District of Columbia Period Tracker Privacy Laws (2026)

DC has strong reproductive privacy protections. But period tracker data still has gaps. Full 2026 legal breakdown.

Abortion access is protected under DC law. Period tracker users face low subpoena risk, though DC has no consumer data privacy law comparable to California's CCPA. A reproductive health shield law protects providers from out-of-state enforcement.

This page is educational, not legal advice. Laws and enforcement practices can change; verify current rules with official state sources or a qualified attorney before relying on this information.

Abortion Law Status in the District of Columbia

Abortion access is protected in DC without gestational restrictions. DC has consistently enacted statutes and passed council measures protecting and expanding reproductive rights. The DC Council has acted proactively to shield reproductive healthcare providers and patients from the legal climate in surrounding jurisdictions.

Period Tracker Data Risk in the District of Columbia

Period tracker data in DC faces low subpoena risk. The DC Protecting Patients and Health Providers Act creates a legal barrier against out-of-state enforcement targeting legal reproductive healthcare in DC. DC courts will not cooperate with anti-abortion legal process from other states. DC-based entities are shielded from such requests. However, DC has no consumer data privacy law. Users have no statutory rights to access, correct, or delete their cycle data under DC law. The protection here is meaningful but narrower than jurisdictions that combine a shield law with a comprehensive privacy law.

Specific Reproductive Data Protections

DC's Protecting Patients and Health Providers Act (B24-0854) focuses on provider and patient protection from out-of-state enforcement rather than consumer data rights. It shields DC-based healthcare providers and DC-based app companies from subpoenas and legal process from jurisdictions pursuing anti-abortion enforcement. This protection primarily benefits users whose period tracker data is stored by DC-based companies.

Federal Protection Status

The HIPAA Reproductive Privacy Rule (which would have prohibited disclosure of protected health information for investigating lawful reproductive healthcare) was vacated nationwide on June 18, 2025 by a federal court in Texas. HHS declined to appeal. Biden-era executive orders directing FTC and HHS action on reproductive data privacy were revoked on January 24, 2025. A ClearDATA/Harris Poll survey (May 2023, n=2,053) found 81% of Americans wrongly believe HIPAA covers health apps. It does not. Period tracker apps are not healthcare providers and fall entirely outside HIPAA regardless of jurisdiction. There is no federal floor for reproductive health data protection.

Key facts

State: District of Columbia
Abortion law: protected
Data protection: moderate
Subpoena risk: low

DC has protected abortion access without gestational restrictions under longstanding DC statute.
DC's shield law blocks cooperation with out-of-state legal actions targeting legal reproductive healthcare in DC.
DC has no standalone consumer data privacy law comparable to CCPA as of 2026.
DC courts are unlikely to cooperate with out-of-state anti-abortion enforcement given the jurisdiction's legal and political environment.
Period tracker users in DC benefit from the shield law's protections against out-of-state subpoenas to DC-based entities.

Definitions

Subpoena: A court order compelling a person or company to produce documents or data. Period tracker apps that store data on their servers can be served with subpoenas; apps that keep core records local-first create less readable company-held data to produce.
Reproductive data: Health information related to menstrual cycles, pregnancy, fertility, and related symptoms. This data is not protected by HIPAA when held by period tracker apps, meaning standard federal health privacy law does not apply.
Shield law: A law that blocks cooperation with out-of-state legal actions targeting legal activity in a state or jurisdiction. DC's reproductive health shield law prevents DC courts and DC-based entities from assisting enforcement originating in states with abortion bans.

Cited signals

$59.5M class action settlement against Flo for sharing user reproductive health data with Facebook and Google Reuters, September 25, 2025
Period tracker apps collect an average of 50+ data points per cycle including symptoms, mood, sexual activity, and medication use Norwegian Consumer Council, 2020

Relevant laws

DC Abortion Procedures Amendment Act

DC law protects abortion access without gestational restrictions. DC has long protected reproductive rights in statute, and the DC Council has consistently acted to expand rather than restrict abortion access.

DC Protecting Patients and Health Providers Act (B24-0854)

DC's reproductive health shield law protects healthcare providers and patients from out-of-state legal actions related to legal reproductive healthcare provided in DC. Blocks cooperation with anti-abortion enforcement originating in other jurisdictions.

No Comprehensive Consumer Data Privacy Law

DC has not enacted a comprehensive consumer data privacy law comparable to California's CCPA as of 2026. Period tracker data protection relies primarily on the shield law and federal baseline requirements.

Quick answers to the obvious questions.

Does DC have a consumer data privacy law covering period tracker apps

No. DC has not enacted a comprehensive consumer data privacy law. Period tracker users in DC have no statutory right to access, delete, or opt out of the processing of their cycle data under DC law. Protection relies on DC's shield law and individual app privacy policies.

Can out-of-state prosecutors subpoena period tracker data from DC-based companies

DC's Protecting Patients and Health Providers Act blocks cooperation with out-of-state legal actions targeting legal reproductive healthcare. DC-based period tracker app companies have a legal basis to refuse subpoenas from prosecutors in states with abortion bans. DC courts will not execute such requests.

How does DC's subpoena risk compare to nearby states

DC's subpoena risk is lower than neighboring Virginia (which has additional state data rights) and much lower than neighboring Maryland (which has similar moderate protections). The combination of abortion protection and a provider shield law means DC's risk profile is among the lowest in the Mid-Atlantic region, despite the absence of a consumer privacy law.

Questions people ask before they switch.

Is period tracker data safe in the District of Columbia?

DC is a low-risk jurisdiction for period tracker users. Abortion is legally protected. DC courts and entities are shielded from out-of-state abortion-related enforcement. The main gap is the absence of a consumer data privacy law. Your rights to access and delete cycle data depend on your app's own policies.

Does DC have a data privacy law protecting period tracker data?

No. DC has not enacted a comprehensive consumer data privacy law as of 2026. Period tracker data has no specific data rights under DC law. There is no right to access, delete, or opt out of processing under DC statute. The Protecting Patients and Health Providers Act focuses on provider and patient protection from out-of-state enforcement, not on consumer data rights.

Does DC's shield law protect period tracker users from out-of-state subpoenas?

Partially. DC's shield law protects providers and patients from out-of-state legal actions related to legal reproductive healthcare in DC. For period tracker app companies based in DC, this creates barriers to complying with subpoenas from states with abortion bans. Most period tracker apps are not based in DC, so users whose data is stored by out-of-state companies do not benefit directly.

Does federal law protect my period tracker data in DC?

No. Federal law does not protect period tracker data. DC's shield law provides the most meaningful protection. DC courts will not assist out-of-state anti-abortion enforcement. DC-based entities cannot be compelled to cooperate with such actions. DC has no consumer data privacy law. For apps based outside DC, on-device storage remains the most reliable protection.