These menstrual tracking apps reportedly shared sensitive data with Facebook

Some of the apps shared things like contraception use and other personal info, according to a UK advocacy group.

Shelby Brown Editor II
Shelby Brown (she/her/hers) is an editor for CNET's services team. She covers tips and tricks for apps, operating systems and devices, as well as mobile gaming and Apple Arcade news. Shelby also oversees Tech Tips coverage. Before joining CNET, she covered app news for Download.com and served as a freelancer for Louisville.com.
  • She received the Renau Writing Scholarship in 2016 from the University of Louisville's communication department.
Shelby Brown
2 min read

Facebook might know a whole lot about you if you use one of these period-tracking apps. 

Angela Lang/CNET

New research from UK-based advocacy group Privacy International uncovered that some period-tracking apps were sharing sensitive data with Facebook. Tracking apps like MIA Fem and Maya shared information with the social network, including when the user logged contraception use, monthly periods and menstruation symptoms, the group said Monday. 

Privacy International's research, reported earlier by BuzzFeed News, examined apps that it said had millions of downloads. The group found that Maya by Plackal Tech and MIA by Mobapp Development, were sharing extensive amounts of sensitive user information with Facebook and other third parties. 

Plackal Tech said it has since removed both the Facebook core software development kit, or SDK, and Analytics SDK from the Maya app across all platforms. The app's CEO, John Paul, said that all data accessed by Maya is essential to the proper functioning of the product. Paul said predicting information pertaining to menstrual cycles is complex and dependent on thousands of variables

"Location information, the significance of which is highlighted in the report, helps us triangulate regional variations in cycle lengths and thus help improve accuracy of our prediction over time. We will continue evaluating our privacy policy and align ourselves to global best practices on data privacy," Paul said in an email.

Mobapp Development didn't immediately respond to a request for comment. 

Facebook's policies say the social network can gather information from third-party apps that use its SDKs and APIs. The SDK integrates with apps to provide features like analytics or letting users log in with Facebook.

Privacy International also discovered that My Period Tracker by Linchpin Health, Ovulation Calculator by Pinkbird and Mi Calendario by Grupo Familia notified Facebook when the user opened the app. Mi Calendario was also using an outdated version of the Facebook SDK, according to the research. 

The research also examined some of the most popular period-tracking apps -- Period Tracker by Leap Fitness Group, Period Tracker Flo by Flo Health, Period Tracker by Simple Design and Clue Period Tracker by Biowink -- and found they weren't sharing any data with Facebook. 

"Our terms of service prohibit developers from sending us sensitive health information and we enforce against them when we learn they are. In addition, ad targeting based on people's interests does not leverage information gleaned from people's activity across other apps or websites," Joe Osborne, a Facebook spokesperson, said in an email. 

The other apps didn't immediately respond to request for comment.

Cycle-tracking apps aren't new and can be used to monitor a pregnancy, menstruation and more. Most recently, Apple and Fitbit wearables incorporated menstrual cycle trackers into their devices. 

Originally published Sept. 9.
Update, Sept. 10: Adds statement from Facebook and Maya app.

Watch this: CES 2019: Sex tech is everywhere and nowhere

The 17 best health and fitness apps for Apple Watch

See all photos