Mozilla report reveals wide privacy gaps among popular period tracking apps

Period tracking apps are popular digital health tools with global user count estimated to be over 250 million. Hundreds of different apps help users track their menstrual cycles to better understand their bodies, learn about symptoms and support their efforts to get pregnant. Women enter sensitive health information to get the benefits of these apps, which have widely varying approaches to data privacy. 

Reproductive health data privacy has always been important, and it has only become more critical in the years following the Dobbs decision that overturned women’s constitutional right to abortion.

“With that comes heightened scrutiny and potential criminal enforcement against patients seeking very much needed care and criminal exposure for the individuals facilitating those patients accessing that care,” Andrea Frey, co-chair of the digital health and reproductive health practices at law firm Hooper, Lundy & Bookman, said.

The Mozilla Foundation set out to evaluate the data privacy of six popular period tracking apps: Euki, Clue, Flo, Period Calendar, Spot On and Stardust. The recently published report offers insight into how each of these apps handles their users’ data and highlights the importance of understanding data privacy in the consumer health tech space.

The findings

The Mozilla Foundation report rates each of the apps on a scale of zero to 10: 

•       Euki: 10/10
•       Clue: 8/10
•       Flo: 7/10
•       Period Calendar: 6/10
•       Spot On: 5/10
•       Stardust: 2/10

Shoshana Wodinsky, a privacy research analyst with Mozilla Foundation, conducted the app tests using a networking proxy tool, Charles Proxy.

“Picture your average period app. Maybe it’s contacting its own servers or…if it’s working with something like Google or Facebook, contacting those servers, maybe having a little conversation, getting information about you from them or sending information out,” Wodinsky explained. “What a proxy lets you do is sit in the middle of those conversations and lets you see what’s being sent in or out.”

Euki, the report’s top-rated app, is designed to keep its users’ data local, and its privacy policies have remained consistent, according to the report.

“We have a variety of other functionality within the product to help keep data very in the hands of their users, not just how it’s stored, but also they have tools to delete data if they want to,” Ana Maria Ramirez, co-founder and executive director of Euki, told DHI.

Clue is upfront regarding how it will make use of the data its users agree to share: advertising, analytics and women’s health research, according to the Mozilla Foundation report. Users can change their settings after setup. In this round of testing, the report calls out that outside services may receive enough information to identify when devices are using the Clue app. 

The Mozilla Foundation report’s review of Flo highlights that the app doesn’t share its users’ health data with advertisers, analytics partners or marketing partners. The app also offers “Anonymous Mode,” an option for enhanced privacy.

The report does point to previous scrutiny of the Flo app’s handling of user health data, including a Federal Trade Commission (FTC) case against the company.

A Flo spokesperson offered insight in a written statement: “For context, between November 2016 and February 2019, Flo, like many consumer apps at the time, used certain third-party analytics SDKs to support app functionality. That practice ended more than seven years ago. In 2021, Flo entered into a settlement with the FTC relating to that historical period. The settlement included no monetary penalty and no finding of wrongdoing.” 

This year, Flo agreed to pay $8 million as part of a larger settlement stemming from a privacy lawsuit also involving Google and Flurry.

Period Calendar relies on advertising for monetization, the only app to do so among those Mozilla Foundation tested. The report does not flag any evidence of the app directly sharing health data with third-party advertisers, but it does call out investigations that found concerning privacy issues. A 2022 Vice report found datasets linked to the app’s users up for sale in a commercial data marketplace. 

The Spot On app has basic privacy protections in place, according to the report. Privacy concerns surface when users leave the app for the web. Planned Parenthood, the organization behind the app, has come under scrutiny for third-party tracking on its website. 

Stardust received the lowest rating in the Mozilla Foundation report. “It was the only app that was sending reproductive health information at all to any third parties,” Wodinsky said.

Mozilla Foundation names three third parties that receive data from Stardust: RudderStack, AppsFlyer and Facebook, owned by Meta. The report also notes that there are no clear settings that allow users to disable data collection or transmission.

“All health data remains inside systems controlled by Stardust and is used exclusively to provide core app functionality for our users,” according to a written statement from the Stardust team. “We use RudderStack solely as a technical data pipeline to transfer app event data into Stardust’s own analytics environment.”

The statement also addresses the other third parties: “We use AppsFlyer and Meta solely to measure and optimize our advertising campaigns. What they receive is basic device data and the app activity described in our ‘Allow App to Track’ prompt, not symptoms, cycle information, pregnancy status or any other health data.” 

Clue, Planned Parenthood (the creator of Spot On) and Simple Design Ltd. (the company behind Period Calendar) did not respond to DHI’s request for comment.  

Period tracking apps and the privacy gap

Users may assume that HIPAA protects the sensitive data that they enter into period tracking apps. HIPAA applies to covered entities — healthcare providers, health plans and healthcare clearing houses — and their business associates. 

“There is a lot of confusion among potential users of these apps that, ‘Well, it’s tracking health information, so HIPAA at the federal level must apply,’ and that’s incorrect,” Frey said. “HIPAA itself doesn’t apply to most, if not all, of these period tracker apps.”

While these apps likely aren’t subject to HIPAA, their creators recognize that users value data privacy. But privacy is a complicated concept without a single agreed upon definition. The Mozilla Foundation report points out that privacy washing is a concern in the period tracking app space.

“Because of the contentious state of reproductive health data here in the US, especially in the post-Roe decisioning…a lot of apps were very concerned about putting forward a privacy-friendly front,” Wodinsky said. Privacy washing occurs when privacy promises in marketing and branding do not align with data privacy practices.

“There’s a lot of mistrust in the period tracker world, rightfully so,” Ramirez said.

Evolving consumer protections

In the wake of the Dobbs decision, a number of states created laws to address this privacy gap. For example, the My Health My Data Act became law in Washington in 2023. The act expanded privacy protection for personal health data that does not fall under the protection of HIPAA.

“I expect to see more of these targeted laws trying to protect consumer health data in the hands of companies that aren’t directly subject to HIPAA,” Frey said.

While privacy protection evolves and risk related to personal reproductive health data sharing persists, period tracking app users must decide what matters most to them in terms of data privacy.

“It’s incumbent upon users to really do their due diligence and investigate because not all period tracking apps are the same when it comes to what their privacy posture is,” Frey said.

Carrie Pallardy, a Chicago-based freelance writer and editor, began her career covering healthcare more than a decade ago. Her work has taken into many different industries, but covering healthcare delivery remains a constant focus. She can be reached at [email protected] or on LinkedIn.