GPS Exchange Format

A GPX File Knows Three Things About You. What Are They?

A GPX file knows three things about you: where you stopped, where you went, where you planned to go.

Waypoints (<wpt>) are individual points — a parking spot, a trailhead, a place you want to remember. Each has a lat and lon attribute and optional children for elevation (<ele>), timestamp (<time>), name, and description. Tracks (<trk>) are recorded paths — where the GPS receiver actually went. A track contains one or more <trkseg> segments (to represent GPS signal loss or intentional pauses), and each segment contains ordered <trkpt> track points. Routes (<rte>) are planned navigation paths — where you intend to go, containing <rtept> route points.

A recorded track is history. A route is a plan. A waypoint is a landmark. The format does not confuse the three, and neither do the applications that read it. That clarity is why GPX became the default export format for Garmin watches, Strava activities, AllTrails guides, and OpenStreetMap traces — the data model maps directly to how users think about the places they keep. The model is simple. The coordinates inside it are not.

Every Consumer Map on Earth Speaks the Same Coordinate System. Why?

Your phone's GPS speaks one coordinate system. So does GPX. So does every consumer map on the internet.

All GPX coordinates use the World Geodetic System 1984 — the same datum that the GPS satellite constellation uses. Latitude ranges from -90° to +90°, longitude from -180° to +180°, stored as decimal degrees directly on the lat and lon attributes. Six decimal places give approximately 11 centimeters of precision — well beyond the 3-5 meter accuracy consumer GPS receivers typically achieve. Google Maps, Apple Maps, and OpenStreetMap all use WGS 84 natively, which means GPX files load into them without any coordinate transformation.

The elevation story is more complicated. GPX's <ele> value is meters above the WGS 84 ellipsoid, not above mean sea level. GPS-derived altitudes are typically off by 10-30 meters without a barometric altimeter (Garmin, Wahoo, and Suunto devices add one). And tracks that cross the International Date Line can render as straight lines across an entire map in tools that do not handle antimeridian wrapping — a surprisingly common bug in early web mapping libraries. That's the coordinate system. What the devices write on top of it is where the format evolved without ever changing the spec.

GPX Has Not Changed in 22 Years. Why Does It Still Express Everything a Modern Watch Measures?

A 90-minute run produces a GPX file with 5,000 timestamps, your heart rate sampled every second, and the air temperature when you started. None of that is in the GPX 1.1 spec.

GPX 1.1's most significant addition was a single element called <extensions>. It appears as an optional child of the root <gpx>, of waypoints, of tracks, of segments, and of individual track points. Extensions use custom XML namespaces to carry vendor-specific data without modifying the core schema. The Garmin TrackPointExtension v2 schema adds heart rate (<gpxtpx:hr>), cadence (<gpxtpx:cad>), temperature (<gpxtpx:atemp>), and speed — data that every fitness-oriented export now carries. Strava adds power measurements in watts. Komoot adds terrain type. Every Wahoo bike computer, Suunto watch, and Polar heart rate monitor writes similar extension blocks.

The core spec hasn't moved since August 2004. The data inside it has been evolving constantly. When a 22-year-old format can still express everything a modern fitness watch measures, it's because the format shipped an escape hatch — and the ecosystem used it.

Garmin also ships FIT, a binary alternative that is 3-5× smaller than equivalent GPX. A 10-hour cycling activity produces roughly 5 MB in GPX and 1-1.5 MB in FIT. But FIT is proprietary, requires the Garmin SDK to parse, and does not render in a text editor. For cross-device, cross-app, or cross-platform interchange, GPX still wins. GPX is also where data exposure happens — with stakes that go far beyond fitness apps.

A 13 KB XML File Exposed Military Bases Worldwide. How?

In November 2017, Strava published a global heatmap aggregating every GPS track its users had ever uploaded — anonymized, but visualized. Two months later, a graduate student at the Australian National University noticed distinct jogging patterns in the middle of the Syrian desert: running routes inside bases that did not officially exist.

A single GPX file is 13 KB of XML. The Strava heatmap was 3 TB of tiles. Both describe the same thing: someone moved through a place, and the coordinates were recorded. The compression changed. The information did not.

Every GPX file contains three streams a reader can cross-reference: precise coordinates (6 decimal places ≈ 11 cm accuracy), timestamps (every second on most fitness devices), and the creator attribute that names the device or app that produced the file. Combine any two of them across multiple files from the same person and you have enough to identify home, work, commute, and daily patterns. Garmin extensions add heart rate and cadence. Strava adds power.

The Strava incident forced two industry changes. Fitness platforms added privacy zones — radius-based location hiding around configurable addresses. Garmin Connect, Strava, Komoot, and Ride with GPS now offer the feature; users have to opt in. Defense organizations globally issued directives against fitness tracking in sensitive locations — the US Department of Defense, UK Ministry of Defence, and NATO partners all published guidance after 2018.

The format did nothing wrong. GPX records exactly what the device told it to record, accurately. The privacy problem lives one level up — in what users share and where that sharing defaults to public. A .gpx file shared publicly without trimming is an intimate dataset in a small, readable XML envelope.