Popular period-tracking apps can hold years of personal data – new NZ research finds mixed awareness of risk

Period-tracking apps are popular digital tools for a range of menstrual, reproductive and general health purposes. But the way these apps collect and use data involves risk.

Many apps encourage users to log information well beyond their menstrual cycle, including sexual activity, medications, sleep quality, exercise, social activity and perimenopause symptoms. As well as this logged data, apps often collect location and other personally identifiable information.

Period tracking apps may pose a particularly high risk in places where abortion is illegal because user data may be accessed by law enforcement on request.

Our new research examines how aware app users in Aotearoa New Zealand are of these risks. We found a range of levels of understanding and perspectives on risk, from untroubled to concerned and deeply worried about the implications of digital tracking for reproductive rights.

Privacy, data and risk

The first period-tracking app was released in 2013. Since then, hundreds of such apps have been created, with collectively hundreds of millions of downloads worldwide.

A recent analysis found app downloads are particularly prevalent in North America, Europe, Australia and Aotearoa. The same study found three apps – Flo, Clue and Period Tracker – make up the majority of downloads.

Some period apps can link to and import information from other apps and wearables. For example, Clue can link to and import information from the Oura smart ring and Apple Health, both of which gather personal health metrics. Flo can similarly import information from other health apps.

A recent analysis of period app privacy policies found they often collect a range of personally identifiable information.

Personal health data flows to third parties

Some participants in our research have used an app for a decade or longer. This means the app holds a comprehensive database of years of intimate health data and other personal information, including some which they may not have chosen to provide.

This data can be used by a range of third parties in commercial, research or other applications, sometimes without app users’ explicit knowledge or consent. One study found many period apps exported more data than was declared in privacy policies, including to third parties.

Another study reported that apps changed privacy policies without obtaining user consent. Apps can also infer sensitive information not explicitly logged by users by combining data.

In 2021, Flo reached a settlement with the US Federal Trade Commission on charges over its sharing of user data with marketing and analytics companies without user consent.

App privacy policies often state that user data may be accessed by law enforcement on request, which is a major concern in places where abortion is illegal. Users may explicitly log the start and end of pregnancies, but pregnancy can also be inferred or predicted using other data. In some cases, period app data may therefore reveal a user’s miscarriage or abortion.

Making sense of the risk in New Zealand

Our exploration of user attitudes about the risk of period-tracking apps has revealed that about half of participants were unconcerned about their data. Some imagined positive uses for their data, such as improving the app or contributing to reproductive healthcare research. These potential uses are often highlighted by period-tracking apps in marketing materials.

Other participants were concerned about their data. Some had risk minimisation strategies, including limiting what information they logged. Concerned participants were often resigned to uncontrolled uses of their data.

One said:

[there’s] no such thing as private data these days.

Another thought that:

everyone that does anything online […] is kind of accepting the fact that your data is being potentially accessed and used by third parties. It’s just kind of where it is now.

About a third of participants in our study contextualised their concerns with respect to reproductive rights and abortion access, especially since the 2022 overturn of Roe v Wade in the US.

Others wondered if what happened in the US could happen in New Zealand. One participant referenced concepts such as rangatiratanga and mana motuhake (self determination) when thinking about period app data. She said:

I worry about the politics that happen overseas coming here to Aotearoa […] knowing that I don’t have full control or rangatiratanga over the data I provide .  I worry for all users about what this information can be used for in future, as much as we like to say ‘this is New Zealand, that would never happen here’, we have no idea.

With gender and reproductive rights at risk around the world, such concerns are reasonable and justified.

Study participants used period-tracking apps for diverse reasons, including to plan for periods, to track pain and communicate it to doctors, to help get pregnant, and to learn about their bodies. Some participants told us that using period apps was empowering. Some perceived period apps as risky, with limits to how they can mitigate the risk.

Menstruators shouldn’t have to trade data privacy and security in order to access the benefits of period-tracking apps. Legislators and policy makers should understand the benefits and risks and ensure strong data protections are in place.