How private is your period?: A systematic analysis of menstrual app privacy policies

Abstract

Menstruapps are mobile applications that can track a user’s reproductive cycle, sex life and health in order to provide them with algorithmically derived insights into their body. These apps are now hugely popular, with the most favoured boasting over 100 million downloads. In this study, we investigate the privacy practices of a set of 30 Android menstruapps, a set which accounts for nearly 200 million downloads.We measured how the apps present information and behave on a number of privacy related topics, such as the complexity of the language used, the information collected by them, the involvement of third parties and how they describe user rights. Our results show that while common pieces of personal data such as name, email, etc. are treated appropriately by most applications, reproductive-related data is not covered by the privacy policies and in most cases, completely disregarded, even when it is required for the apps to work. We have informed app developers of our findings and have tried to engage them in dialogue around improving their privacy practices.

“Developers Are Responsible”: What Ad Networks Tell Developers About Privacy

“…We fnd that ad networks use dark patterns to nudge developers to choose personalised ads and share more data, much like users resulting in a "control theatre" rather than giving developers a chance to make informed choices. We hypothesise that the low rate of GDPRcompliant consent popups in websites [15,28,49] and the abundance of non-compliant Android apps [26,37,39,54] may partially be because developers are not making informed decisions and are either not aware of the consequences of their choices on users or not aware of how to do a better job than the defaults suggest; hence, not because of their ignorance for user privacy. Opinions about dark patterns are mixed; they are viewed as an ethical issue or a violation of law [51,52].…”

Caring for Intimate Data in Fertility Technologies

“…As noted in [68], applications developed by companies that focus on women's digital health seem to demonstrate a better understanding of the sensitivity of the data handled, and to respond accordingly with their policies and practices. Privacy and data protection issues are concerns in 'FemTech', a category referring to software, products, and services that advance women's health but that also stresses the commercial value of female technologies [64].…”

“…Furthermore, fertility data is not neutral in relation to gender, sexuality, and race. As noted in [68], developers seem to understand period and sexual data "as simply another piece of data rather than health data that is sensitive in nature". Being 'sensitive', we argue, involves defning and attending to the necessary privacy policies while taking into account ethnic, cultural, geographic and age diversity, in ways that are free of commercial infuence [19].…”

“…It is also not clear who has the rights to these data, or who could legally access them. Indeed, research shows that there is a lack of clarity in the law in relation to this extremely sensitive data that include ovulation, sex activity, or medical records [68]. This can be observed on diferent levels e.g.…”

Privacy Preference Signals: Past, Present and Future

“…This is likely because organizations do not incur significant costs following data breaches and privacy violations in terms of either regulatory fines or lost shareholder value [41]. Nevertheless, firms' privacy prac-tices are somewhat impacted by data processors' selfdeclared privacy policies [42][43][44][45] and even the privacy preferences expressed by users, to which we now turn.…”