Are period tracking apps a privacy concern?

At the end of June, the legislation which was interpreted as conferring the right to have an abortion in the US - Roe vs Wade - was overturned, leaving the decision about the legality of the procedure to individual states. Since then, half of US states have since made moves to ban or restrict abortions, which technically means any woman seeking the procedure could be prosecuted. In the wake of Roe vs Wade, viral messages spread quickly online, telling individuals to delete any period tracking apps they were using. But why are these apps a concern? Julia Ravey spoke to Andrea Ford, a medical and cultural anthropologist at the university of Edinburgh…

Andrea- There have been a lot of concerns raised since the news in the US. The concern is that the data in your app would be potentially used as incriminating evidence, if you're in a situation where you're being persecuted for having an abortion. So that could include data about missed periods, abortions, miscarriages, irregular periods potentially. Phones in general, and lots of apps, track location data which could be incriminating, if you visited an abortion clinic.

Julia- All these concerns valid. Do you think there is a chance that data could be used in this way?

Andrea- Yes. I think there are definitely valid concerns. Lots of app companies have stepped up to be reassuring, which is nice that they're recognizing the concerns. There are, however, a lot of loopholes or different ways of interpreting privacy policies in legal jargon. Sometimes if you're protected in general, you're not protected if you're under criminal prosecution, because that's a special set of rules. While it's nice that app companies are often recognizing this. I wouldn't necessarily say that it's entirely reassuring because there's lots of ways to get around regulations and promises if there's the will to prosecute.

Julia- And these laws being overturned, it comes at a time where we now have these devices essentially logging everything we do. It's very different to the pre Roe versus Wade world. Do individuals need to be thinking about their data beyond just period tracking apps?

Andrea- Yeah I'm glad you asked about that beause I think, in a lot of ways - not just related to abortion - but in privacy in general, period tracking apps have been this red flag. People have become concerned about them because the type of information you put in is quite intimate. But, they're just a Canary in the coal mine in a sense there's so much data gathered and surveillance of different sorts that is baked into the digital ecosystem that we live in. As I mentioned earlier, the location data that's shared and stored by any number of other apps might actually be more incriminating in the court situation.

Julia- From person to person, periods vary dramatically. People can have a regular period but stress and incidences like that can alter periods. Do you think that using the timing of someone's period could be used to incriminate someone because of this huge variation?

Andrea- Again, I think that comes down to the will to prosecute. There have been numerous historical examples where people have said they've had a miscarriage and have been prosecuted for an abortion, and there's just a grey area between the two. And if you look historically, the way similar experiences have been interpreted has really varied. So because there's this ambiguity inherent in the thing, that's why I say it comes down to the will to prosecute. If some judicial body, jury, et cetera, is bent on interpreting it a certain way, that will matter much more than the actual data.

Julia- What would be your advice to someone tracking their period using an app?

Andrea- At this point, I think it depends where you live. I live in Europe and I kind of have a handful on the go for research purposes. But if I lived in a lot of areas of the US, I would not. There are apps that store your data locally, instead of in servers. Those are more secure. Although your actual phone could be held as evidence in a prosecution situation. So, if you're concerned, I would say don't use an app. The kind of takeaway I would love to leave people with is that considering your personal privacy is important and it's part of a bigger set of problems and having conversations about those bigger questions is really, really necessary at this moment.

Julia- In order to learn more about how our data can be used in criminal proceedings, particularly in the overturning of Roe versus Wade. I spoke to Laura Lazara Cabrera, a legal officer from Privacy International who, as an organization, look at the exploitation of data by government and organizations. She told me about the types of evidence that might be used to get a conviction in criminal proceedings.

Laura- If you have indicated in your engagement with a period tracking app that you are pregnant or that you are looking or have undergone an abortion, then that information is likely to be of interest to law enforcement authorities and, by extension, prosecution to show that you have indeed undergone such a procedure. Of course, it's not just period tracking apps. You could have shared that sort of information with a range of different actors. It's all about tracing back your steps and seeing who you told and what sort of engagement those private companies are likely to have with law enforcement. In other words, what is the likelihood of them passing on that information?

Julia- And how easy would that sharing back be? So say you've got an app on your phone and you agree to their privacy measures and they've come out and said, your data is protected in some way. In the case of criminal proceedings, can the user privacy guidelines be overridden?

Laura- Privacy policies will usually have an exception, or at least they should when this is the case, that law enforcement will be able to access some of that data or at least that they will be providing some data to law enforcement upon law enforcement making a legitimate request. But sometimes the issue is that this is not prominently flagged in the privacy policy and so people may overlook that. I think that everything that's happening in the US should prompt users to reconsider their terms of engagement with private companies and look at the privacy policy where there is one.

Julia- Have there been any examples of this in proceedings? So, prosecution using data from an app to get a conviction.

Laura- So we know that browsing histories have been used in the past in the context of criminal proceedings and data processed by period tracking apps is just something that could fall in the same category in terms of the types of evidence that that could be. Then again, whether or not that is likely to be conclusive evidence of someone having undergone an abortion is a very different question altogether. But the real worry is that combined with other evidence or in light of other information, this type of data could be incriminating and put a person in a very difficult position to defend themselves.

Julia- Some of these period tracking apps are based in the EU, would a person in the US using one of these apps, therefore come under EU data protection.

Laura- Absolutely. So the great thing about the general data protection regulation, or GDPR as many of us know it, is that it's got a really broad scope of application, which includes people based in the territory of European union, but also companies which are based here. The good thing about GDPR is that it provides quite a strong standard of protection for people in terms of the ways in which their data is processed. Of course in the US, we don't have such legislation. Each state has different types of legislation that may be applicable to data protection but, in the end, there is no single overarching federal piece of legislation that looks into data protection.

Julia- So in the US, are you more vulnerable in these situations? What is the difference between the EU privacy laws and the US in terms of protecting personal data?

Laura- The US simply doesn't have that sort of legislation in general. There is some legislation that looks into health data, but then that legislation only applies to certain healthcare providers. So that means that many of these organizations will be following through the cracks in terms of data protection standards in the US. Whereas, if we're looking at the EU, then it doesn't matter whether or not you have been licensed to provide a certain service everybody's held to the same standard.

Julia- What would be your advice to someone who is maybe based in one of these states now where reproductive health is being restricted in terms of tracking their menstruation using an app, or just in general with their data being on their phone?

Laura- I would say to them to treat everything that's happened as a result of Roe v Wade as a wake up call and try and adapt to the current information environment. Take this as an opportunity to go back to those apps that you've been using for a while, with whom you've been sharing, very intimate, personal data. Review the privacy policies, make sure that you are happy with those privacy policies. If you're not, try and find out what you can do in terms of maybe limiting your engagement with the app, if you feel uncomfortable continuing to use it or exercising the data protection rights that may be included in the app.