Experiential case study audit of three popular period trackers using General Data Protection Regulation (GDPR) and...

Period tracker downloads worldwide continue to increase year over year even though users are exposed to intimate data surveillance, unconsented third-party data sharing, and unauthorized commercial use of their reproductive information. This paper argues that data protection measures such as Europe's General Data Protection Regulation, considered the gold standard for personal privacy protection, could be bolstered if an intimate privacy design code was applied.

As no code, such as the United Kingdom Information Commissioner's Children's Code, exists for reducing data protection risks associated with online processing of sensitive reproductive information, we developed 15 measures operationalizing the concept of intimate privacy. Risk assessments based on intimate privacy criteria were compared to General Data Protection Regulation requirements in our 2023 United Kingdom-based pilot study auditing three popular period trackers, Flo, Clue, and Eve.

When our intimate privacy criteria were applied, we identified tracker data protection weaknesses and privacy elements falling outside of existing General Data Protection Regulation requirements. Particularly worrisome was the lack of dynamic consent for data sharing, no built-in surveillance detection measures, and few user-determined data retention and deletion processes. Processing and storage of United Kingdom Flo and Eve users' data in the United States raises significant intimate privacy protection concerns, especially as legal implications of such data transfers were not well explained to users. Privacy policies were complex, requiring college education.

Incorporating intimate privacy-by-design would provide Femtech device users enhanced protection for their sensitive, private intimate data.