Reproductive health apps strengthened privacy, but serious risks remain
Story at a glance
Reproductive health app Flo announced a new Anonymous Mode feature that lets users access the app without requiring a name, email address or other technical identifiers.
The new feature is intended to protect users’ sensitive health data from state abortion laws.
Cybersecurity advocates say users should consider app’s privacy policies, which can be dense and hard to find, but are critically important.
One of the world’s most popular period tracking apps released a heightened privacy mode for users to activate in an effort to protect their sensitive health data from abortion bans cropping up across the country. Yet some cybersecurity experts are demanding more reforms that permanently end data harvesting and retention across the digital app space.
On Wednesday, Flo, a period tracker app that’s used by about 200 million users worldwide, announced it now has an Anonymous Mode that lets users access the app without requiring a name, email address or other technical identifiers from being associated with their health data.
The new feature was inspired by the U.S. Supreme Court’s decision to overturn Roe v. Wade — a nearly 50-year precedent that affirmed abortion access as a constitutional right — and since, at least 12 states have banned abortion or heavily restricted the procedure.
Digital privacy advocates have warned about how law enforcement or anti-abortion groups could seek out user’s digital data in order to enforce those abortion bans.
America is changing faster than ever! Add Changing America to your Facebook or Twitter feed to stay on top of the news.
That’s because many period tracking apps, including Flo, allow users to input their menstrual cycles, sexual activity and ovulation windows. That information could potentially be used to identify individuals seeking abortions.
Andrew Crawford, senior policy council at Center for Democracy & Technology, believes Flo’s Anonymous Mode is a positive step in the right direction. He told Changing America that, “reducing the amount of data that companies collect and retain can really reduce the risk of people’s reproductive health data being used and shared in unwanted and harmful ways.”
There are still more reforms needed, as Crawford explained law enforcement entities, including from states that have passed abortion bans and restrictions, can still go to companies and demand data they have on users — some of which may include sensitive health information.
It’s a situation that recently played out in Nebraska when Meta’s Facebook turned over chat messages of a mother who is accused of giving abortion pills to her daughter and then helping bury the fetus. Those actions would be in violation of Nebraska law that bans abortion 20 weeks after an egg is fertilized.
Facebook Messenger offers end-to-end encryption, which means chats between users are only visible on those users’ phones and aren’t readable by Facebook or any government entity that requests to see it — but end-to-end encryption is not an automated feature and Facebook users must select the option to mark chats as secret.
There’s currently no federal law preventing companies from collecting and selling user data and a report by the U.S. Government Accountability Office (GAO) found that more regulations are needed to manage how companies collect, use and sell online personal information — often done with a consumer’s knowledge or consent.
Most reproductive health apps have weak privacy protections, with the Mozilla Foundation investigating 25 popular reproductive health apps and wearable devices and found 18 offered dangerously vague privacy labels that also could carry security concerns.
However, Crawford says there are proactive measures companies can take, like limiting the amount of unnecessary information collected on users and in instances where it is collected, it’s deleted quickly.
Google announced such a policy in July by saying if its systems identified a user was visiting a sensitive location — like an abortion clinic — it would delete those entries from its Location History feature soon after the visit.
Caitlin Seeley George, campaign director for Fight for the Future, agreed, telling Changing America in an emailed statement, “We need companies to collect and retain less data from the get-go, and to make ‘Anonymous Mode’ the default so that no one has to be afraid of who might gain access to their information.”
When considering a mobile app or any digital program, Crawford recommends users should take a close look at their privacy policies, which can be dense and hard to find but critically important. Users should also be considering whether an app tracks location data, has access to photos and microphones and whether messages have end-to-end encryption.
In addition to its Anonymous Mode, Flo confirmed it uses encryption technology on all of its data and passcode protection to reduce the risk of any unauthorized users from accessing the app on their personal devices. Anonymous Mode will offer a deeper layer of privacy, with the app partnering with Cloudflare to remove the connection between a user’s IP address and their health data.
For the latest news, weather, sports, and streaming video, head to The Hill.
