Period and pregnancy tracking apps have bad privacy protections, report finds

Most popular period and pregnancy tracking apps don’t have strong privacy protections, according to a new analysis from researchers at Mozilla. Leaky privacy policies in health apps are always a problem, but issues that fall into this particular category are especially concerning now that abortion is illegal in many places in the United States.

Period and pregnancy tracking apps collect data that could theoretically be used to prosecute people getting abortions in places where it’s illegal. Data from period tracking apps isn’t the biggest thing used to tie people to abortions right now — most often, the digital data used in those cases comes from texts, Google searches, or Facebook messages. But they’re still potential risks.

“Companies collecting personal and sensitive health information need to be extra diligent when it comes to the privacy and security of the personal information they collect, especially now in our post-Roe vs Wade world in the U.S. Unfortunately, too many are not,” Jen Caltrider, the Mozilla *Privacy Not Included guide lead, said in a statement.

The analysis looked at 25 of the most popular apps and wearable devices that have period and pregnancy tracking features. Most did not say if and when they’d share information with law enforcement, the report found. Eighteen of the 25 got warning labels from Mozilla around their privacy practices, including the Clue Period & Cycle Tracker and Eve, both of which are at the top of cycle tracking app recommendations in the Apple App store. The label notes that Mozilla has concerns about the apps’ privacy policies and around how they collect, share, and protect user data.

The five wearable devices included in the analysis, though, did not get warning labels. Garmin, Fitbit, Apple Watch, Oura Ring, and Whoop Strap include period tracking features and met Mozilla’s standards for privacy.

Mozilla released a similar report around mental health apps in May of this year and also found that those products did a bad job protecting user privacy. You can see the full *Privacy Not Included guide here.