView, which on that reading would include your readings once they’re uploaded.

Both versions also let Abbott share “aggregated, anonymised, de-identified (or pseudonymised to the extent permitted by Your law) data derived from LibreView” with researchers. In the September 2025 version, the one I accepted, that sentence reads “de-identified (or pregelatinised to the extent permitted by Your law)”. Pregelatinised describes starch that’s been cooked and dried. The question is how it got through legal review into a licence about what can be done with people’s health data. The August 2026 version corrects it. It isn’t the only slip. In Abbott’s current privacy notice, the legal basis given for meeting medical device regulations is “GDPR Article 6(1)(c) and 9(1)(i)”. Article 9(1) is the general prohibition on processing health data, and it has no point (i); the condition intended is presumably 9(2)(i), which is the one cited a few lines earlier. That’s in the part of the document meant to tell you the legal basis for processing your health data, though it’s a citation slip rather than a missing legal basis, since the right condition is cited elsewhere in the same notice.

Comparing the two versions of the licence, 24 of the 26 sections are essentially unchanged. Section 2 gains optional generative AI features that give “educational insights on the impact of food and lifestyle choices on your glucose levels”, and an acknowledgement that the app “may use machine learning, and other AI technology, including generative AI”. Section 13 gains the Input and Output wording and the AI training licence. It also loses a section for EEA users only, on the EU Data Act, with two separate provisions worth distinguishing. One gave Abbott a “perpetual, worldwide, royalty-free, non-exclusive, and transferrable license” over data in which the user might have rights. The other listed what Abbott would do with non-personal data generated by the products, including aggregating it or creating derived data “including with the aim of selling or otherwise making available such aggregated or derived data to third parties”. That selling language is framed around non-personal data, and it doesn’t in itself show a right to sell identifiable glucose histories; the same section said personal data could only be used or shared where the GDPR allowed it. None of the current versions includes it. Abbott now publishes a separate EU Data Act notice, which I come to below. It covers access to data, and says Abbott “may use this data for the purposes described in our contract with you”, but it contains nothing like the perpetual licence or the language about selling derived data, so I can’t say whether those were moved, replaced or dropped. So Abbott has published app terms that make room for AI, much as Dexcom has, though the Libre 3 app hasn’t yet asked me to accept them.

The privacy notice is more specific than the licence about one AI feature. Libre Assist, it says, “uses non-personal information and images of foods”, but “further AI training of Libre Assist may combine your health-related information, such as your health metrics and information you provide about your food intake, analytes responses and related experiences to provide you with a personalised indication of how your foods may impact your analytes targets or values”. That reads as training to personalise the feature for you, and it doesn’t say every user’s glucose history is used to train anything. But it’s the clearest description either company gives of using glucose data for AI, and the notice doesn’t say whether it needs a separate opt-in or which legal basis it rests on.

The restrictions are lighter than Dexcom’s. I couldn’t find anything in either version of the Libre licence that prohibits research on your own data, using it with someone else’s AI, or publishing benchmarks. On unofficial apps, Abbott says it “does not recommend” them and that using them is “at your own risk” (§4), although the LibreView rules prohibit “accessing LibreView through any automated means, like scripts or web crawlers” (§11), which looks capable of applying to some of the tools people use to get Libre data into Nightscout.

On legal basis, Abbott’s privacy notice sets out for UK and EEA users which grounds it relies on for each purpose, which Dexcom’s doesn’t. Running your LibreView account rests on explicit consent under Articles 6(1)(a) and 9(2)(a). For scientific research on pseudonymised or aggregated health data it names Article 9(2)(a) or 9(2)(j), the research condition, which comes with its own safeguards. What it doesn’t make clear is which of those applies to each kind of research it describes, or where ordinary product development stops and scientific research starts. Pseudonymised data that can be linked back to you is still personal data, and the notice says data already pseudonymised for research isn’t deleted when you delete your account.

Withdrawing consent is also more layered than I first thought. The notice says generally that you can withdraw consent, “where and as applicable, within the app, in the website preference centre, by clicking the unsubscribe link in emails or by contacting us by phone”. The UK and EEA section says that withdrawing the consent needed to run LibreView means deleting your account. Those can both be true: marketing and some optional research can be switched off separately, while the core consent can’t be withdrawn without ending the service. What isn’t clear is where the AI training licence in the 2026 licence sits. It’s a contract term, granted by accepting the licence, and the notice doesn’t say what happens to it if you withdraw a particular consent.

