How Period Tracker Apps Collect and Use Your Data

DEFINITION

Data broker

A company that aggregates personal information from multiple sources and sells it to third parties, typically advertisers, insurers, or researchers. Data brokers often receive health information from app developers through third-party SDKs embedded in the app.

DEFINITION

Behavioral advertising

Advertising targeted to users based on inferred characteristics — health status, purchasing intent, demographic profile — derived from data collected across apps and websites. Period data can be used to infer pregnancy status, fertility treatments, and reproductive health conditions.

DEFINITION

Health data

Any information relating to the physical or mental health of an individual. In the context of period tracker apps, this includes cycle dates, flow intensity, symptoms, mood, sexual activity, contraception use, and pregnancy status. Consumer health apps are generally not protected by HIPAA.

What Period Tracker Apps Actually Collect

The visible data is only part of the picture. When you log a period date, a mood, or a symptom, the app records that entry. It also typically records when you opened the app, what you tapped, how long you spent on each screen, and device identifiers that link this session to your broader digital profile.

This behavioral layer — not just the health data itself — is what makes period tracking data valuable to advertisers. Combined with external data from brokers, a detailed profile of a user’s reproductive health, lifestyle, and purchasing behavior can be assembled from what looks like a simple cycle log.

The FTC Enforcement Record

Two enforcement actions define the legal landscape:

Flo Health (2021): The FTC found that Flo shared health data — including menstrual and pregnancy information — with Facebook and Google for advertising purposes, despite its privacy policy stating it would not. The FTC entered a consent order requiring Flo to obtain user consent before sharing health data. A $59.5M class action settlement followed in September 2025.

Premom (2023): The FTC found that Premom shared sensitive reproductive health data with two analytics firms, Umeng and Jiguang, without user awareness or consent. The action resulted in a ban on sharing health data with third parties for advertising.

Both cases confirm that the privacy risks of period tracking apps are not speculative — they have resulted in documented enforcement.

How to Audit Your Current App

Use the steps above to review what your current period tracker is sending and to whom. The combination of checking app permissions, reading the data sharing section of the privacy policy, and scanning for embedded trackers gives a reasonably complete picture of your exposure.

The Alternative: Data That Never Leaves Your Device

The most direct way to prevent this data collection is to use an app that never transmits health data to a server in the first place. On-device-only apps have no server to breach, no company to serve with a court order, and no advertising network to feed. The trade-off is no cross-device sync and no cloud backup — but for many users, that trade is worth making.