Period Tracking Apps Can Be Used In A Post Roe-v-Wade To Track Abortions
https://www.wsj.com/articles/how-period-tracker-apps-treat-your-data-and-what-that-means-if-roe-v-wade-is-overturned-11655561595?mod=hp_featst_pos3
You might not talk to your friends about your monthly cycle, but there’s a good chance you talk to an app about it. And why not? Period-tracking apps are more convenient than using a diary, and the insights are more interesting, too.
But how much do you know about the ways apps and trackers collect, store—and sometimes share—your fertility and menstrual-cycle data?
The question has taken on new importance following the leak of a draft Supreme Court opinion that would overturn Roe v. Wade. Roe established a constitutional right to abortion, and should the court reverse its 1973 decision, about half the states in the U.S. are likely to restrict or outright ban the procedure.
Phone and app data have long been shared and sold without prominent disclosure, often for advertising purposes. HIPAA, aka the Health Insurance Portability and Accountability Act, might protect information shared between you and your healthcare provider, but it doesn’t typically apply to data you put into an app, even a health-related one. Flo Health Inc., maker of a popular period and ovulation tracker, settled with the Federal Trade Commission in 2021 for sharing sensitive health data with Facebook without making the practice clear to users.
The company completed an independent privacy audit earlier this year. “We remain committed to ensuring the utmost privacy for our users and want to make it clear that Flo does not share health data with any company,” a spokeswoman said.
In a scenario where Roe is overturned, your digital breadcrumbs—including the kind that come from period trackers—could be used against you in states where laws criminalize aiding in or undergoing abortion, say legal experts.
“The importance of menstrual data is not merely speculative. It has been relevant to the government before, in investigations and restrictions,” said Leah Fowler, research director at University of Houston’s Health Law and Policy Institute. She cited a 2019 hearing where Missouri’s state health department admitted to keeping a spreadsheet of Planned Parenthood abortion patients, which included the dates of their last menstrual period.
Prosecutors have also obtained other types of digital information, including text messages and search histories, as evidence for abortion-related cases.
Millions of people have downloaded period-tracking apps to become pregnant, avoid pregnancy or simply know when their period is coming. Flo—the most popular app in the category according to app-analytics firm Data.ai—claims 48 million monthly active users. In Apple’s App Store current free app download rankings, it sits above the popular workplace-messaging app Slack.
To figure out if an app can share your data, review its privacy policy for details on what measures it takes to protect customer information, whether that information is shared or sold, and how the company responds to government requests. App developers’ lawyers often pack in technical jargon and edge-case scenarios that sound more ominous than they are, so we reached out to the companies to further explain the legalese. (See below.)
If you are concerned about shielding your health data from advertisers, hackers, law enforcement or all of the above, here’s what to know about how some of the most popular period trackers—as well as other apps—handle your information.
Mind the App
Different types of data, including information that can be subpoenaed from period trackers, can create an extremely detailed profile of you when combined. Prof. Fowler says she thinks it is likely that user data will have greater importance if more places criminalize abortion.
While period trackers collect and store health data, there aren’t typically special protections governing that information, said Prof. Fowler. Apps can use your data how they choose as outlined in their privacy policies, she said, adding that ideally the data would be stored on your devices—rather than in the cloud—and not be subject to third-party tracking.
When vetting the policy of your preferred app, here are a few keywords to search for (Command or Control + F will come in handy).
“Encrypt”: Your data should be encrypted—that is, scrambled into an incoherent string of code when it’s traveling to the server or stored on the server—to prevent hackers from accessing it. Often, companies retain keys to unscramble the code.
An even more secure form of protection is end-to-end encryption. Not even the company can see your data, so it doesn’t have anything useful to share with marketers or law enforcement in the case of a subpoena, court order or search warrant. Only your device has the keys.
Of the period trackers whose data practices we reviewed, only Apple’s Health app offers end-to-end encryption.
“Share” or “Sell”: If your data could be shared or sold to advertisers or other third parties, you may want to reconsider using the app.
When it comes to period trackers, Glow says it can share personal information for advertising purposes. Apple says data from its Health app can’t be shared or sold because it is encrypted end-to-end. The makers of Flo and Fitbit say they don’t sell personal data, but may share some anonymized data with marketing firms. The makers of Clue and Natural Cycles have similar policies, but allow their users to opt out.
“Requests”: Legal experts say companies should notify users when a court or government agency asks them for data, ideally before complying with the request. Larger companies such as Google and Apple publish transparency reports disclosing the scope of incoming requests.
All of these apps’ privacy policies say they will comply with legal requests. Flo, Apple and Fitbit have policies for notifying users when their data is requested.
Be wary of free apps, which often make money by selling ads or user data. (Also note any apps that ask for your location but don’t provide any visible use for the information, as it can be used in ad targeting.) Using a paid app isn’t a guarantee that your data is private. While Glow Inc. offers paid upgrades to its free app, its policy states that the company can still share or sell your data. Glow didn’t respond to multiple requests for comment.
Also bear in mind: Emails, messages and web searches have historically been the primary data used to build cases against people seeking abortion care, said Cynthia Conti-Cook, tech fellow at the Ford Foundation, a nonpartisan human-rights nonprofit.
“Search history and text messages actually reveal what someone was thinking, curious about, and searching for as opposed to what can be extrapolated either through locations visited or period details entered or not entered,” said Ms. Conti-Cook, author of a widely cited study on the role of digital forensics in abortion-related prosecutions.You could take your tracking off digital devices altogether. Free printable templates let you keep records the old-school way, as do fertility awareness charts for determining ovulation. After all, pen and paper can be counted on to not leak data. Period.