What the law makes of all this

This is where the distinction between what a company claims and what it can enforce really matters. I’m not a lawyer, so if you want to rely on any of this, make sure you check it with one before taking things further, but there are several pieces of law that bear directly on these terms.

Your glucose readings are your personal data

Under UK and EU data protection law, a glucose reading linked to an identifiable person is data concerning health, which is special category data. Dexcom’s own privacy notice lists “glucose readings and related date, time, and device identifier related to that reading” as sensitive health information. A contract can call that reading Dexcom Data and claim to own it, but it can’t stop it being your personal data.

That matters most for access. You have a right of access to your personal data, and in some cases a right to data portability, which means getting data you’ve provided in a structured, machine-readable form and having it sent to someone else. The ICO’s guidance says data “provided” by you includes “‘raw’ data processed by connected objects such as smart meters and wearable devices”. There are limits. Portability only applies where the lawful basis is consent or contract and the processing is automated, and it doesn’t cover data the company has derived from what you provided. A glucose value is the sensor’s measurement of a physical quantity, which looks much more like observed data than like a profile built about you, although nobody has tested that for CGM as far as I know. It’s also worth saying that the right to erasure isn’t absolute. Medical device makers have legal duties to keep some records, and genuinely anonymised data falls outside data protection law, though calling data pseudonymised doesn’t take it outside.

Lawful basis needs two things

To process identifiable health data, a company needs an Article 6 lawful basis and, separately, an Article 9 condition, and consent is only one of the options for each. Dexcom’s privacy notice, which is the same text on its UK site, lists purposes for patients that include marketing and “internal research and development … to develop new products and services”, and separately lists possible bases including legitimate interests, healthcare, public health, research and consent “in circumstances where we have requested and received consent”. It says the bases “include those enumerated in Articles 6 and 9” of the GDPR, but not which applies to which purpose. So I can’t tell whether Dexcom treats acceptance of the app terms as consent under data protection law for using glucose data in product development, which would bring in everything I said about free choice above, or on another basis with its own safeguards.

Owning a number

Copyright doesn’t protect facts, and a glucose value of 6.4 mmol/L at 08:15 is a fact. Dexcom’s software is protected, a database can be, and a contract can bind the parties even where nobody owns the underlying facts, subject to consumer law. The UK database right protects investment in obtaining, verifying or presenting a database’s contents, and the Court of Justice held in British Horseracing Board v William Hill (C-203/02) that investment in creating the data doesn’t count. A sensor creating readings isn’t the same situation as racing fixtures, so I wouldn’t treat that as settled, but it’s an awkward starting point for a company whose device creates the readings. Claiming ownership in a contract doesn’t create a property right the law doesn’t recognise; what it can do is shape what you’ve agreed not to do.

US federal law already voids much of the publication ban

In the US, the Consumer Review Fairness Act (15 U.S.C. § 45b) makes a provision of a standard-form consumer contract “void from the inception of such contract” if it “prohibits or restricts the ability of an individual who is a party to the form contract to engage in a covered communication”, which includes a “performance assessment of, or other similar analysis of … the goods, services, or conduct” of the seller. It also voids provisions requiring you to transfer “intellectual property rights in review or feedback content”, and it makes it unlawful “to offer a form contract containing a provision described as void”. It’s worth separating two kinds of activity. For ordinary consumer reviews and assessments of how your own sensor performs, there’s a strong argument that Section 6(s), and Section 5.5’s assignment of the IP in “reviews”, are void as far as US consumers are concerned, assuming the app terms count as a consumer form contract. Independent scientific research, commercial benchmarking and developing competing products aren’t necessarily protected by the Act, which also has exceptions for things like trade secrets and confidential information. So the question for Dexcom isn’t only whether it means to enforce these clauses. It’s why it’s offering clauses that appear to conflict with federal consumer protection law.

In the UK there’s no direct equivalent, but the Consumer Rights Act 2015 says an unfair term in a consumer contract isn’t binding on the consumer, and a ban on publishing anything about your own use of a medical device without the manufacturer’s written approval seems a reasonable candidate for that test.

