The Information Commissioner’s Office (ICO) is reviewing period and fertility apps as new figures show more than half of women have concerns over data privacy.

Period and fertility apps are typically use to track a user’s menstrual cycle, and can include person data such as the use of birth control, days of ovulation, and sexual intimacy frequency.

A poll commissioned by the regulator revealed women said transparency over how their data was used (59%) and how secure it was (57%) were bigger concerns than cost (55%) and ease of use (55%) when it came to choosing an app.

“These statistics suggest data security is a significant concern for women when it comes to choosing an app to track their periods or plan or prevent pregnancy. That’s not surprising, given the incredibly sensitive and personal information involved,” Emily Keaney, deputy commissioner of regulatory policy at the ICO, said.

The poll showed a third of women have used apps to track periods or fertility.

The research also showed that over half of people who use the apps believed they had noticed an increase in baby or fertility-related adverts since signing up. While some found the adverts positive, 17% described receiving these adverts as distressing.

As part of its continued research, the ICO is now urging users to come forward to share their experiences through a survey in a call for evidence.

The regulator has also contacted companies who provide period and fertility tracking apps, including some of the most popular apps available to UK users, to find out how they are processing users’ personal information.

“We want to make sure women can use these services with confidence, so we’re calling for people to share their experiences,” Keaney said. “This will help us understand whether there are areas that need improvement – from how easy it is to navigate privacy policies to whether people have experienced upsetting and unexpected targeted advertising. We also know some users feel these apps bring many benefits and we’d like to hear about these too.”

A focus of the ICO’s work is to identify whether there is the potential for harm and negative impact on users as a result. These harms could include unnecessarily complicated and confusing privacy policies, leaving users in the dark as to what they have consented to, apps requesting or storing unnecessary volumes of data, or users receiving upsetting targeted advertising that they did not sign up to.

The ICO will also be commissioning focus groups and user testing, and working with key stakeholders, where the National Data Guardian, Dr Nicola Byrne, and women’s health groups, including Wellbeing of Women, have offered their support.

Recommended reading

• Report: UK Executives Grappling with Evolving Data Privacy Laws
• Consumer Data Privacy Concerns at an All Time High
• Data Privacy Day: Don’t Put all your Eggs in One Basket

“As with all health apps, we would expect organisations to safeguard their users’ privacy and have transparent policies in place. This review is intended to establish both the good and bad of how the apps are working currently. Once we have more information, we will explore next steps, but we will not hesitate to take regulatory action to protect the public if necessary,” Keaney added.

Privacy and Fertility Apps

At this year’s Scot-Secure 2023, Flo presented their own story as a period and fertility tracking app used by many people in the United States. After a Supreme Court decision meant that abortion was no longer legally protected in all 50 states, users of fertility tracking apps were concerned that government and law enforcement could use this personal data against them to see if users had become pregnant and sought an abortion.

In an effort to protect their user’s privacy, Flo partnered with CloudFlare to implement an Oblivious HTTP (OHTTP) and re-examine their IP firewall system in order to create an anonymous mode which decoupled health data from personal information containing no unique user identifiers, and kept both data sets secure.

Anonymous [Mode] is important, especially in the world that we live in,” said Leo Cunningham, chief information security officer at Flo said. “Particularly with female data, it is imperative that we respond as a company and protect the users.”

“It is non-negotiable for us as a company.”

You can find hear about more data privacy and cybersecurity stories, protocols, and best practice at Scot-Secure West taking place in Glasgow on 14 September.