A popular period and fertility tracking app struck a deal with the Federal Trade Commission over allegations that it lied to users about sharing private health information with third-party companies, including Facebook and Google. Flo, a period and ovulation tracking app, has over 100 million users.
In the complaint, the FTC alleges that Flo told users that their information would be kept confidential. He then shared his confidential health data, including the dates of his periods and his pregnancy plans, with outside companies that provided marketing and analytics services for the app. It also failed to limit how this data would be used.
The move could have allowed Facebook to combine confidential health information with user profiles and target ads to them more effectively. Since some users are more willing to share private information with an application like Flo than with a large social network, disclosures can seem invasive.
“Apps that collect, use and share sensitive health information can provide valuable services, but consumers need to be able to trust these apps,” said Andrew Smith, director of the FTC’s Bureau of Consumer Protection. “We are looking closely at whether health app developers are keeping their promises and handling sensitive health information responsibly.”
The news of the agreement follows a 2019 report from O Wall Street Journal, which revealed that Flo was secretly sharing confidential user data with Facebook.
A 2019 study published in Open JAMA network it also showed that apps marketed to people with depression or who wanted to quit smoking shared health data with Facebook and Google.
As part of the agreement, Flo must notify users of how their personal information has been shared and ask for their permission before sharing more information in the future. The company must also receive an independent audit of its privacy practices. He did not admit any irregularity.
In an emailed statement to The Verge, a spokesman for Flo said: “We are pleased to have reached an agreement with the FTC and resolved the matter. We will be conducting a compliance review of our policies and procedures as requested as part of the Consent Agreement and provide the FTC with regular updates. We are committed to ensuring that the privacy of our users’ personal health data is absolutely paramount. “
January 13 update, 4:35 PM ET: This article was updated with a statement from Flo.