If you’re one of the millions of Canadians who uses period-tracking apps to predict when menstruation will start and when you’re mostly likely to be fertile, either to facilitate or prevent pregnancy, there’s a risk these apps are sharing your personal data and sensitive health information with third parties, in particular, the digital advertisers Facebook and Google. With hundreds of millions of users worldwide, these apps collect detailed health data on menstruation, fertility, pregnancy and illness that are of value to marketers and health researchers.
Apps claim that sharing data with third parties can be ultimately beneficial to their users, by, for example, generating new medical knowledge of reproductive health conditions, a laudable goal given the systematic underfunding of women’s health-care research. But there are serious drawbacks. Apps’ data sharing can breach users’ privacy and potentially be used to criminalize them in jurisdictions where abortion is limited or outright prohibited.
A class-action lawsuit in British Columbia, certified in March 2024, should provide a better understanding of how period-tracking apps capture and commodify Canadians’ health and sexual data. The class action alleges that the Flo Health app collected, tracked and sold users’ sensitive and valuable personal information without their consent, violating its own privacy policies, and that the company’s activities caused “real and substantial harm to those who have been exposed to profiteering off of the most intimate, personal details of their bodies.” The BC class action is part of a broader effort with coordinated lawsuits in Ontario and Quebec. As reported by the CBC, the lead plaintiff in the BC lawsuit, who used the app when she was trying to conceive and later during pregnancy, said in an affidavit that she was “shocked” to learn Flo had disclosed her data to “Facebook and others, despite my clear understanding…that my information would be kept private.”
Flo’s alleged data-disclosure activities in Canada, which relate to Canadian users of the app between June 1, 2016, and February 23, 2019, are similar to allegations the app already settled with the US Federal Trade Commission (FTC) in 2021. Both cases reveal the degree to which many period-tracking apps’ business models rely on data commodification. Commodification occurs when the apps transform users’ personal and health data into an asset that can be sold to marketers who will mine it for commercially valuable insights, such as about groups intending to become, or who already are, pregnant.
At its heart, data commodification involves appropriating data collected for one purpose — in this instance, tracking menstrual cycles — and then repurposing it for other activities, such as marketing. Data commodification is a problem not only because people largely do not read or understand companies’ privacy policies and so are unable to meaningfully provide informed consent, but also, because as the FTC ruled against Flo, companies may deceive users as to their data practices.
Data commodification enables data collectors to, effectively, use people’s data against them. As such, it’s not just a consumer issue; it’s also a security issue. In the wake of the US Supreme Court’s overturning of Roe v. Wade in 2022, period-tracking apps can pose a privacy and security risk to users. Privacy experts warn that law enforcement could use app data to identify users within or even transiting through the United States whose pregnancy starts and then stops. Where abortion is prohibited, US law enforcement could request fertility-related records from period-tracking app companies as evidence of crimes.
Decommodifying Bodily Data
Given the data-intensive business models of most period-tracking apps, what are possible solutions? In our 2023 (open-access) book The New Knowledge: Information, Data, and the Remaking of Global Power, my co-author Blayne Haggart and I propose that governments adopt an approach we call “data decommodification.” Data decommodification rejects the collect-and-monetize-all-data ideology underlying the data economy and instead begins from the premise that individuals and groups should maintain control over how the data they produce is used by others.
Data decommodification does not preclude data collection. Rather, one of its key elements is data minimization, meaning data should only be collected to provide the services that the user chooses from the provider. Data decommodification would thus prohibit repurposing data toward other activities, such as marketing.
Decommodifying the Data Economy
With the class action lawsuits against Flo, it’s an opportune time in Canada to rethink how we regulate data throughout the economy. Data decommodification recognizes that by using an app for one purpose, people are not consenting to the pervasive, wholesale siphoning of their data for repurposing to other activities without their knowledge.
This approach moves society away from the commercial sale of data, while still leaving in place the ability to share data with non-commercial actors when the data is being collected and used (with informed consent) in the interests of the people who serve as the source of this data. Decommodification would entail examining how we could sharply limit the collection and use of personal data by tech companies, in particular, social media firms, gig companies such as Uber, and advertising-dependent apps.