Arbitration and changing the terms

There are two separate 30-day windows in Dexcom’s terms and they do different things. Section 1.3 lets you reject changes to the terms by emailing Dexcom within 30 days, though it also says that continuing to use the products after opting out means you’re bound by the changes anyway. Section 9.2 lets you opt out of arbitration within 30 days of first agreeing, and says doing so “will have no adverse effect on your relationship” with Dexcom. That second one is the opt-out Dexcom’s statement pointed people to.

Arbitration itself isn’t new. The 2023 terms already required disputes to go to individual arbitration, with no jury and no class actions, and they had no opt-out. The 2025 terms keep that and add the opt-out, but they also add a “Mandatory Pre-Arbitration Claim Resolution” step (§9.1): a signed, individual notice of dispute, then 45 days of negotiation, including a telephone settlement conference if the other side asks, before anyone can start an arbitration or a small claims case. They also add a procedure for “Mass Arbitrations”, where more than 50 claimants bring similar claims through coordinated lawyers. Claims are then filed in stages, 25 per side, then 50, then 75, with a mediation after each, and the terms say your case “might be delayed”. If your claim still isn’t resolved after the third mediation, you can opt out of arbitration and go to court by giving signed notice within 30 days, and Dexcom can do the same within 14 days after that. Otherwise the remaining claims go on in batches of 200. Provisions like this are generally seen as a response to people filing thousands of individual arbitrations at once, which leaves the company facing the fees for all of them, and this one would slow that down considerably.

In practice, for a US user who hasn’t opted out, the terms mean that if a sensor or the app let you down and you wanted compensation, you’d send the notice, wait out the 45 days, and then bring your claim on your own in front of a private arbitrator, with limited room to appeal, rather than suing in court or joining a class action. Small claims court stays open for smaller claims, and the mass-claims route above has its own later exit to court. Whether the clause would actually be enforced in a particular dispute is a separate legal question. If you accepted in October, the 30-day opt-out window closes in November, and opting out is a matter of emailing your name, address and a clear statement that you don’t want arbitration to DexcomLegal@Dexcom.com. Consumers in Germany, Austria and Switzerland are excluded from the arbitration clause altogether.

For UK users, the Consumer Rights Act lists as potentially unfair a term that hinders a consumer’s right to take legal action, “in particular by requiring the consumer to take disputes exclusively to arbitration not covered by legal provisions”. Separately, the Arbitration Act 1996 makes an arbitration agreement unfair for a consumer claim of up to £5,000. So the absence of a UK section in Dexcom’s terms doesn’t mean a UK user could actually be made to arbitrate in California.

In the US

The Dexcom events happened in the US, where health privacy works differently. HIPAA applies to “covered entities”, which include healthcare providers that bill electronically, and the businesses acting for them. It doesn’t cover every health app. But Dexcom says it is one. Its own HIPAA Notice of Privacy Practices, effective since July 2023, applies when it collects health information through the G7, G6 and G5 systems and their apps “when those Products are provided to you … as a Product reimbursable (paid for by) insurance in the United States”. So where a user’s glucose information falls within those covered activities, Dexcom itself treats it as protected health information, and the notice expressly excludes some other activities, such as patient support programmes and complaint reporting.

That has consequences. Under HIPAA you have a right to a copy of your protected health information, in the electronic form you ask for where it’s readily producible (45 CFR 164.524), and a covered entity needs your written authorisation to use it for marketing or to sell it (45 CFR 164.508). The app terms don’t mention any of this, and it’s hard to see how a contractual claim to own the readings changes what Dexcom’s own HIPAA notice says it owes you for the same data. For Stelo and other data outside HIPAA, state laws fill some of the gap. Washington’s My Health My Data Act covers health data including “bodily functions, vital signs, symptoms, or measurements” and restricts collecting and sharing it without consent, though it exempts information already protected by HIPAA, and Dexcom publishes a separate Consumer Health Data Privacy Policy for those laws. The Federal Trade Commission can act against unfair or deceptive practices.

The EU Data Act

In the EU, the Data Act has applied since 12 September 2025. It gives users of connected products a right to access “product data”, meaning data generated by using the product that the manufacturer designed to be retrievable, and to have it shared with a third party. It has its own limits. Access can be restricted where it could undermine security requirements with a serious adverse effect on health or safety, and a user mustn’t use the data “to develop a connected product that competes with the connected product from which the data originate”. It’s worth noticing that Dexcom’s Section 6(g) is much wider than that, covering any other product or algorithm.

