Your Period Data Isn't Safe by Default: A Post-Dobbs Guide to Reproductive Privacy
You open your period-tracking app. You log your cycle. Maybe you note some symptoms, a mood, whether you had sex last night. You do this because it helps you understand your body. Because it feels like a private act -- a quiet conversation between you and your own biology.
But here is the uncomfortable truth: for most period-tracking apps, that conversation has never been private. Your data has been shared with advertisers, analytics companies, and social media platforms. And in a post-Dobbs legal landscape, that same data could theoretically be used against you.
This is not a scare piece. This is a practical guide. We want you to understand exactly what is at stake, what has changed, and what you can do about it -- right now, today -- to protect your reproductive privacy.
The Data You Are Actually Sharing
When you use a period-tracking app, you probably think of the data as "my period dates." But the information these apps collect is far more detailed than most people realize.
The Obvious Data
- Period start and end dates
- Cycle length and regularity
- Flow intensity
The Less Obvious Data
- Sexual activity (timing, protection used, partner details)
- Pregnancy status and pregnancy test results
- Symptoms that could indicate pregnancy (nausea, breast tenderness, fatigue)
- Mood and emotional state
- Fertility windows and ovulation predictions
- Miscarriage or pregnancy loss events
- Medication and contraception usage
The Data You Didn't Know You Were Sharing
- Device identifiers (which phone, which operating system)
- Location data (where you were when you logged)
- IP address (which reveals approximate location)
- Browsing behavior within the app
- Third-party analytics identifiers (which link your app behavior to your broader digital profile)
- Advertising IDs (which allow ad networks to build a profile of you across apps and websites)
That last category is where the trouble lives. Because once your reproductive health data is linked to your advertising profile, it can be combined with purchase data, location data, search history, and social media activity to build a startlingly detailed picture of your reproductive life -- one that exists outside your control, often without your meaningful consent.
What Happened with Flo (And Why It Matters)
If you have used a period-tracking app in the last decade, there is a reasonable chance you have used Flo. It is one of the most popular reproductive health apps in the world, with hundreds of millions of users.
In 2021, the Federal Trade Commission reached a settlement with Flo Health after finding that the company had shared users' reproductive health information -- including period dates, pregnancy status, and health symptoms -- with third-party analytics firms, including Facebook and Google, despite explicitly promising users that their data would remain private.
The FTC found that between 2016 and 2019, Flo embedded third-party software development kits (SDKs) from Facebook, Google, and others directly into the app. These SDKs transmitted users' health data to those platforms, where it was used for targeted advertising.
In 2025, a class-action settlement was reached for a combined total of roughly $56 million, with Google paying $48 million and Flo paying $8 million. An additional $3.5 million settlement was reached with Flurry, another analytics firm.
These were not small, obscure data-sharing practices. This was one of the world's most popular women's health apps, quietly funneling intimate reproductive data to two of the world's largest advertising platforms.
Why This Is Not Just a Flo Problem
Flo got caught. But the underlying business model -- embed ad-tech SDKs, monetize user behavior, and bury the details in a 40-page privacy policy -- is standard practice across the app industry. Period-tracking apps are not uniquely predatory. They simply handle uniquely sensitive data using the same careless infrastructure as every other free app.
The question is not whether Flo was uniquely bad. The question is whether the app you are using right now has the same third-party SDKs embedded, collecting the same data, and sharing it with the same companies.
Most users have no way to answer that question. And that is the core problem.
What Dobbs Changed
On June 24, 2022, the Supreme Court's decision in Dobbs v. Jackson Women's Health Organization overturned Roe v. Wade, eliminating the federal constitutional right to abortion and returning the question to individual states.
Within months, numerous states enacted strict abortion bans. Some included provisions that could criminalize not just abortion providers, but people who seek, assist, or facilitate abortions. And that raised a question that reproductive health advocates had been warning about for years: could period-tracking data be used as evidence in a criminal prosecution?
The Theoretical Risk
The concern is straightforward. If a person in a state with a strict abortion ban has a regular cycle tracked in an app, and the data shows a missed period followed by a gap in logging, that pattern could theoretically be used to establish that a pregnancy existed and was terminated.
Prosecutors in states with restrictive abortion laws could potentially subpoena app data, request it from the app company, or obtain it through law enforcement data requests. Location data could establish that a person traveled to a state where abortion is legal. Search history could show queries about abortion providers. Purchase data could show the acquisition of pregnancy tests or abortion medications.
