Privacy International: Regulators Should Review Period-Tracking Apps
Regulators should apply “extra scrutiny to menstruation apps because they may process and collect highly sensitive health data that requires additional protections and safety measures,” Privacy International (PI) said Tuesday in a report on the privacy of period-tracking apps.
Sign up for a free preview to unlock the rest of this article
“Require apps to conduct in-depth data protection and human rights impact assessments to consider the potential harms to users and ensure the app is protecting users’ privacy in accordance with relevant data protection laws,” the UK-based charity recommended to regulators. “Ensure app developers abide by the data protection principle of transparency, including that any information relating to the processing of personal data is easily accessible and easy to understand, and that clear and plain language is used.”
Also, regulators should ensure “app developers provide clear disclosures about the data access relationship they have with third parties” and require “apps to request explicit and fully-informed consent before any data is collected, including automatic collection of device data,” and scrutinize “the use of third party deployers, particularly AI companies offering their API services to sexual and reproductive health apps.”
PI’s research, which followed up on a 2019 report, “found that, overall, period tracking apps were not sharing users’ cycle data as egregiously with third parties as we found for some apps in 2019,” it said. “Though in the course of our investigation, we did observe several categories of third parties that many apps were integrating for different purposes, such as advertising software development kits (SDKs) or application programming interfaces (APIs) to service certain app functionalities, and these third parties often processed some degree of the user's personal or device data.”
The group added, “The various technical approaches that period tracking apps utilise to service their app warrant scrutiny in a politically volatile realm.”
More U.S. states are considering measures that protect the privacy of reproductive health data after Dobbs v. Jackson, the U.S. Supreme Court’s 2022 decision overturning Roe v. Wade, and in the wake of President Donald Trump’s return to the White House (see 2502210015). A Virginia reproductive health data privacy law enacted this year is set to take effect July 1 (see 2504110039).