Study exposes serious privacy risks in period tracking apps

Several popular digital health platforms expose users to significant period tracking app privacy risks by operating within regulatory grey areas and sharing highly sensitive reproductive data with third-party tech corporations. The findings come from a detailed study investigating how famous menstrual cycle software manages personal data. These apps frequently monitor menstrual cycles, pregnancy statuses, contraceptive usage, mood changes, and physical symptoms, creating a detailed profile of highly intimate user behaviour.

The Mozilla Foundation, creators of the Firefox web browser, published the research after auditing popular tracking platforms including Flo, Clue, Stardust, Spot On, Period Calendar, and Euki. Researchers discovered that many platforms share device identification numbers and internet usage data with advertising and analytics giants, including Meta, TikTok, Microsoft, and Google. Furthermore, the audit revealed that the Stardust app transmitted detailed reproductive health details to data management firm Rudderstack without disclosing this relationship in its official privacy policy.

Additional security flaws were identified in the Spot On application, developed by Planned Parenthood. The app links users to external websites for healthcare-related searches, resulting in the subsequent sharing of personal browsing data with analytical firms. Electronic Privacy Information Centre director Sara Geoghegan noted that data collected from such platforms forms a larger web of digital surveillance, which can become exceptionally revealing in regions where reproductive healthcare faces criminalisation or surveillance following the overturning of federal US abortion protections in 2022.

The report highlighted Euki as the top recommendation for users due to its robust protective protocols, which store data locally on the user's device and bypass account creation requirements. Clue and Flo demonstrated relative structural improvements by allowing users to opt out of targeted advertising data sharing, though they still store health histories on central servers. To mitigate period tracking app privacy risks, researchers recommend that users evaluate who sees their health data, where information is stored, and if the app developer has a history of data scandals.