None of this requires a malicious app company. It requires only that the data exists, that it is accessible, and that someone with legal authority decides to request it.
What Has Actually Happened
It is important to be precise here. As of this writing, there are no widely reported cases of period-tracking app data being used as primary evidence in an abortion prosecution. The risk is real but largely theoretical.
What is not theoretical is the broader pattern of digital evidence being used in reproductive health cases. Law enforcement agencies have obtained text messages, search histories, and social media posts in cases involving allegations of illegal abortion. The digital footprint of reproductive decision-making is already being used in legal proceedings. Period-tracking data is simply one more potential source.
The Federal Privacy Gap
In 2024, the federal government attempted to strengthen protections by updating HIPAA rules to prohibit the use or disclosure of protected health information for prosecutions related to reproductive care. However, in June 2025, a federal judge vacated that rule. The Department of Health and Human Services did not appeal.
This means that the federal privacy enhancement designed specifically to protect reproductive health data no longer exists. Some states have enacted their own "shield laws" that limit cooperation with out-of-state investigations into reproductive health care, but these protections are a patchwork -- strong in some states, nonexistent in others.
The practical reality is this: there is no federal law specifically protecting your period-tracking data from law enforcement requests.
What "Privacy" Actually Means (And What It Doesn't)
When an app says it is "private" or "secure," that can mean many different things. Here is a quick guide to the terms you will encounter and what they actually mean in practice.
End-to-End Encryption (E2E)
What it means: Your data is encrypted on your device before it is transmitted, and only you (or someone you authorize) can decrypt it. The app company itself cannot read your data, even if compelled by a court order.
What it does not mean: It does not protect your data from being accessed on your device if someone has physical access to your phone. It also does not prevent you from voluntarily sharing data through features like social sharing or community forums.
Why it matters: If the app company cannot read your data, it cannot share it with advertisers, and it cannot hand it over to law enforcement. This is the strongest form of data protection.
Data Minimization
What it means: The app collects only the data it needs to function and does not retain data longer than necessary.
What it does not mean: It does not mean zero data collection. Some data is necessary for the app to work (your cycle dates, for example). Minimization means the app is not collecting your location, device fingerprint, browsing behavior, and other data that serves no health purpose.
Why it matters: Data that does not exist cannot be subpoenaed, hacked, or sold. The best protection for sensitive data is not collecting it in the first place.
"We Don't Sell Your Data"
What it means: The company does not directly exchange your data for money with a third party.
What it often does not mean: It does not mean your data is not being shared. Many apps "share" data with third-party analytics and advertising platforms without technically "selling" it. The legal distinction between selling and sharing is often meaningless from a privacy perspective. Your data still ends up in someone else's hands.
Why it matters: This is the most common misleading privacy claim in the app industry. Look for apps that commit to not sharing data with any third party, not just ones that promise not to "sell" it.
Anonymous Mode
What it means: You can use the app without providing your real name, email, or other identifying information.
What it does not mean: Depending on implementation, the app may still collect device identifiers, IP addresses, or other data that can be used to identify you indirectly. True anonymity requires that the app cannot connect your health data to your identity even if it wanted to.
Why it matters: If you are concerned about legal risk, an app that allows genuinely anonymous usage -- no email, no phone number, no account creation -- provides a meaningful additional layer of protection.
A Practical Privacy Checklist for Period-Tracking Apps
Here is what to look for and what to do, regardless of which app you use.
Before You Download
- Read the privacy policy. Yes, really. You do not need to read every word. Look for mentions of "third parties," "advertising partners," "analytics," "service providers," and "law enforcement." If any of these terms appear without clear limitations, proceed with caution.
- Check for third-party SDKs. Independent privacy researchers and organizations regularly audit popular apps and publish their findings. A quick search for "[app name] privacy audit" or "[app name] third-party trackers" can reveal what is embedded in the app.
- Look for encryption. Does the app explicitly state that your health data is encrypted end-to-end? Or does it just say "encrypted" without specifying what that means? There is a significant difference between encrypting data in transit (which almost every app does by default) and encrypting data so that even the company cannot access it.
- Check the business model. If the app is free with no premium tier, ask yourself how it makes money. If the answer is advertising, your data is likely the product.