The interesting question is whether a glucose reading counts, and the Act’s own wording points both ways. Recital 15 says that data “pre-processed for the purpose of making them understandable and useable” are in scope, including data from sensors used for “determining a physical quantity or quality or the change in a physical quantity”, and a glucose concentration is a physical quantity. The same recital says that information “inferred or derived from such data”, produced “in particular by means of proprietary, complex algorithms, including those that are a part of proprietary software”, is out of scope, and a CGM’s calibration algorithm is proprietary. The Commission’s current guidance (FAQ version 1.4, 22 January 2026) says in-scope data “include measurements of a ‘physical quantity or quality'” and that “all sensor measurements require some level of interpretation before they can be communicated in a digital format”. The previous version, from September 2025, went further and said “it is not, however, the complexity of processing that renders data out of scope”, and that sentence has been dropped from the current version.

Abbott, for its part, has answered the question for its own products. Its EU Data Act notice says Libre sensors are “capable of generating certain personal data (e.g. glucose measurements)” as product data, lists the FreeStyle Libre 3 app as a related service that “will receive relevant data the connected product generates”, and says data can be retrieved through the app, downloaded from LibreView or provided on request “in CSV or similar file format”. That doesn’t settle the legal classification of every calculated value, and recognising a right of access isn’t the same as offering convenient, interoperable access: the notice describes the app’s home screen, a LibreView download and a customer-service request, not a live feed you can point another app at. But it means a manufacturer has treated glucose measurements as product data under the Act. I couldn’t find an equivalent Dexcom notice, which may only mean I didn’t look in the right place.

Where the Act applies, access is meant to be continuous and in real time where that’s technically feasible (Article 4(1)), and connected products placed on the EU market after 12 September 2026, a month before these prompts, have to be designed so users can access their data directly (Articles 3(1) and 50). The Data Act doesn’t apply in Great Britain.

Where you live

Both sets of terms are written for the US first and varied country by country. The table below shows what the contracts say. It isn’t a guide to what a court would enforce, because in the UK and the EU mandatory consumer law and data protection law apply whatever the contract says, as above. It’s also worth repeating where the prompts have actually been seen. Dexcom’s was reported first in the US, with sensors running, and then by UK users in the GBDoc community, without details of the terms shown. Abbott’s was seen by me in the UK, without a sensor running.

Where you are	Dexcom app terms: how changes take effect	Dexcom app terms: law and disputes, as written	Abbott Libre app licence: how changes take effect	Abbott: law, as written
US	Continued use is acceptance; reject by email within 30 days	California law; arbitration, with an opt-out within 30 days of first agreeing	Shown on screen; you must accept to keep using the app; refusal lets Abbott end the agreement	Illinois
UK	No UK section, so the general wording	No UK section, so the general wording	Deemed accepted unless you object within six weeks; account may then be closed on four weeks’ notice	UK
Germany	Valid reason needed, at least one month’s notice, right to terminate	No arbitration for consumers	Deemed accepted unless you object within six weeks	Germany
Austria	Email notice; 14 days before silence counts as acceptance	No arbitration for consumers	As UK	Austria
Switzerland	Email notice in advance; 14 days to object	No arbitration for consumers	As UK	Switzerland
Other EU countries	No country section, so the general wording	No country section, so the general wording	As UK	Country of residence

Dexcom’s November 2025 terms name three UK companies among the entities they cover, yet have nothing specific for the UK, so if those are the terms UK users were shown, on paper a UK user gets California law and US arbitration. For the reasons above, I doubt much of that would survive against a UK consumer. Abbott applies UK law to UK users, and its licence gives UK users six weeks to object to changes, although the separate update clause, which lets an update block the app until new terms are accepted, is the one that matches what I saw. Germany, Austria and Switzerland get advance email notice from Dexcom and a period before changes bind, which isn’t what an instant dialog does; I’ve no evidence it appeared in those countries.

None of the regional sections, in either company’s terms, changes the ownership, AI, research or publication clauses. If you’re outside the US and you’ve seen Dexcom’s dialog, I’d really like a screenshot of it and of the agreements behind it, along with the date, your country, the app and version, and whether your sensor was running at the time.

