Connecticut Period Tracker Privacy Laws (2026)

Connecticut has strong reproductive privacy protections. But period tracker data still has gaps. Full 2026 legal breakdown.

Abortion access is legally protected in Connecticut. Period tracker data faces low subpoena risk, supported by the Connecticut Data Privacy Act.

This page is educational, not legal advice. Laws and enforcement practices can change; verify current rules with official state sources or a qualified attorney before relying on this information.

Abortion Law Status in Connecticut

Abortion access is legally protected in Connecticut. The state has codified abortion rights in statute, protecting access up to fetal viability. Connecticut has also enacted a shield law (PA 22-19) that protects residents, providers, and healthcare workers from out-of-state legal actions related to legal abortion services performed in Connecticut.

Period Tracker Data Risk in Connecticut

Period tracker data in Connecticut faces low subpoena risk. The Connecticut Data Privacy Act classifies health data as sensitive personal information. It grants residents rights to access, correct, and delete their data. Combined with the state's shield law protecting against out-of-state abortion investigations, Connecticut offers meaningful legal protections for period tracker users. State prosecutors are not pursuing abortion-related cases here.

Specific Reproductive Data Protections

Connecticut enacted specific reproductive data privacy protections through SB 3 / Public Act 23-56 (June 2023). This law amended Connecticut's comprehensive privacy law to add consumer health data, including reproductive and sexual health data, as sensitive data requiring opt-in consent. It also bans geofencing within 1,750 feet of reproductive health facilities.

Federal Protection Status

The HIPAA Reproductive Privacy Rule (which would have prohibited disclosure of protected health information for investigating lawful reproductive healthcare) was vacated nationwide on June 18, 2025 by a federal court in Texas. HHS declined to appeal. Biden-era executive orders directing FTC and HHS action on reproductive data privacy were revoked on January 24, 2025. A ClearDATA/Harris Poll survey (May 2023, n=2,053) found 81% of Americans wrongly believe HIPAA covers health apps. It does not. Period tracker apps are not healthcare providers and fall entirely outside HIPAA regardless of state. There is no federal floor for reproductive health data protection.

Key facts

State: Connecticut
Abortion law: protected
Data protection: moderate
Subpoena risk: low

Connecticut has codified abortion rights in statute, protecting access up to fetal viability.
The Connecticut Data Privacy Act (CTDPA) covers sensitive personal data including health information.
Connecticut's shield law protects patients and providers from out-of-state abortion investigations.
Period tracker companies operating in Connecticut must comply with CTDPA data subject rights.
Subpoena risk from Connecticut prosecutors is minimal given that abortion is legal and protected.

Definitions

Subpoena: A court order that can require a person or company to produce documents or data. Period tracker apps that store readable data on their servers can receive subpoenas. Local-first apps reduce what the company can produce.
Reproductive data: Health information related to menstrual cycles, pregnancy, fertility, and related symptoms. This data is not protected by HIPAA when held by period tracker apps, meaning standard federal health privacy law does not apply.
On-device storage: A privacy architecture where core cycle records stay local-first. Optional encrypted sync may send unreadable ciphertext. Because there is no readable central cycle database, company-directed requests should have less core cycle data to retrieve. Device access and operational records are separate risks.

Cited signals

$59.5M class action settlement against Flo for sharing user reproductive health data with Facebook and Google Reuters, September 25, 2025

Relevant laws

Connecticut Data Privacy Act (CTDPA)

Comprehensive consumer data privacy law effective July 2023, covering personal data including sensitive health information. Grants consumers rights to access, delete, and opt out of data sales.

Read statute

PA 22-19, Abortion Shield Law

Protects Connecticut residents and providers from out-of-state legal actions related to abortion services performed legally in Connecticut.

Quick answers to the obvious questions.

Does Connecticut's data privacy law protect period tracker data

Yes. The Connecticut Data Privacy Act classifies health data as sensitive personal information, giving users rights to access and delete their cycle data. Period tracking app companies serving Connecticut residents must comply with these requirements.

Can out-of-state prosecutors get period tracker data from Connecticut app companies

Connecticut's shield law blocks cooperation with out-of-state abortion-related legal actions. This creates a meaningful barrier against prosecutors in states with abortion bans attempting to subpoena period tracker data from companies operating in Connecticut.

Questions people ask before they switch.

Does Connecticut protect period tracker data?

Connecticut's Data Privacy Act covers personal data including health information. It gives users rights to access and delete their data. Connecticut's shield law also provides protection from out-of-state legal actions related to abortion.

Can out-of-state prosecutors access period tracker data through Connecticut companies?

Connecticut's shield law creates legal obstacles to out-of-state subpoenas related to abortion. Companies in Connecticut have a legal basis to resist such requests.

How does Connecticut's abortion law protect period tracker users?

Abortion is legal and protected in Connecticut. State prosecutors are not pursuing abortion-related cases. The risk of a Connecticut subpoena targeting period tracker data is very low.

Does federal law protect my period tracker data in Connecticut?

No. HIPAA does not apply to consumer apps. Connecticut's state-level framework provides meaningful protections. The Connecticut Data Privacy Act (effective July 2023) treats health data as sensitive personal information with user access and deletion rights. PA 22-19 shields Connecticut companies from out-of-state abortion-related subpoenas. These protections reduce but do not eliminate risk. Federal processes and out-of-state courts can still override state law in some circumstances. Connecticut users are in a substantially better position than those in states with no data protection at all.