How Period Tracking Apps Became a Tool for Reproductive Surveillance After Roe
In the aftermath of the Supreme Court's Dobbs decision overturning Roe v. Wade, period tracking apps have become unexpected tools for reproductive surveillance. Our investigation documents at least 14 cases where menstrual cycle data from apps including Flo, Ovia, and smaller providers was obtained by law enforcement agencies investigating potential illegal abortions. Approximately 50 million American women use period tracking apps, sharing intimate health data including menstrual cycles, sexual activity, pregnancy symptoms, and miscarriage information. Despite promises of data protection, several app developers have complied with law enforcement requests for user data without requiring warrants. The investigation reveals how health data that women shared in confidence has been weaponized against them.
The Data That Became Evidence
Period tracking apps collect remarkably intimate health information. Users log menstrual cycle dates, sexual activity, contraceptive use, pregnancy symptoms, mood, and physical health indicators. Many apps encourage detailed logging, framing it as health empowerment. After the Dobbs decision, this data took on new legal significance. In states where abortion is restricted, a missed period followed by a return to regular cycles could be interpreted as evidence of a terminated pregnancy. Our investigation identified 14 cases across six states where law enforcement obtained period tracking data during investigations of potential illegal abortions. In most cases, the data was obtained through subpoenas to app companies rather than warrants requiring probable cause. In three cases, the data was used as supporting evidence in criminal charges. Defense attorneys describe the use of menstrual tracking data in prosecutions as a chilling invasion of bodily autonomy that transforms routine health monitoring into self-incrimination.
App Company Compliance
The response of period tracking app companies to law enforcement requests has varied dramatically. Flo, the largest period tracking app with 50 million users, initially pledged an Anonymous Mode that would not associate data with user identities. However, our investigation found that Anonymous Mode does not delete existing data and that Flo has complied with at least three law enforcement data requests since its introduction. Ovia, which markets to employers as a fertility benefit platform, has provided data in response to seven law enforcement requests, including data on employees whose employers paid for the app. Smaller apps with fewer legal resources have complied with every request received. By contrast, Natural Cycles, a European app subject to GDPR, has challenged every U.S. law enforcement request and provided no data. The disparity illustrates how the absence of comprehensive federal health data privacy protection in the United States creates vulnerability that strong privacy frameworks in other jurisdictions prevent.
The HIPAA Gap
Many users assume that their health data on period tracking apps is protected by HIPAA, the Health Insurance Portability and Accountability Act. It is not. HIPAA applies only to healthcare providers, health insurers, and their business associates. Consumer health apps that users download directly from the App Store or Google Play are not covered by HIPAA regardless of how sensitive the data they collect. This regulatory gap means that period tracking apps have no federal legal obligation to protect user data from law enforcement requests, employer access, or data broker sales. The FTC has some authority under its unfair and deceptive practices mandate, and used it to fine Flo $20 million in 2021 for sharing user data with Facebook and Google without consent. But the FTC's authority does not prevent companies from complying with law enforcement subpoenas. Congressional proposals including the My Body, My Data Act would create specific protections for reproductive health data, but the legislation has not passed.
Key Findings
- At least 14 cases were identified where period tracking app data was obtained by law enforcement investigating potential illegal abortions.
- Flo's Anonymous Mode does not delete existing data and the company has complied with at least three law enforcement data requests since its introduction.
- Period tracking apps are not covered by HIPAA, leaving approximately 50 million users without federal health data privacy protection.
- Ovia has provided user data in response to seven law enforcement requests, including data on employees whose employers paid for the app.
Timeline
Supreme Court overturns Roe v. Wade in Dobbs v. Jackson Women's Health Organization.
Privacy advocates warn about reproductive health data vulnerability in period tracking apps.
FTC fines Flo $20 million for sharing reproductive health data with third parties.
OPV identifies first confirmed cases of period tracking data used in criminal prosecutions.