You might not talk to your friends about your monthly cycle, but there’s a good chance you talk to an app about it. And why not? Period-tracking apps are more convenient than using a diary, and the insights are more interesting, too.
But how much do you know about the ways apps and trackers collect, store—and sometimes share—your fertility and menstrual-cycle data?
The question has taken on new importance following the leak of a draft Supreme Court opinion that would overturn Roe v. Wade. Roe established a constitutional right to abortion, and should the court reverse its 1973 decision, about half the states in the U.S. are likely to restrict or outright ban the procedure.
Phone and app data have long been shared and sold without prominent disclosure, often for advertising purposes. HIPAA, aka the Health Insurance Portability and Accountability Act, might protect information shared between you and your healthcare provider, but it doesn’t typically apply to data you put into an app, even a health-related one. Flo Health Inc., maker of a popular period and ovulation tracker, settled with the Federal Trade Commission in 2021 for sharing sensitive health data with Facebook without making the practice clear to users.
The company completed an independent privacy audit earlier this year. “We remain committed to ensuring the utmost privacy for our users and want to make it clear that Flo does not share health data with any company,” a spokeswoman said.
In a scenario where Roe is overturned, your digital breadcrumbs—including the kind that come from period trackers—could be used against you in states where laws criminalize aiding in or undergoing abortion, say legal experts.
“The importance of menstrual data is not merely speculative. It has been relevant to the government before, in investigations and restrictions,” said Leah Fowler, research director at University of Houston’s Health Law and Policy Institute. She cited a 2019 hearing where Missouri’s state health department admitted to keeping a spreadsheet of Planned Parenthood abortion patients, which included the dates of their last menstrual period.
Prosecutors have also obtained other types of digital information, including text messages and search histories, as evidence for abortion-related cases.
Millions of people have downloaded period-tracking apps to become pregnant, avoid pregnancy or simply know when their period is coming. Flo—the most popular app in the category according to app-analytics firm Data.ai—claims 48 million monthly active users. In Apple’s App Store current free app download rankings, it sits above the popular workplace-messaging app Slack.
To figure out if an app can share your data, review its privacy policy for details on what measures it takes to protect customer information, whether that information is shared or sold, and how the company responds to government requests. App developers’ lawyers often pack in technical jargon and edge-case scenarios that sound more ominous than they are, so we reached out to the companies to further explain the legalese. (See below.)
If you are concerned about shielding your health data from advertisers, hackers, law enforcement or all of the above, here’s what to know about how some of the most popular period trackers—as well as other apps—handle your information.
Mind the App
Different types of data, including information that can be subpoenaed from period trackers, can create an extremely detailed profile of you when combined. Prof. Fowler says she thinks it is likely that user data will have greater importance if more places criminalize abortion.
While period trackers collect and store health data, there aren’t typically special protections governing that information, said Prof. Fowler. Apps can use your data how they choose as outlined in their privacy policies, she said, adding that ideally the data would be stored on your devices—rather than in the cloud—and not be subject to third-party tracking.
When vetting the policy of your preferred app, here are a few keywords to search for (Command or Control + F will come in handy).
“Encrypt”: Your data should be encrypted—that is, scrambled into an incoherent string of code when it’s traveling to the server or stored on the server—to prevent hackers from accessing it. Often, companies retain keys to unscramble the code.
An even more secure form of protection is end-to-end encryption. Not even the company can see your data, so it doesn’t have anything useful to share with marketers or law enforcement in the case of a subpoena, court order or search warrant. Only your device has the keys.
Of the period trackers whose data practices we reviewed, only Apple’s Health app offers end-to-end encryption.
“Share” or “Sell”: If your data could be shared or sold to advertisers or other third parties, you may want to reconsider using the app.
When it comes to period trackers, Glow says it can share personal information for advertising purposes. Apple says data from its Health app can’t be shared or sold because it is encrypted end-to-end. The makers of Flo and Fitbit say they don’t sell personal data, but may share some anonymized data with marketing firms. The makers of Clue and Natural Cycles have similar policies, but allow their users to opt out.
“Requests”: Legal experts say companies should notify users when a court or government agency asks them for data, ideally before complying with the request. Larger companies such as Google and Apple publish transparency reports disclosing the scope of incoming requests.
All of these apps’ privacy policies say they will comply with legal requests. Flo, Apple and Fitbit have policies for notifying users when their data is requested.
Be wary of free apps, which often make money by selling ads or user data. (Also note any apps that ask for your location but don’t provide any visible use for the information, as it can be used in ad targeting.) Using a paid app isn’t a guarantee that your data is private. While Glow Inc. offers paid upgrades to its free app, its policy states that the company can still share or sell your data. Glow didn’t respond to multiple requests for comment.
Also bear in mind: Emails, messages and web searches have historically been the primary data used to build cases against people seeking abortion care, said Cynthia Conti-Cook, tech fellow at the Ford Foundation, a nonpartisan human-rights nonprofit.
“Search history and text messages actually reveal what someone was thinking, curious about, and searching for as opposed to what can be extrapolated either through locations visited or period details entered or not entered,” said Ms. Conti-Cook, author of a widely cited study on the role of digital forensics in abortion-related prosecutions.You could take your tracking off digital devices altogether. Free printable templates let you keep records the old-school way, as do fertility awareness charts for determining ovulation. After all, pen and paper can be counted on to not leak data. Period.
