The Hidden Risks of Period Tracker Apps
Over the summer, concerned public health experts in the UK called for publicly funded alternatives to commercial period tracker apps.[1] Their research revealed alarming risks to women’s health data.
More and more people who menstruate make use of period tracking apps, also referred to as ‘cycle tracking apps’ (CTAs). The European market for these apps was valued at EUR 400 million in 2023 and is expected to grow by 15% in the next 5-10 years.[2] Part of the wider and expanding business of ‘FemTech’, period tracking apps allow users to report, monitor, and predict their menstrual cycle. In some cases, apps also make use of machine learning to predict periods and ovulation over time, as well as detect cycle irregularities (see for example the app ‘Flo’[3]).
These apps raise considerable risks and challenges to rights, including risks to data privacy. In countries where reproductive rights are threatened, it is obvious how this data, once in the wrong hands, can have serious consequences – particularly for the most vulnerable, such as those seeking safe abortion care.[4]
Organisations have criticised the insufficient consent acquisition of these apps,[5] for example where users may consent to the privacy policy, but these policies are found to be inaccessible, overly long, and complicated to understand. Predatory advertising techniques may also make use of period tracking data, pushing users to purchase private fertility products or services.[6] Further, data may be shared with third parties, which may also include location data.[7]
All these challenges raise serious questions as to how users’ rights are protected.
In countries where reproductive rights are threatened, it is obvious how this data, once in the wrong hands, can have serious consequences – particularly for the most vulnerable, such as those seeking safe abortion care.
Alice Beck
Gaps in Regulation
In addition to personal data protection as a human right, in the European Union (EU), menstrual data is governed by the General Data Protection Regulation (GDPR) at Art. 9, which provides extra protection to special categories of data, such as medical information. The processing of such data is forbidden, with the exceptions laid out in Art. 9(2), such as explicit consent by the user or when processing is needed to protect the user’s vital interests, for example, in case of unconsciousness.
Despite these protections, compliance with the GDPR has been lacking. According to a 2022 audit, nearly 80% of FemTech apps failed to obtain user consent for specific personal data uses, time-bound data retention and obscured third-party partnerships in their cookie options.[8]
While the medicalisation of menstruation should be avoided, there are legal protections in the EU’s Medical Devices Regulation (MDR) that could serve to protect the privacy of people using period tracking apps. Under the MDR, medical devices can only enter the market when they comply with strict quality and safety rules. However, FemTech apps only fall under this legislation if they meet the conditions laid out in Art. 2 MDR. When considered medical devices, applications must undergo several steps including clinical evaluation and ongoing post-market surveillance. As a result, many applications, in general, deny having a ‘medical purpose’ and define themselves as ‘wellness’ or ‘lifestyle’ tool to avoid these regulatory requirements.
Future Avenues for Protection
Future avenues governing the use of period tracking apps could include the upcoming Digital Fairness Act.
In October 2024, the Digital Fairness Fitness Check was published by the European Commission. This report delved into the current state of consumer protection in the EU through the lens of the Consumer Rights Directive, the Unfair Commercial Practices Directive, as well as the Unfair Contract Terms Directive. The results show that current rules need to be adapted to specific practices that occur online.[9] Ultimately, consumers feel that they are not always in control of their online experiences due to the use of dark patterns - deceptive practices and tactics used to manipulate consumers.[10]
Several of these highlighted dark patterns may also be used by period tracking apps. Practices such as unknowingly granting permissions, buried data-sharing, and ‘obfuscation through legalese’ are all examples that may lead consumers agreeing to practices that they do not fully comprehend. As a result, their data privacy may not be ensured.
Given the highly sensitive nature of the data collected by period tracking apps, better regulation of online practices may be necessary to redress current legal gaps in regulation and implementation.
At the time of writing, the European Commission has an open consultation on the Consumer Agenda 2025-2030.[11] This provides the opportunity for input directly from consumers. Given the identified shortcomings and challenges that FemTech apps pose, the European Commission must seize this opportunity to provide stronger regulation of these harmful online practices and integrate health-related concerns.
References
[1] Gregory, A. (2025) ‘Public health bodies urged to launch period tracking apps to protect data’, The Guardian, 11 June. Available at: https://www.theguardian.com/society/2025/jun/11/public-health-bodies-urged-launch-period-tracking-apps-protect-data (Accessed: 15 July 2025).
[2] Research Lab Analytics (2025) Europe Period Tracking App Market Size, Growth & Forecast. Available at : https://www.linkedin.com/pulse/europe-period-tracking-app-market-size-growth-forecast-zxobc/ (Accessed: 15 July 2025).
[3] Flo. Available at https://app.flo.health/ (Accessed 21 July 2025).
[4] McCallum, S. and Singleton, T. (2024) ‘Periods trackers ‘coercing’ women into sharing risky information, BBC News, 15 May. Available at: https://www.bbc.com/news/articles/cmj6j3d8xjjo (Accessed: 15 July 2025).
[5] Hammond, E. and Burdon, M. (2024) ‘Intimate harms and menstrual cycle tracking apps’, Computer Law & Security Review, 55. Available at: https://www.sciencedirect.com/science/article/pii/S0267364924001043 (Accessed: 15 July 2025).
[6] EDRI (2019) Period tracker apps – where does your data end up?. Available at: https://edri.org/our-work/period-tracker-apps-where-does-your-data-end-up/ (Accessed: 15 July 2025).
[7] Dubiniecki, A. (2024) ‘Post-Roe, Your Period App Data Could Be Used Against You’, Forbes, 14 November. Available at: https://www.forbes.com/sites/abigaildubiniecki/2024/11/14/post-roe-your-period-app-data-could-be-used-against-you/ (Accessed: 15 July 2025).
[8] Secure Privacy (2025) Privacy Vulnerabilities in Fertility Technology: Digital Reproductive Health Data. Available at https://secureprivacy.ai/blog/femtech-fertility-technology-digital-reproductive-data-privacy#:~:text=In%20the%20European%20Union%2C%20the,prohibit%20processing%20without%20explicit%20consent (Accessed: 21 July 2025).
[9] Cyber Risk GMNH (2025) Digital Fairness Act: Updates. Available at: https://www.digital-fairness-act.com/ (Accessed: 15 July 2025).
[10] Lagorce, N. (2024) ‘Six ‘dark patterns’ used to manipulate you when shopping online’, OECD Blog, 16 September. Available at: https://www.oecd.org/en/blogs/2024/09/six-dark-patterns-used-to-manipulate-you-when-shopping-online.html (Accessed: 21 July 2025).
[11] European Commission (2025) Consumer Agenda 2025-2030 and action plan on consumers in the Single Market. Available at: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14514-Consumer-Agenda-2025-2030-and-action-plan-on-consumers-in-the-Single-Market_en (Accessed: 21 July 2025).
