Reproductive-health, location-privacy claims in US FTC crosshairs after abortion decision

The chief US national privacy enforcer signaled today it will search for privacy or security threats posed by apps that collect location and reproductive and other health data, with the US Federal Trade Commission warning it “will vigorously enforce the law if we uncover illegal conduct that exploits Americans’ location, health, or other sensitive data.”

In a strongly worded blog post, the acting chief of the FTC’s Division of Privacy and Identity Protection said data at “the intersection of location and health,” including information "related to personal reproductive matters — for example, products that track women’s periods, monitor their fertility, oversee their contraceptive use, or even target women considering abortion" — are a particular area of concern.

The FTC post didn't mention the US Supreme Court’s June 24 opinion overturning the 1973 Roe v. Wade decision. But coming days after a White House executive order asked the FTC to consider how to protect the privacy of consumers when they search for reproductive health services online, the statement by DPIP Associate Director Kristin Cohen makes clear the FTC has joined the California attorney general in aggressively probing apps that collect health or location data and feed them into the “opaque” and “often shadowy” industry that traffics in personal data.

While the myriad of apps that collect location data for route-finding, weather forecasts and countless other uses are certainly valuable for consumers, the FTC under Chair Lina Khan has signaled repeatedly that what it today called the “murky marketplace” in consumer data, particularly sensitive data such as location and health, is out of control.

“The conversation about technology tends to focus on benefits,” Cohen wrote in today’s post. “But there is a behind-the-scenes irony that needs to be examined in the open: the extent to which highly personal information that people choose not to disclose even to family, friends, or colleagues is actually shared with complete strangers. These strangers participate in the often shadowy ad tech and data broker ecosystem where companies have a profit motive to share data at an unprecedented scale and granularity.”

The FTC’s statement comes as some apps attempt to double down on privacy, with privacy advocates warning that women should consider deleting ovulation trackers and other reproductive health apps and location trackers following the Supreme Court’s decision in Dobbs v. Jackson Women's Health Organization.

Flo Health, which offers an ovulation tracking app with 240 million users, announced June 30 that it would launch “Anonymous Mode,” allowing women to use its Android and iOS apps without sharing their names, email addresses or any other “technical identifier” associated with their accounts. London-based Flo said it “does not share or sell any health data with any other company, but wanted to take the additional step to reassure users who are living in states affected by an abortion ban.”

The FTC strongly disagreed with Flo’s claim that it doesn’t share user data last year. In a January 2021 settlement with Flo on allegations that the fertility app shared menstruation and pregnancy information with third parties including Google and Meta Platforms, the FTC ordered Flo to notify its users that their data had been shared, and it ordered Flo to instruct those third parties to destroy the user data it shared with them.

The unprecedented Flo settlement, the FTC said today, could be a “roadmap” for future enforcement actions over health or location privacy violations. “Protecting consumers’ health privacy remains a top priority for the FTC, and the agency is committed to taking action when companies violate the law,” the enforcer said in a written statement to MLex today. Flo didn't respond to a request for comment for more detail about when “Anonymous Mode” will be launched.

Another enforcement model, the FTC said, could be its settlement this year with Weight Watchers’ children’s weight loss app Kurbo, in which Kurbo agreed to pay a $1.5 million fine and to delete all illegally collected data as well as algorithms or other products created with that data.

The FTC appears particularly poised to probe claims that health or location data has been anonymized, as Flo said it would do with “Anonymous Mode,” with the agency today warning that such claims “are often deceptive.”

“Significant research has shown that ‘anonymized’ data can often be re-identified, especially in the context of location data,” Cohen said in today’s post. “One set of researchers demonstrated that, in some instances, it was possible to uniquely identify 95 percent of a dataset of 1.5 million individuals using four location points with timestamps. Companies that make false claims about anonymization can expect to hear from the FTC.”