Should you worry about the data from your period tracking app being used against you?

It is estimated that millions of people in the United States use menstrual tracking apps to plan ahead, track ovulation time, and monitor other health effects. Apps can help indicate when your period is late.

After Politico published on May 2 draft opinion From the Supreme Court noting that Raw vs. WadeThe law that guarantees the constitutional right to abortion will be repealed, people are turning to social media. They were expressing concerns about the privacy of this information – especially for people who live in countries with severe abortion restrictions – and how it could be used against them.

Recommended by many users Delete immediately All personal data from period tracking apps.

Activist and Advocate “If you use an online period tracker or track your cycles through your phone, remove it and delete your data” Elizabeth McLaughlin said in a viral tweet. “right Now.”

Likewise, Eva Galperin, a cybersecurity expert, data said It can be “used to sue you if you choose to have an abortion.”

This led us to wonder – are these concerns justified, and should people who use cycle tracking apps delete the data or the app entirely from their phone? We asked the experts.

Is period tracking app data shared?

Privacy policies — specifically, whether apps sell information to data brokers, use the data for advertising, share it for research, or just keep it within the app — vary widely between companies.

“Is it encrypted? What is its business model?” said Lucia Savage, chief privacy and regulatory officer at Omada Health, a digital therapy company. “If you cannot find the Terms of Service or Privacy Policy, do not use this app.”

Period-tracking apps are often not covered under the Health Insurance Portability and Accountability Act, or HIPAA, although if a company is paying for health care services, they could be. However, HIPAA does not prevent the company from sharing non-identifying data. If the app is free — and the company is monetizing the data — then “you are the product,” Savage said, and HIPAA does not apply.

Study 2019 Posted in BMJ It found that 79% of the health apps available via the Google Play Store regularly share user data and were “far from transparent”.

When it comes to marketing, pregnant woman’s data is particularly valuable and can be difficult to hide from A barrage of cookies and bots. Some menstrual tracking apps, which often request health information along with menstrual cycle details, also participate in the broader internet data economy.

“The data can be sold to third parties, such as big tech companies; or to insurance companies, where it can then be used to make targeting decisions, such as selling you a life insurance policy, or how much your premium should be,” Julia de TonyHe is a researcher in health and artificial intelligence at the University of Edinburgh in Scotland.

Flo Health, headquartered in London, He settled with the Federal Trade Commission last year Because of allegations that the company, following promises of privacy, has shared health data of users who use its fertility tracking app with third-party data analytics companies, including Facebook and Google.

In 2019, Ovia Health criticize To share the data – though not identified and aggregated – with employers, who can purchase a pregnancy and pregnancy tracking app as a health benefit for their workers. People using the employer-sponsored version must currently opt in to this type of data sharing.

Ovia nearly 10,000 words private policy It details how the company shares or sells anonymous health data and uses tracking technologies for ads and analytics on its free, consumer-oriented version.

For residents of Europe, companies must comply with the most stringent General Data Protection Regulation, which grants data ownership to the consumer and requires consent before personal data is collected and processed. Consumers also have the right to have their data erased online.

Companies have the option to extend these rights to people living in the United States via their privacy policies and terms of services. If they did, the Federal Trade Commission (FTC) could hold companies accountable for those obligations, said Devin McGraw, Invitae’s head of data stewardship and former deputy director for health information privacy at the Department of Health and the Office of Human Services for Civil Rights.

The period tracking app Cycles, which is owned by the Swedish company Perigee, falls into this category. The Company undertakes to its users not to make any advertisement or sell data to third parties. Instead, the company’s spokesperson, Ranil Engineers, said it only makes money through subscriptions.

Interested customers are reaching out to another health app, Clue, developed by a Berlin-based company. “We fully understand this concern, and want to reassure you that your health data, especially any data that Clue tracks about pregnancies, pregnancy loss, or miscarriages, remains confidential and secure,” Clue co-CEO Carrie Walter said in an email. statment.

Some countries, such as California And Virginiahas statewide laws that give users ownership of their information and whether it is sold to third parties.

Data brokers trade in other types of information, such as location tracking data of people who have visited Planned Parenthood, that could potentially be purchased by law enforcement or government officials. Earlier this month, SafeGraph stopped selling mobile phone tracking data that maps the movements of people who visit Planned Parenthood, how long they stayed, and where they went next, Vice reported a week’s data purchase of $160.

Also of concern is the level of data security in the company, and the extent to which it has been compromised. “Piracy is a criminal process, there is no doubt about it,” Savage said. “But once it’s hacked, the information can be released.”

Could this data be used in a criminal trial?

The short answer is yes.

“It’s almost realistic that in some states, using the period app might get you in trouble,” McGraw said. “But if abortion is a crime, it can be accessed in bringing a case against you.”