What this means for the Diabetes Data Rights Charter

The timing here is hard to ignore. A Diabetes Data Rights Charter has been co-produced over the last three years by people with diabetes, after leaders of the #WeAreNotWaiting community called for one in 2023, working with legal researchers at Birmingham Law School, University College Dublin and the Steno Diabetes Center. It launches on 16 November in Vancouver, a month after these prompts. Its final text isn’t public yet, so I can only go on what the team has published about it, mainly a 2026 paper in Diabetic Medicine by Reed-Berendt and colleagues setting out what the roundtables asked for. Read against that, October looks like a worked example of the problems the Charter was set up to address.

On control, the paper reports that participants wanted to choose what data is shared and with whom, and that this “should not be ‘all or nothing'”: people should be able to decline some uses “without losing access to their devices and associated features”. An accept-or-uninstall prompt over a live glucose screen is about as all-or-nothing as it gets. Abbott makes withdrawing the consent used to run LibreView depend on deleting the account. That may be understandable for processing the service can’t work without, but it leaves open whether you can refuse optional research or AI uses without losing access, which is the question the Charter cares about.

On access, participants wanted their data “in real time and in a format they can use”, and genuinely portable. Dexcom’s terms license you to display your readings in the Dexcom app and restrict unofficial apps, while Abbott’s Data Act notice offers the app, a LibreView download or a CSV on request. Neither looks like the real-time, portable access the roundtables described.

On transparency, the paper notes a lack of openness about “the ways in which models (including new machine learning models) are trained and developed”. Both sets of terms contain language anticipating AI-related uses, Dexcom in a licence that includes the word “train” and Abbott in an explicit licence to train AI models, without clearly establishing which identifiable glucose data, if any, is actually used for training. Add apps linking to out-of-date terms, an agreement that wasn’t published on Dexcom’s website, and a legal citation that doesn’t exist, and the trust the Charter talks about is hard to build.

There’s also an irony in the ownership argument. The paper’s authors point out that calls for “data ownership” from people with diabetes “do not fit easily within existing legal frameworks”, and that manufacturers already “exercise de facto control through technical design and contractual means”. Dexcom’s new terms are that contractual control written down, and they go a step further by claiming the ownership the community was told the law doesn’t really recognise. And several of Dexcom’s new restrictions, on research, on use with outside AI, on using the data to build or test other products, and on publishing assessments, would on their face cover exactly the kind of community work the Charter grew out of.

None of this makes the Charter binding on anyone; it sets out best practice “above and beyond current regulatory requirements”, in the website’s words. But it gives people with diabetes a clear reference point to measure these terms against, and October has given the Charter its first real test case.

Open questions

Before drawing any conclusions, there are things only the two companies can answer, and some of them could change the picture considerably.

For Dexcom. Which countries and app versions showed the dialog, and from when, and which terms were UK users shown? Was it assessed in the product’s risk management and usability files, and what happens to someone who declines with a sensor running? Did alarms, followers and connected pumps keep working behind it? Is there an authenticated copy of the app terms, and a version history showing when each clause first appeared? Why were glucose readings moved from User Data to Dexcom Data, and does the §4.3 licence over Personal Data cover them? Which Article 6 basis and Article 9 condition does Dexcom rely on for each use of glucose data in the UK, and does it treat acceptance of the app terms as consent under data protection law for any of them? Is the AI definition meant to cover open-source automated insulin delivery, and how are partner pumps treated? And can people publish their own assessments of how their sensors perform without written approval, given US law on consumer reviews?

For Abbott. Why does the Libre 3 app still present and link to the September 2025 licence when Abbott has published an August 2026 one, and will users be asked to accept the newer version? Can the update prompt appear while a sensor is running, and what remains available to someone who hasn’t yet accepted? Are glucose values calculated by the app part of the user’s Input? Does Libre Assist training use identifiable glucose histories, does it need a separate opt-in, and what is its legal basis? Which Article 9 condition applies to each kind of research on pseudonymised data, and what happened to the EEA Data Act section? Can UK users decline optional research and AI training while keeping a working app, and what happens to the AI training licence if they withdraw consent?

So whose data is it?

This is where things stand before either company has answered the questions above, and their answers could change it.

A glucose reading linked to you is your personal health data, whatever a manufacturer chooses to call it.

