Dutch privacy agency warns of risks in period-tracking apps

The Dutch Data Protection Authority (AP) on Tuesday warned that women who track their menstrual cycles in apps share highly sensitive personal information. It is unclear how the information is used by the apps and if it is shared with advertising partners. Therefore, AP calls for women to be cautious and said it might launch an investigation into such cycle-tracking apps.

Nearly a quarter of Dutch women use a cycle or fertility app, according to research cited by the agency. Users enter details such as the start of their periods, hormonal symptoms, and when they have had sex. The apps provide insights into cycle patterns and estimated ovulation windows. Such data qualifies as special-category personal data under the law. In principle the apps may not collect such data unless the user has given explicit consent. In practice it is often unclear whether the information is shared with advertising partners and whether users have been properly informed.

In late May, Bits of Freedom, a Dutch civil rights group, filed a complaint with the AP against the period-tracking app Flo. The group similarly said that the app, used by more than 200,000 women in the Netherlands, processes highly sensitive data and enables targeted advertising based on the information. At the time, director Evelyn Austin said such apps “commercialize intimate health data."

The AP advised people to check the permissions they grant when installing an app. If the information is unclear or there is no option to refuse data sharing, users should avoid entering details they want to keep private.

“Girls and women record a great deal of intimate information in these apps," said Monique Verdier, vice chair of the AP. “. That makes them vulnerable. For example, when this sensitive information ends up unwanted with advertisers. Because with free apps you often ‘pay’ with your data. In this case, with information about when you have sex or are overdue.”

“Your data can also end up in the hands of hackers,” Verdier continued. “These criminals specifically target the most sensitive personal data, because with that they can blackmail people. Information about your health, fertility, and sex life is meant for no one else, only for yourself.”

The AP told providers of such apps that they must comply with the General Data Protection Regulation. They must clearly state what they do with the personal data and inform users in advance.

Such apps must be able to demonstrate why the collection and any sharing of special-category personal data falls under an exception to the processing prohibition.

“We are concerned about the functioning and the security of these apps. Precisely because of the sensitivity of the information,” Verdier said. “The AP has these apps in its sights and does not rule out starting an investigation.”