I find it interesting that a lot of people seem to feel that this isn't Strava's fault, but the fault of the users who didn't manage their privacy settings correctly. Having done a lot recently related to GDPR in the EU I've been coming around to the way of thinking that has influenced this law.

We as technologists need to start taking some responsibility for our users privacy. Firstly, just because you can collect the data doesn't mean you should. There is this general idea that we should collect and store as much data as we can, just in case we can find a use for it. The problem is that firstly even if we claim to be only using/exposing 'anonymised' data, as this Strava situation shows, it is very hard to truly anonymise data. Secondly, the raw data is still stored somewhere and in the event of a data breach it doesn't matter what a users privacy setting was if you were still collecting and storing the data.