After You Start Using the App
- Disable location services. No period-tracking app needs to know where you are. Turn off location access for the app entirely.
- Use a non-identifying email. If the app requires an email address to create an account, consider using a dedicated email that is not connected to your real name.
- Review permissions regularly. Apps sometimes request new permissions through updates. Check periodically what your app has access to.
- Be thoughtful about what you log. Consider whether you need to log every detail in the app. Some information -- like pregnancy test results or sexual activity details -- carries more risk than basic cycle dates. This is not about self-censorship. It is about informed decision-making.
- Export and delete. If your app offers data export and deletion, use it periodically to remove historical data you no longer need.
- Use your phone's privacy features. Both iOS and Android offer app-tracking transparency controls and advertising ID limitations. Use them.
What to Look For in a Privacy-First App
If you are evaluating period-tracking apps with privacy as a priority, here are the features that actually matter.
Non-Negotiable
- End-to-end encryption of health data
- No third-party advertising SDKs embedded in the app
- Explicit commitment to never share health data with advertisers or data brokers
- Data export and deletion (GDPR/CCPA compliance as a baseline, not an afterthought)
- Transparent, readable privacy policy (not a legal document designed to protect the company)
Strongly Preferred
- Data minimization (no location tracking, no device fingerprinting, no unnecessary data collection)
- Anonymous usage option (no real name or identifying email required)
- Explicit law enforcement policy (what the company will do if it receives a subpoena or data request)
- Independent security audit (third-party verification of privacy claims)
- Local-first data architecture (data stored on your device first, with server sync optional)
Red Flags
- The privacy policy mentions "trusted partners," "service providers," or "affiliated companies" without clearly stating what data is shared
- The app is free with no apparent business model beyond advertising
- The app requires location access, contacts access, or other permissions unrelated to cycle tracking
- The company has a history of FTC enforcement actions or privacy settlements
- The privacy policy was last updated before June 2022 (before Dobbs)
The Broader Picture: Reproductive Data in a Surveillance Economy
The period-tracking privacy problem is part of a much larger issue. We live in a digital ecosystem where personal data is the default currency. Most apps, websites, and services are built on a business model that depends on collecting as much data as possible and monetizing it through advertising, analytics, or data brokering.
For most categories of data -- your shopping habits, your music preferences, your news consumption -- this trade-off is annoying but not dangerous. For reproductive health data, the stakes are fundamentally different. This is data that can reveal pregnancies, miscarriages, fertility struggles, and reproductive decisions. In certain legal jurisdictions, this data could have life-altering consequences.
The solution is not to stop tracking your cycle. Understanding your body is valuable, and cycle tracking is a powerful tool for health awareness. The solution is to demand better from the apps you use. Better encryption. Better data practices. Better transparency. And a business model that does not depend on exploiting the most intimate data you have.
What We Are Building at Gliss
We started Gliss because we believe you should not have to choose between understanding your body and protecting your privacy.
Every architectural decision we make starts with the same question: "What is the minimum data we need, and how do we protect it from everyone, including ourselves?"
End-to-end encryption is not a feature we added. It is the foundation we built on. Data minimization is not a marketing claim. It is a design constraint we impose on every feature we develop. We do not embed third-party advertising SDKs. We do not share your health data with analytics platforms. We do not sell, share, or monetize your reproductive information in any form.
We are not asking you to trust us because we say nice things about privacy. We are asking you to evaluate our architecture, our policies, and our track record -- and hold us accountable.
Your cycle data should help you live better. It should never be used against you. That is not a feature. That is a promise.
Further Reading and Resources
If you want to go deeper on reproductive data privacy, these organizations and resources are doing essential work:
- Electronic Privacy Information Center (EPIC) -- Ongoing research and advocacy on reproductive data privacy in the post-Dobbs landscape
- Center for Reproductive Rights -- Legal analysis of reproductive health data privacy threats and state-by-state protections
- International Association of Privacy Professionals (IAPP) -- Comprehensive tracking of state reproductive privacy laws and compliance considerations
- Electronic Frontier Foundation (EFF) -- Digital privacy tools and guides for protecting sensitive personal data
- National Partnership for Women & Families -- Policy research on the intersection of data privacy and reproductive freedom
Your body. Your data. Your choice about who gets access to either.