Menstrual Data as a Marketing Commodity: Legal Regulation of Feminine Health Apps and Consumer Privacy

Abstract

Delivery of period tracking apps which is part of the fast-growing ‘femtech' category, now gathers sensitive information about physiology and behaviors from an estimated 200 million people in the world. Combined with data on menstrual cycles, ovulation windows, sexual behavior, mood, and fertility markers, the data is a major marketing asset that is traded among advertisers, insurers, data brokers, and even, likely now more than ever, the hands of law enforcement agencies, especially following the demise of the Dobbs case. However, current laws such as the “Health Insurance Portability and Accountability Act” (HIPAA), the “Federal Trade Commission Act” and a few state privacy laws have severe gaps in their structure that mean femtech users are largely un-protected. In this paper, the regulatory terrain surrounding the collection of, and commerce in, menstrual data is charted, there is a comparative study of the regulatory frameworks of the United States, the European Union and India, and a thorough examination of the current legal relief provided. The paper builds on empirical accounts of applications privacy audits, enforcement records from the FTC, and post-Dobbs patterns of data requests to propose a novel framework for considering menstrual data that draws upon, but differs from, current protections for sensitive health information and is instead based on a meaningful consent framework, purpose limitation, and prevention of transfers for law-enforcement purposes without a judicial process.