If you’re the kind of person who tracks your period, fitness, sleep, or other health metrics with an app, privacy experts have a warning for you: Your data could be a goldmine for advertisers. hackers or law enforcement.
There have been calls on social media for American women to remove period-tracking apps from their phones since the US Supreme Court’s draft decision in Roe v. Wade in early May.
With Abortion is now banned in at least eight statesThere are fears that app users’ menstrual cycle data, along with other information, could be used to prosecute them for having an abortion in a state where it’s no longer legal.
“Unfortunately I have to tell people to get rid of [the apps]says Danielle Citron, a professor of law at the University of Virginia School of Law.
His concern is that data from a period tracker, as well as other sources of information, could help build a case that a woman had an illegal abortion.
“You had your period on X date, you didn’t have your period, then let’s say, for example, 20 weeks later you had your period again, and in that time frame your location shows that you went to a clinic in-state or out-of-state, which in many respects it is the circumstantial evidence a prosecutor needs,” Citron said.
Digital privacy experts say concerns about period-tracking apps should also be a wake-up call for Canadians about how they record their own sensitive health data online.
“Just don’t trust what companies are doing with your data,” says Ann Cavoukian, former Ontario privacy commissioner and founder of the International Council on Global Privacy and Security by Design.
“They may claim to protect your privacy, they don’t store any of your digital data, they don’t share it with anyone, but time and time again, we’ve seen them proven wrong. They often share it with unauthorized third parties in ways they don’t.” you consented.”
track and share
The most sophisticated applications collect and store a huge amount of databeyond menstrual cycle details, to create a users profile: everything from their name, location, and whether they are trying to get pregnant, to details of their sex life, exercise, what medications they take, and much more: a hidden treasure for advertisers.
“When you downloaded that app, how much did you pay for it? What is your monthly subscription fee? If the answer is zero, if you’re not paying for the product, then you are the product,” says Ritesh Kotak, a cybersecurity expert. and technology analyst in Toronto.
Some vintage apps explicitly tell users that their data might be shared with third-party advertisers, affiliates, business partners, and even other app users, though those details are often unreliable. buried in their privacy policies.
Since the Supreme Court ruling, several of the period’s largest app companies have tried to reassure their users about their data protection measures.
Flo launched an anonymous modeso users no longer need to share their name or email, while Clue promised to Never give private health data “to any authority that may use it against you.”
However, if a business receives a court order or subpoena in the US, it will be required to turn over that data to law enforcement, Citron says, and the same goes for Canada.
“[Police] they could demand it if they have a court order. You, the organization, are required to provide the data to the police,” Cavoukian said. (Clue did not respond to a request for comment.)
Experts say that even if an app promises not to share or sell user data, it’s likely to monetize that information through targeted ads that reach specific users.
“There are puns on what can and cannot be sold,” said Andrea Ford, a medical anthropologist and researcher at the University of Edinburgh who has studied period-tracking apps extensively.
“[The company] still has a profile of you as an internet user, and where you go, what you’re doing, what other things you’re interested in, for example if you might be pregnant and might want baby supplies, your data can be funneled to those channels without it being sold your personal information.”
Anyone ready to get rid of their period tracker should know that simply deleting the app won’t necessarily remove all of your data from their servers – some apps require you to make a written deletion requestand your request can take weeks to fulfill.
big data traces
Tech experts also warn against focusing too much on period trackers when many other apps also monetize private health data in various ways.
There are many other fingerprints that can reveal more about a person’s activities, including web search results, text messages, and email receipts. All have been used to criminalize people who have sought abortions in the US, Cynthia Conti-Cook, civil rights attorney and digital evidence researcher, told the New York Times.
Concerns about the possibility of location data from women’s smartphones being used against them prompted Google to announce that it will do so. automatically remove visits to abortion clinicsas well as a host of other destinations, from user location histories.
The change will apply globally, including in Canada, a Google spokesperson told CBC News.
Personal data can also be a “very valuable commodity” for hackers, Kotak warned. He suggests using an email address that does not contain your full name when signing up for an app and providing as little personal information as possible.
Canadians concerned about how apps use their personal data can contact a privacy organization for help or file a complaint with the office of the federal privacy commissioner.
A spokesman for the Privacy Commissioner, Philippe Dufresne, said his office has not received any complaints related to period-tracking apps, nor has it investigated any of those apps.