Period-tracking apps share sensitive user data, Mozilla investigation finds

A new investigation by the Mozilla Foundation has raised concerns about the privacy practices of popular period-tracking applications, revealing that some apps share sensitive user data with third parties. The study highlights which applications maintain robust data protection policies and which leave significant privacy vulnerabilities.

“

Your data is private. Period.

The app Stardust, which combines menstrual cycle tracking with astrological predictions, claims strong data privacy commitments, stating "Your data is private. Period." However, a report obtained by the BBC suggests the company's interpretation of "private" differs from its users'. Mozilla's research examined six widely used period-tracking apps: Flo, Clue, Stardust, Spot On, Period Calendar, and Euki.

While some apps offer reliable data protection, others share user information with major companies like Google, Meta, and TikTok, as well as lesser-known partners. Although these practices are currently legal, experts worry that following the U.S. Supreme Court's 2022 decision to overturn federal abortion protections, this data could be used in criminal proceedings.

“

the concept of “private” seems to have a different interpretation for the company and its users.

Mozilla's findings indicate that Stardust shares sensitive reproductive health data with the data management company RudderStack, without this being disclosed in its privacy policy. The shared information includes pregnancy status, contraceptive use, mood, alcohol consumption, and various symptoms. Stardust maintains that RudderStack acts solely as a "technical pipeline" for analytics and does not access or sell personal data. Additionally, Mozilla found that while Spot On, an app from Planned Parenthood, does not directly share data with third parties, some of its features link to the organization's website, which is considered less secure. The website shares information about the type of medical care a user is seeking with a data analytics company, a practice that privacy analyst Shoshana Wodinsky noted could be easily rectified.

“

could easily be fixed