She added that this depends on where you live, but there is no federal protection against this happening from a privacy standpoint. Last year, Senator Ron Wyden (Raw Democrat) introduced The Fourth Amendment is not to the Sales Act, which would prevent data brokers from selling personal information to law enforcement or intelligence agencies without court oversight. But the legislation has not yet been put to a vote.

Wyden told KHN that he is “absolutely” concerned that people who seek abortions may be criminalized through their phone data.

“It’s a really ominous possibility that their personal data will be used as a weapon against them,” Wyden said. He said, “You have to decide on these massive data sets – are they going to protect the privacy of the women who deal with them? Or are they going to primarily sell to the highest bidder?”

In the absence of federal law, if law enforcement obtains a court-ordered subpoena, it can be difficult for the company to resist turning over data on a particular case.

“Given the breadth of surveillance laws in the United States, if a company collects and retains information, that information is subject to compulsion by law enforcement,” he said. Amy Stepanowicz, privacy attorney and vice president for US policy at the Future of Privacy Forum. “They do not necessarily have the ability to lawfully retain this information from law enforcement once the appropriate process has been carried out.”

However, even in states with strict abortion restrictions on the books, a lot depends on how those laws are structured. Last month, for example, the murder of a Texas woman charged with an “intentional abortion” I refused After the attorney general found it did not violate state law, which criminalizes abortion providers, not patients.

if Raw vs. Wade 14 states have so-called employment laws that will take effect automatically and ban abortions entirely or after specific time periods – for example, six weeks or 15 weeks, According to KFF . analysis.

“It’s really complicated under the hood, but I don’t think people should blindly assume that their data is safe from legal process,” Savage said. It added that it could depend on the company’s approach to the subpoenas. Some will fight them while others will not.

Take Apple, for example, which Repeatedly resist Unlock iPhones for law enforcement in high-profile cases like the 2015 San Bernardino shooting. Data in Apple’s Health app, which includes a cycle tracker, is “encrypted and inaccessible by default,” according to the Company privacy policy. All health data in the app is kept on the person’s phone, not stored on servers. But at the same time, Savage said, people who live in low-income communities don’t always own an iPhone because it’s an expensive piece of equipment.

Ovia’s Privacy Policy states that the Company may provide data to law enforcement authorities if required to do so by law or a subpoena. However, the company said in a statement that it has “never provided Ovia user data to any government, and we have never received any government requests for access to Ovia user data.” There is also an option in the Ovia account settings to permanently delete account data.

Despite the guarantees in place under the GDRP, period trackers can still be called up in Europe as well. Li Tiana senior lawyer at the Electronic Frontier Foundation.

“even in [European Union] Tian said companies are subject to US legal action, although it will take longer. “The United States has mutual legal treaties with other countries, including the European Union, and law enforcement knows how to share information.”

Has this type of information been used by public officials or law enforcement agencies before?

Officials with anti-abortion views have benefited from period tracking information in the past. In 2019, former Missouri Health Director Dr. Randall Williams got it spreadsheet Tracking the menstrual periods of women who visited Planned Parenthood in an effort to identify patients who experienced a miscarriage that failed to terminate a pregnancy.

During the Trump administration, Scott Lloyd, former refugee resettlement chief and anti-abortion activist, admitted Tracking the menstrual cycles of teenage immigrant women trying to prevent them from having an abortion.

“We’re now thinking about cycle trackers the way we’ve been thinking about facial recognition software for years,” Savage said.

Should you delete a period tracker app?

Experts said it’s unlikely that a period tracking app will be the only evidence used if someone is building a case against you for seeking an abortion.

“Frankly, I think if law enforcement or a civilian investigator were trying to figure out who was doing the abortion, there would probably be several other places that were more realistic or more useful right away,” Stepanovich said. She continued, “They could potentially get a dump of information about relevant data, such as trying to get the location information of every person who was delivered near an abortion center, which is a much smaller data set, or getting people who called abortion hotlines at times specific”.

Stepanovich added that as long as someone uses a smartphone with any kind of apps on it, there is a risk that the data could be obtained and used as part of a criminal or civil trial. Conclusion: The only way to completely avoid risks is to not use the smartphone.

But McGraw took a more cautious approach: “If I lived in a country that thought data could end up in the hands of law enforcement, I wouldn’t track [my period] Absolutely.”

Ultimately, people who use neighborhood time tracking apps should be aware of the risks of using technology considering the benefits it brings to their lives.

“You have to think about what you need in terms of tracking your period,” Tian said. “You have to weigh in and ask yourself, ‘How important is this comfort really to me?’ “

KHN (Kaiser Health News) is a national newsroom that produces in-depth journalism on health issues. Along with policy analysis and survey, KHN is one of the three major drivers in KFF (Caesar Family Foundation). KFF is a non-profit organization that provides information on health issues to the nation.

Use our content

This story can be republished for free (details).