If you’re the type of person who tracks your period, fitness, sleep, or other health metrics with an app, privacy experts warn you: your data could be a goldmine for advertisers, hackers computer scientists or law enforcement.
There have been calls on social media for American women to remove menstruation tracking apps from their phones since the U.S. Supreme Court ruling draft on Roe v. Wade leaked in early May.
With abortion banned in at least eight states, there are fears that menstrual cycle data from app users, along with other information, could be used to process them for having an abortion in a state where it is no longer legal.
“Unfortunately, I have to tell people to get rid of it [the apps]says Danielle Citron, a law professor at the University of Virginia Law School.
Her concern is that data from a period tracker, as well as other sources of information, could help build a case that a woman had an illegal abortion.
“You had your period on the X date, you missed the period, then, for example, 20 weeks later you had your period again and in that time period your location shows that you went to a clinic of out of state or out of state, this is, in many ways, the circumstantial evidence a prosecutor needs, ”Citron said.
MIRAR | Why some women may want to consider deleting period tracking apps:
The legal expert urges American women to eliminate menstrual monitoring apps
Danielle Citron, a law professor at the University of Virginia Law School, says health data collected by smartphone apps could be used to prosecute American women for having abortions illegally.
Digital privacy experts say concerns about period tracking apps should also be a wake-up call for Canadians on how to record their own sensitive health data online.
“Just don’t trust what companies are doing with your data,” says Ann Cavoukian, a former Ontario privacy commissioner and founder of the International Council on Global Privacy and Security by Design.
“They may claim that they protect your privacy, that they do not store any of your digital data, that they do not share it with anyone, but we have seen time and time again that they have been shown to be wrong. They often share it with unauthorized third parties. way you didn’t consent “.
Tracking and sharing
There are thousands of period tracking apps in Apple’s App Store and Google Play, each with its own privacy policy detailing how users’ information is stored and shared.
Proponents of abortion rights are protesting at the Mississippi Capitol in Jackson, Mississippi, on June 28 after the U.S. Supreme Court overturned Roe v. Wade, ending constitutional protections for abortion. Mississippi has an active law to ban abortion that could go into effect this week, pending a legal challenge. (Rogelio V. Solis / The Associated Press)
The most sophisticated applications collect and store a large amount of data, beyond the details of the menstrual cycle, to create a profile of users: from their name, location and if they are trying to get pregnant, to details of their sex life, exercise, etc. what medications they take and more: a treasure trove for advertisers.
“When you downloaded this app, how much did you pay for it? What’s your monthly subscription fee? If the answer is zero, if you’re not paying for the product, then you’re the product,” says Ritesh Kotak, a cybersecurity manager. and technology analyst in Toronto.
Some vintage apps explicitly tell users that their data may be shared with third-party advertisers, affiliates, business partners, and even other app users, although these details are often buried in their privacy policies.
Since the Supreme Court ruling, several of the larger vintage app companies have tried to reassure their users about their data protection measures.
Flo launched an anonymous mode, so users no longer need to share their name or email, while Clue pledged to never hand over private health data “to any authority that could use it against you.”
However, if a company received an order or subpoena in the U.S., it would have to hand that data over to law enforcement, Citron says, and the same goes for Canada.
This Flo period tracking app image shows the “pregnancy mode” of the app. The company says it will create an anonymous option for users to help protect their privacy. (Provided by Flo)
“[Police] they could demand it if they have an order. You, the organization, are required to provide the data to the police, “Cavoukian said. (Clue did not respond to a request for comment).
Experts say that even if an app promises not to share or sell users ’data, it’s likely to still monetize that information through targeted ads that reach specific users.
“There are puns on what can and can’t be sold,” said Andrea Ford, a medical anthropologist and researcher at the University of Edinburgh who has extensively studied period tracking applications.
“[The company] still has a profile of you as an internet user and where you go, what you are doing, what other things interest you, such as if you are pregnant and may want baby supplies, your data can be channeled to these channels without that your personal information be sold “.
Anyone willing to leave their period tracker should be aware that simply deleting the app will not necessarily delete all of your data from their servers – some apps require you to make a written removal request and your application. It can take weeks to complete. .
Big data routes
Technology experts also warn not to focus too much on period trackers when many other applications also monetize private health data in various ways.
There are many other fingerprints that can reveal more about a person’s activities, including web search results, text messages, and email receipts. All have been used to criminalize people who have requested abortions in the United States, Cynthia Conti-Cook, a civil rights lawyer and digital evidence researcher, told The New York Times.
Google says it will automatically delete location history data that shows visits to abortion clinics, among other locations, around the world. In this photo, anti-abortion protesters, leftists and clinic companions gather in front of an abortion clinic in Louisville, Kentucky, on April 16th. (Jonathan Cherry / Reuters)
Concerns about the location of women’s smartphone location data being used against them led Google to announce that it will automatically delete visits to abortion clinics, as well as a number of other destinations. of users’ location histories.
The change will be implemented globally, including in Canada, a Google spokesman told CBC News.
Personal data can also be a “very valuable product” for hackers, Kotak warned. Suggest using an email address that doesn’t contain your full name when you sign up for an app and provide as little personal information as possible.
Canadians concerned about how applications use their personal data may contact a privacy organization for assistance or file a complaint with the office of the federal privacy commissioner.
A spokesman for privacy commissioner Philippe Dufresne said his office has not received any complaints related to period tracking applications, nor has it investigated any of those applications.