That doesn’t settle every question about intellectual property or about what you’ve agreed to by contract, and the law on those is less clear than either side of the online argument tends to suggest. Dexcom’s app terms now claim ownership of the readings and restrict research, AI use, product development and publication using them. Some of those restrictions look unlikely to be enforceable against consumers in the US or the UK. Data protection law doesn’t decide who owns information, so a company can hold rights in software or databases while the readings are still your protected health data. The conflict comes if those claimed rights are used to override your statutory rights to access your data or take it elsewhere, and whether Dexcom’s claimed rights exist at all, in the form it describes, is open. Abbott expressly disclaims ownership of what you send to LibreView and restricts much less, though its position on the calculated readings is unclear. Its latest version also takes a licence to use your data that includes training AI, and like Dexcom it can block the app until new terms are accepted.

The part I find hardest to defend is the way agreement was obtained. Putting an accept-or-uninstall dialog over the glucose screen of a CGM app, while people are using it to manage their diabetes, leaves them very little real choice, whatever the intention behind it. In the US, where it happened, that’s a question for the Federal Trade Commission on fairness and for the FDA on how changes to device software are risk-assessed. Now that UK users have reported the same prompt, I’d want the ICO and MHRA to look at whether it was used to obtain consent under data protection law, what that consent was meant to cover, and whether asking for it that way met the legal requirements. In the meantime, it’s worth saving a copy of whatever you’re asked to accept.

Ownership and arbitration may make the headlines, but we’re the ones wearing the sensors, and a choice between acceptance or uninstalling, while blocking access to your glucose data, isn’t much of a choice.

Sources

Dexcom

• Dexcom App Terms of Use, “Last Updated: 1 November 2025”, as copied from the app by Casey Fiesler on 16 October 2026: Fiesler’s public copy, linked from Fiesler’s thread. Not published or authenticated by Dexcom. Section numbers are given with quotations in the text.
• Dexcom Terms of Use, effective 26 January 2023, UK site, retrieved 22 October 2026.
• Dexcom Privacy Notice, last updated October 2025, UK site, retrieved 22 October 2026.
• Dexcom’s statement, as screenshots in Fiesler’s post of 17 October 2026, 18:03 UTC. I haven’t located the original post.

Abbott

• Libre app End-User Licence Agreement and Terms of Use, version date September 2025, the version the Libre 3 app presented and links to; copy made by the author, October 2026.
• Section-by-section comparison of the September 2025 and August 2026 Libre app licences, generated by script from the two texts.
• Libre app End-User Licence Agreement and Terms of Use, version date August 2026, UK English, retrieved 22 October 2026.
• LibreView patient terms, September 2026, retrieved 21 October 2026.
• Libre family global privacy notice, September 2026, UK English, retrieved 21 October 2026.

Accounts

• Sam Andrews, Instagram reel, 14 October 2026.
• Casey Fiesler, Bluesky thread, 17 October 2026.

Law and guidance

• UK GDPR, Articles 6, 7, 9, 13, 15, 17 and 20.
• ICO: right to data portability; ICO: valid consent; ICO: special category data.
• Consumer Rights Act 2015, Schedule 2, paragraphs 10, 11 and 20.
• Arbitration Act 1996, section 91, and the Unfair Arbitration Agreements (Specified Amount) Order 1999.
• Reed-Berendt R, Bell J, Hatherall L, Hayes H, O’Donnell S, Quigley M. Towards better Diabetes Data Rights: Data protection, data ‘ownership’, and developing a patient charter. Diabetic Medicine 2026;43:e70160. doi:10.1111/dme.70160.
• Diabetes Data Rights Charter, website retrieved 22 October 2026; launch date from the project’s Bluesky account, 13 October 2026.
• Consumer Review Fairness Act, 15 U.S.C. § 45b.
• Abbott EU Data Act notice, Ireland site, retrieved 22 October 2026.
• Washington My Health My Data Act: RCW 19.373.010 (definitions), RCW 19.373.100 (exemptions).
• ICO and CMA, Harmful design in digital markets, August 2023.
• FDA safety communication on missed alerts from smartphone-connected diabetes devices, February 2025.
• EU Data Act, Regulation (EU) 2023/2854, Official Journal L, 22 December 2023: recital 15, Articles 2, 3, 4 and 50. European Commission, Frequently Asked Questions: Data Act, version 1.4, 22 January 2026, and version 1.3 of 12 September 2025 for the sentence since removed.
• Dexcom Notice of Privacy Practices (HIPAA), effective 1 July 2023, retrieved 22 October 2026.
• HIPAA Privacy Rule: 45 CFR 160.103 (definitions), 164.508 (authorisations), 164.524 (right of access).
• British Horseracing Board v William Hill, Case C-203/02, judgment of 9 November 2004.