FTC Reaches Settlement With Flo Health Over Fertility-Tracking App

Flo Health accused of improperly sharing data with Facebook, including whether users were ovulating

The Federal Trade Commission reached a settlement with Flo Health Inc., the developer of a widely used period and fertility-tracking app, over allegations that it improperly shared personal data with Facebook and others, including whether users were ovulating.

The data shared by Flo Health often allowed online ads to be targeted to those users, despite Flo Health’s promises that the information would be kept private, The Wall Street Journal found in a 2019 article.

The FTC’s vote on the proposed settlement was 5-0, the agency said Wednesday. The proposed settlement with the FTC, if it becomes final following public comment, would require Flo Health to obtain an independent review of its privacy practices and get users’ consent before sharing their health information, the agency said. The company also must notify consumers of the FTC charges that it shared consumers’ personal information without their consent, commissioners said.

In a statement, a Flo spokesperson said the company cooperated with the FTC, adding, “We are committed to ensuring that the privacy of our users’ personal health data is absolutely paramount.”

The company emphasized that it didn’t share users’ names, addresses or birthdays, and that its agreement with the FTC wasn’t an admission of wrongdoing but allowed it to “avoid the time and expense of litigation and... decisively put this matter behind us.”

The FTC alleged in its complaint that Flo promised to keep users’ data private, when it actually disclosed data to third parties that provided marketing and analytics services to the app, including Facebook’s analytics division as well as Alphabet Inc.’s Google analytics division and others.

Facebook didn’t respond to a request for comment. Google didn’t respond prior to publication, but after this article was published, a Google spokesperson said companies that use Google Analytics on their websites and apps own all data collected by the service and can delete that data at any time.

“We don’t build advertising profiles from sensitive data like health conditions, and we have strict policies preventing developers and advertisers from using such data to personalize ads,” the spokesperson said.

Flo didn’t stop disclosing this data until its practices were revealed in the 2019 Wall Street Journal article, according to the agency. The Journal’s testing showed that Facebook software collected data from many apps even if no Facebook account was used to log in, and even if the end user wasn’t a Facebook member.

The article prompted “hundreds” of complaints from users, the FTC said.

The FTC suggested that more such cases could be coming.

“Apps that collect, use and share sensitive health information can provide valuable services, but consumers need to be able to trust these apps,” said Andrew Smith, director of the FTC’s Bureau of Consumer Protection. “We are looking closely at whether developers of health apps are keeping their promises and handling sensitive health information responsibly.”