What was the Flo FTC enforcement action about?

In 2021, the FTC took enforcement action against Flo Health for sharing users' reproductive health data, including period dates, pregnancy status, and health symptoms, with Facebook, Google, and Flurry via embedded analytics SDKs, without disclosing this to users. The sharing happened automatically even when users had set their devices to opt out of ad tracking. The FTC case is documented at ftc.gov/cases-proceedings/192-3133-flo-health-inc. A $59.5M class action settlement followed in September 2025 (Reuters 2025-09-25).

Does Flo share my data with Facebook?

The FTC documented in 2021 that Flo shared reproductive health data with Facebook (via Facebook's analytics SDK) and with Google, without user consent. Flo's privacy practices have changed since the enforcement action and settlement. However, Flo remains cloud-based. Your data still exists on Flo's servers. What the company does with that data going forward is governed by their updated privacy policy and the FTC settlement order.

How do I request deletion of all my Flo data?

Two steps: First, delete your account in-app. Open Flo, go to Settings, then Account, then Delete Account, and complete the email confirmation. Second, email privacy@flo.health with the subject 'CCPA/GDPR Data Deletion Request,' invoking CCPA Section 1798.105 (California) or GDPR Article 17 (EU/UK), and requesting deletion of all data including backup copies. Flo has 45 days to respond under CCPA and 30 days under GDPR. In-app deletion removes active data. The email request compels purging of backup copies.

Is period tracker data protected by HIPAA?

No. HIPAA applies to covered entities: hospitals, insurance companies, healthcare providers, and their business associates. Consumer period tracking apps downloaded from the App Store or Play Store are not HIPAA-covered entities. The FTC enforcement action against Flo was a consumer protection case, not a HIPAA violation. Your cycle data, symptom logs, and pregnancy information in a period app are governed by that app's privacy policy, not healthcare privacy law.

alternatives

What Data Does Flo Have on You, and How to Get It Deleted

A plain-language breakdown of what Flo collects, stores, and has shared, and the exact steps to request deletion of your Flo data under CCPA and GDPR.

What Flo has collected about you Flo collects data in several categories. Here's what the app records and what the FTC documented was shared: Reproductive health data Period start and end dates Flow intensity (spotting, light, medium, heavy) Cycle length and regularity patterns Ovulation window predictions and any ovulation symptoms you logged Symptom and health logs Physical symptoms: cramping, bloating, breast tenderness, acne, headaches, and others from Flo's symptom list Energy level and mood entries Sleep quality logs Weight entries (if you used the logging feature) Exercise entries Reproductive status data Pregnancy mode (if you switched to it) Trying to conceive status Birth control method (if logged) Sexual activity logs Account and device data Email address Device type and operating system IP address (which can approximate location) App usage patterns and feature interactions What the FTC documented was shared The FTC's 2021 enforcement action found that Flo shared health data, specifically data about pregnancy, menstrual cycles, and related health conditions, with Facebook and Google through embedded SDKs, and with Flurry (an analytics company). This sharing occurred even