How is the Premom case similar to the Flo case?

Both cases involve the same pattern: a fertility or period tracking app that promised to keep health data private but shared it with third parties through embedded SDKs. Flo shared data with Facebook and Google (FTC action 2021, $59.5M settlement 2025). Premom shared data with Chinese analytics firms (FTC action 2023). Both apps were server-based. Both relied on policy promises that were violated. The pattern demonstrates that policy-based privacy protections fail when the underlying architecture allows data to leave the app.

What is the Health Breach Notification Rule?

The Health Breach Notification Rule is an FTC rule that requires companies handling personal health records to notify consumers when their data is breached or improperly shared. It applies to health apps that are not covered by HIPAA, which includes most period trackers. The California Law Review has noted that 'menstruation-tracking apps are not bound by the Health Insurance Portability and Accountability Act (HIPAA) because they are not healthcare providers.' The Health Breach Notification Rule fills part of that gap.

Why does it matter that Premom shared data with Chinese companies?

Data localization matters because data transmitted to companies in other countries is subject to those countries' laws and government access practices. US privacy protections do not apply to data held by foreign companies. The FTC specifically highlighted the Chinese analytics firms in its enforcement action, signaling that cross-border health data transfers carry heightened regulatory scrutiny.

How many period tracker apps has the FTC taken action against?

Two. Flo Health in January 2021 (for sharing reproductive data with Facebook and Google via SDKs) and Premom in May 2023 (for sharing reproductive data with third-party analytics firms including Chinese companies). Both were server-based apps. Both shared data despite privacy policy promises. No on-device period tracker has faced FTC enforcement because on-device architecture does not create a mechanism for data sharing.

guides

Premom FTC Enforcement: Data Sharing With Chinese Firms

The FTC charged Premom for sharing reproductive health data with Chinese analytics firms. Second FTC action against a period tracker after Flo.

In May 2023, the FTC charged Premom, an ovulation and fertility tracking app, for sharing users' sensitive reproductive health data with third party analytics companies, including firms based in China. This is the second FTC enforcement action against a period or fertility tracking app, following the Flo Health case in 2021. What the FTC Found The FTC stated that Premom "deceived users by sharing their sensitive personal information with third parties" despite telling users their data would remain private. The data was transmitted through embedded third party analytics SDKs, the same mechanism the FTC identified in the Flo case two years earlier. The FTC proposed barring Premom from sharing health data for advertising purposes under the Health Breach Notification Rule. Source: FTC press release, May 2023 The China Dimension The AMA reported in July 2023 that the FTC charged Premom for violating the Health Breach Notification Rule specifically for sharing user data with Chinese analytics firms. This added a data localization dimension to the enforcement action. When health data is transmitted to companies based in other countries, US privacy protections no longer apply. The data is