Period tracking app says it will stop sharing health data with Facebook

After The Wall Street Journal reported that popular period-tracking app Flo had been secretly sharing some of its users’ most personal health data with Facebook, Flo is promising to make some changes.

Along with a number of other popular health apps, Flo used Facebook’s developer software to track users’ data in a way that could be used for advertising purposes, the report found. 

In Flo’s case, the period tracking app “told Facebook when a user was having her period or informed the app of an intention to get pregnant,” according to The WSJ. This data “was sent with a unique advertising identifier that can be matched to a device or profile.”

Now, Flo says it will stop sending this type of app data to Facebook’s analytics software, which tracked the info via a feature called “custom events.”

“Facebook Analytics is one of the world leading analytics platforms for app developers & publishers that provide a wide range of tools for measurement, understanding and optimizing the product and customer experience,” a Flo spokesperson said in a statement.

“Moreover, we have released app updates for iOS and Android that don’t send any custom app events to any external analytics system, including Facebook Analytics,” the spokesperson added. The company will also be conducting a privacy audit, it said.

According to Facebook, its developer policies prohibit developers from sharing health data with the social network, a spokesperson said in a statement.

Sharing information across apps on your iPhone or Android device is how mobile advertising works and is industry standard practice. The issue is how apps use information for online advertising. At Facebook, we require app developers to be clear with their users about the information they are sharing with us, and we prohibit app developers from sending us sensitive data. We also take steps to detect and remove data that should not be shared with us.

Yet despite Facebook’s rules, Flo was not an isolated case, according to The Wall Street Journal’s investigation. Other popular health apps, including a heart-rate monitoring and meditation app, were also sharing “sensitive” data.

The extremely personal nature of period tracking apps makes this type of data sharing all the more alarming. Millions of women use these apps, not just to track their menstrual cycles, but to log aspects of fertility including ovulation and attempts to conceive. Flo also has a “pregnancy mode,” which lets users input and save information related to their pregnancy. 

That this information could be used for targeted advertising without making that clear to users is cause for concern, according to privacy advocates. Flo and other developers may have valid reasons to use analytics tools that help them learn about how their apps are used, but the company’s privacy policy stated that users’ health data was not shared to third parties, according to The Wall Street Journal. Flo’s privacy policy was updated Feb. 19, according to its website.

Another complication: Women have long been uncomfortable that marketers, in the words of AdAge, “can reach pregnant women on Facebook with near-surgical precision.” This has been the case for years — AdAge’s piece is from 2012 — but if advertisers were able to get their hands on data from fertility tracking apps, it could take that type of creepy ad targeting to the next level.

Again, Flo says it’s cleaning up its policies to prevent this kind of data sharing from happening. Whatever happens, this is yet another timely reminder that the data you share with app developers can resurface in uncomfortable ways.