California Period Tracker Privacy Laws (2026)

California has strong reproductive privacy protections. But period tracker data still has gaps. Full 2026 legal breakdown.

Abortion access is constitutionally protected in California. Period tracker data faces low subpoena risk backed by the CPRA and explicit reproductive health data protections.

This page is educational, not legal advice. Laws and enforcement practices can change; verify current rules with official state sources or a qualified attorney before relying on this information.

Abortion Law Status in California

Abortion access is constitutionally protected in California. In November 2022, California voters passed Proposition 1. It amended the state constitution to explicitly protect the right to abortion and contraception. California is one of the strongest legal environments for reproductive rights in the country.

Period Tracker Data Risk in California

Period tracker data in California faces low subpoena risk. The California Privacy Rights Act classifies reproductive health data as sensitive personal information and grants users expanded rights to control and delete it. AB 1242 prohibits California-based app companies from complying with out-of-state subpoenas tied to abortion investigations. These combined protections make California one of the most favorable states for period tracker users concerned about data privacy.

Specific Reproductive Data Protections

California has enacted specific reproductive data privacy protections through AB 254 (September 2023), AB 1242 (2022), and AB 45 (2025).

AB 254 amends the Confidentiality of Medical Information Act to cover reproductive or sexual health application information. Any business offering a reproductive health digital service becomes a provider of health care subject to CMIA requirements with criminal penalties. AB 1242 prohibits California courts from issuing electronic surveillance orders related to abortion. It also bars California corporations from complying with out-of-state abortion-related subpoenas. AB 45 bans geolocation collection near family planning centers.

Federal Protection Status

The HIPAA Reproductive Privacy Rule (which would have prohibited disclosure of protected health information for investigating lawful reproductive healthcare) was vacated nationwide on June 18, 2025 by a federal court in Texas. HHS declined to appeal. Biden-era executive orders directing FTC and HHS action on reproductive data privacy were revoked on January 24, 2025. A ClearDATA/Harris Poll survey (May 2023, n=2,053) found 81% of Americans wrongly believe HIPAA covers health apps. It does not. Period tracker apps are not healthcare providers and fall entirely outside HIPAA regardless of state. There is no federal floor for reproductive health data protection.

Key facts

State: California
Abortion law: protected
Data protection: strong
Subpoena risk: low

California's constitution explicitly protects the right to abortion as of Proposition 1 (2022).
The CPRA classifies reproductive health data as sensitive personal information with heightened protections.
AB 1242 prevents California companies from complying with out-of-state subpoenas related to abortion investigations.
California's Privacy Protection Agency actively enforces data privacy rules against apps that mishandle health data.
Period tracker companies headquartered in California face legal penalties for sharing user data with abortion investigators.

Definitions

Subpoena: A court order that can require a person or company to produce documents or data. Period tracker apps that store readable data on their servers can receive subpoenas. Local-first apps reduce what the company can produce.
Reproductive data: Health information related to menstrual cycles, pregnancy, fertility, and related symptoms. This data is not protected by HIPAA when held by period tracker apps, meaning standard federal health privacy law does not apply.
On-device storage: A privacy architecture where core cycle records stay local-first. Optional encrypted sync may send unreadable ciphertext. Because there is no readable central cycle database, company-directed requests should have less core cycle data to retrieve. Device access and operational records are separate risks.

Cited signals

$59.5M class action settlement against Flo for sharing user reproductive health data with Facebook and Google Reuters, September 25, 2025
California's AB 1242 (2022) and AB 254 (2023) are among the most comprehensive state-level reproductive data protection laws in the country, covering abortion shield protections and app-level CMIA compliance requirements California Legislature, 2022-2023

Relevant laws

California Privacy Rights Act (CPRA)

Extends CCPA with stronger consumer rights including the right to correct data, opt out of sensitive data sharing, and limit use of sensitive personal information including health data.

Read statute

California Consumer Privacy Act (CCPA)

Gives California residents the right to know what personal data is collected, delete it, and opt out of its sale. Health data qualifies as sensitive personal information.

Read statute

AB 1242 (2022), Abortion Shield Law

Prohibits California-based companies from cooperating with out-of-state subpoenas related to abortion. Protects period tracker data from requests by restrictive states.

Read statute

Quick answers to the obvious questions.

Does California's CPRA protect period tracker data

Yes. The California Privacy Rights Act classifies reproductive health data as sensitive personal information. Users can access, delete, and opt out of the sale or sharing of their cycle data. The CPRA also requires companies to disclose exactly what reproductive health data they collect.

Can out-of-state prosecutors subpoena period tracker data from California-based apps

It is significantly harder in California. AB 1242 prohibits California-based app companies from complying with out-of-state subpoenas related to abortion investigations. If your period tracker is headquartered in California, this law creates a meaningful legal barrier against prosecutors in states with abortion bans.

Questions people ask before they switch.

Can another state's prosecutors get my period tracker data if I live in California?

It is significantly harder. California's AB 1242 prohibits companies based in California from complying with out-of-state subpoenas related to abortion. If your period tracker app is California-based, this law provides a meaningful legal barrier.

What rights do California users have over their period tracker data?

Under the CPRA, you have the right to know what data is collected, delete it, correct it, and opt out of the sale or sharing of sensitive personal information including reproductive health data.

Is California a safe state for period tracker users?

California offers some of the strongest legal protections in the country for period tracker users. It combines constitutional abortion protection with strong state data privacy law and an abortion shield law.

Does federal law protect my period tracker data in California?

No. HIPAA does not apply to consumer apps. California fills that gap with state law. The CPRA classifies reproductive health data as sensitive personal information and gives users rights to access, delete, and opt out of its sale. AB 1242 bars California-based app companies from complying with out-of-state abortion-related subpoenas. AB 254 extends CMIA requirements to reproductive health app data. These state protections reduce risk substantially, though federal law enforcement and courts outside California remain outside their reach.