Only 1 in 25 Reproductive Health Apps Protects User Data

The Mozilla Foundation looked into 25 popular reproductive health apps and wearable devices to investigate their privacy and security policies. Eighteen of them had vague privacy policies with no clear guidelines on how they share data with U.S law enforcement, Mozilla found. Apps including Flo, Glow, Period Calendar Period Tracker and My Calendar Period Tracker were looked into. Those apps with muddy guidelines received a Privacy Not Included warning label by Mozilla, which is best known as the creator of the web browser Firefox. "Overnight, apps and devices that millions of people trust have the potential to be used to prosecute people seeking abortions," said Ashley Boyd, Mozilla’s vp of advocacy. "Our research confirms that users should think twice before using most reproductive health apps; their privacy policies are riddled with loopholes, and they fail to properly secure intimate data." Millions of Americans use mobile apps that collect troves of personal information, including phone numbers, emails, home addresses, menstrual dates and doctor’s appointments. The post Roe v. Wade world heightened the realization of a lack federal protections around user data. While such apps use data for ad targeting, the investigation found the increased potential for law enforcement action in states where abortion is now outlawed. Overturning Roe v. Wade Sparked a Number of Privacy Bills, but None Are a Quick Fix Meanwhile, the Flo app is under investigation by the Federal Trade Commission (FTC) and is the subject of a class action lawsuit for sharing people’s fertility data with third parties like Facebook and Google, despite stating otherwise. Another app—Sprout Pregnancy—allows users to build personal pregnancy timeline calendars and collects intimate data such as weight, doctor’s appointments, birth plan and pregnancy journals. Mozilla found it lacked a privacy policy. Sprout has more than one million downloads in the Google Play store. Sprout Pregnancy tells Adweek the Mozilla research is flawed and that its privacy policy is freely available in the Apple and Google app stores. Further, Sprout tells Adweek the app does not require a username or password and the data is only backed up to the user’s personal iCloud or Google Drive account. Mozilla found the My Calendar Period Tracker, an app with more than 10 million downloads in the Google Play store, did not have a privacy policy that Mozilla could find. Instead, the app linked two outside policies, from the Google Play store and the Apple App store, which were last updated in March 2021 and December 2019, respectively. However, Mozilla found their privacy protections "rather questionable and, unfortunately, their security protections look just as bad." The period-tracking app Clue responded to the report reaffirming that they do not sell personal data. Of all apps investigated, Mozilla found only one, Euki, did not collect user data while giving users more control over their data. The investigation found apps like Maya not only collect large troves of personal information but "are also finding new ways of trapping users" to give consent. Their data collection practices, per Mozilla, were often hidden under the term of service, making it harder for users to know how companies will collect, use, store and retain their data. In 2019, research by Privacy International found the app shared sensitive health information with Facebook. The Mozilla research also finds some apps, whose names aren’t specified, ask users to fill in additional details like work experience, education, hobbies and interests while collecting information via people's social media platforms. This data is then sold to third-party data brokers for ad targeting purposes, the research finds. Eight apps failed to meet Mozilla’s Minimum Security Standards, such as allowing the use of weak passwords.