Millions of women track their cycles in apps like Flo, logging when their period starts, their symptoms, and when they have sex. The Netherlands' data protection authority just warned that all of that is exactly the kind of data advertisers and criminals want, and it may open a formal investigation.
What the regulator said
Under EU law, health data is "sensitive" and can't be collected without explicit consent. The Dutch authority (AP) says it's unclear whether period apps actually get that consent before sharing data with advertising partners.
"Girls and women record a lot of intimate information in these apps. That makes them vulnerable, especially if this sensitive information ends up in the hands of advertisers without their consent," said AP vice-chair Monique Verdier. She warned the same data is a target for criminals, who use health, fertility, and sex-life details for blackmail.
This isn't hypothetical
In September 2025, Google and Flo, a period app with more than 70 million monthly users, settled a class-action for $56 million. The claim: Google received users' data through a software kit that Flo built into its app, then used it for personalized ads. Researchers at Cambridge have called period apps a "gold mine" for profiling, warning the data can be used to control people's reproductive choices.
What you can do
Read the data-sharing and consent screens. If there's no clear opt-out, treat everything you enter as potentially shared.
Don't enter what you don't have to. If a sensitive field is optional, leave it blank.
Consider a tracker that keeps your data on your device instead of a company's servers, so there's nothing to share in the first place.
Up next · Wednesday
A period app built the opposite way — it collects nothing, keeps everything on your phone, and shows a fake screen if someone makes you open it.