Center for Policy Analysis and Research
Technology and Health Equity
May 2026
Tracked and Targeted: Reproductive Health App Surveillance and the Criminalization of Black Women Fact Sheet
Daniel Ikem, Technology and AI Research Fellow
Post-Dobbs, Period-Tracking Data has Become Potential Criminal Evidence
After Dobbs v. Jackson Women’s Health Organization overturned the constitutional right to abortion, the data that Black women and other people who menstruate share with period and pregnancy tracking apps is no longer private by default but potential evidence. Apps like Flo, Clue, Natural Cycles, and Ovia collect cycle dates, pregnancy status, symptom logs, and location data from millions of users. Period tracking apps have over 200 million downloads; the FemTech industry is projected to reach $140 billion by 2035. 1,2 In states that have criminalized abortion or certain pregnancy outcomes, this data can be subpoenaed, purchased from data brokers, or shared with law enforcement, often without users’ knowledge or meaningful consent. In states that have criminalized abortion, including self-managed abortion, or pregnancy outcomes such as miscarriage and stillbirth, the cycle dates, pregnancy status, symptom logs, and location data collected can be subpoenaed, purchased from data brokers, or shared with law enforcement, often without users’ knowledge or informed consent.
Why State Legislatures Now Carry the Weight
In June 2025, a federal court vacated the Department of Health and Human Services’ 2024 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to Support Reproductive Health Care Privacy in Purl v. U.S. Department of Health and Human Services , and HHS declined to appeal by the August 2025 deadline. 4 The bipartisan Fourth Amendment Is Not For Sale Act passed the U.S. House in April 2024 but expired without enactment. 5 Because no federal law has set a minimum standard for reproductive health data protection, state legislatures have become the primary arena for safeguarding it. That gap matters most for reproductive health apps, which fall outside HIPAA entirely, because they are not healthcare providers, health plans, or clearinghouses. State law, therefore, is the only mechanism that currently reaches them.
User enters data (cycle dates, pregnancy status, symptoms, location)
App collects and stores data (cloud servers, not on device)
Shared with advertisers and analytics firms
Accessible via employer wellness portals
Law enforcement purchases data (no warrant required)
Data used as evidence in pregnancy-related prosecution
Pregnancy-related criminal cases in 2 years post- Dobbs
Drop in FemTech app usage after Dobbs leak 3
Federal laws specifically protecting reproductive app data
to Data Brokers
Data Collected From Users
Cycle dates, pregnancy intent, symptom logs
GPS coordinates, app-derived location traces
Pregnancy status, high-risk flags, return-to-work plans
Sexual activity, contraception use, biometric data
Advertising & analytics firms
Data brokers → law enforcement (no warrant)
Employers via wellness portals
Embedded third-party trackers
Federal Trade Commission (FTC) found Flo shared pregnancy-intent data with Facebook and Google despite privacy promises.6
FTC v. Kochava: broker sold an “Expecting Parents” segment covering 61M device IDs in one week.7
Ovia Health sells employer dashboards with aggregated employee pregnancy data.8
2025 class action alleges Natural Cycles embedded Google and TikTok trackers that captured reproductive data without consent. 9
Repurposed For Prosecution: The Medical-ToCarceral Pipeline
In 264 of the 412 post- Dobbs pregnancy-related criminal cases, information supporting prosecution came from a medical setting. 10 Prenatal visits, ER admissions, and hospital deliveries generate records that can be repurposed as evidence, and the medical-to-carceral pipeline operates with built-in racial bias. Reproductive health apps introduce a new entry point to this same pipeline, one that operates outside clinical settings but produces data of comparable evidentiary value. The overlap between racially disparate medical surveillance and the legal vulnerability of reproductive app data raises sincere concern that digital self-tracking may reinforce existing patterns of reproductive scrutiny in the states most likely to criminalize pregnancy outcomes.
50.3
Deaths per 100,000 live births—Black women
Black women’s maternal mortality vs. White women’s 12 What Apps Collect Who Accesses It
14.5
Deaths per 100,000 live births—White women
3.5X
Where Prosecutions Are Concentrated
Seven states account for the vast majority of documented post- Dobbs pregnancy prosecutions: Alabama, Oklahoma, South Carolina, Texas, Mississippi, Tennessee, and Idaho. Three states alone account for 89% of the 412 documented post-Dobbs prosecutions: Alabama (192 cases), Oklahoma (112), and South Carolina (62). 10 The national Black population share is 13.7%. Four of these states far exceed that baseline: Mississippi (37.7%), Alabama (26.5%), South Carolina (25.7%), and Tennessee (16.4%) . Mississippi, Alabama, and South Carolina rank among the eight states nationally with the highest Black population share. 13 The convergence of aggressive prosecution frameworks and large Black populations is consistent with, and raises concern about, the same structural conditions that produce the nation’s deepest racial disparities in maternal health outcomes. 13
High-Prosecution States
Alabama
Idaho
Mississippi
Oklahoma
South Carolina None
Tennessee None
Texas
Texas Data Privacy and Security Act (2024)
192 cases in two years postDobbs; chemical endangerment statute applied to fetuses; up to 10-year sentence
Near-total ban; site of FTC v. Kochava data broker case; cases documented post-Dobbs
Near-total ban; child endangerment statutes; among top 6 prosecution states
112 cases in two years postDobbs; felony child neglect charges; fetal personhood arguments used by District Attorneys (DAs)
62 cases in two years post-Dobbs; child neglect/ endangerment statutes; sixweek abortion ban
Near-total ban; Fetal Assault Law precedent (2014 to 2016); cases documented post-Dobbs
Private physician-led challenge that vacated federal HIPAA rule (Purl v. HHS); state privacy law lacks affirmative consent, sale restrictions, location-based protections, or private right of action for reproductive health data.
Six States Show the Path Forward
Six states ( California, Connecticut, Maryland, Nevada, Virginia, and Washington ) have enacted meaningful reproductive health data protections. The strongest share four features: (1) broad definitions that include data from which health conditions can be inferred; (2) affirmative consent for collection and sharing; (3) restrictions on data sales and broker access; and (4) enforcement mechanisms with teeth.
High-Protection States
California
Key Privacy Act: Confidentiality of Medical Information Act (CMIA) + Assembly Bill (AB) 45 (2026)
Key Detail: Attorney General (AG) guidance extending CMIA to apps; locationbased ban near family planning centers (2026)
Maryland
Key Privacy Act: Maryland Online Data Privacy Act (MODPA) (enforcement 2026)
Key Detail: “Strictly necessary” data minimization standard; prohibits sale of sensitive data; location-based ban
Virginia
Key Privacy Act: SB 754 (2025)
Key Detail: Covers inferred/derived data; $500 minimum statutory damages; private right of action; no revenue thresholds
Connecticut
Key Privacy Act: Public Act 23-56 (2023)
Key Detail: Opt-in consent; location-based ban; AG enforcement; applies to all entities regardless of size
Nevada
Key Privacy Act: Senate Bill (SB) 370 (2023)
Key Detail: Mirrors My Health My Data (MHMD) Act; AG enforcement only; location-based ban within 1,750 feet
Washington
Key Privacy Act: My Health My Data (MHMD) (2023)
Key Detail: Signed April 27, 2023. First state law protecting consumer health data outside HIPAA. Broadest scope; private right of action; location-based ban; no revenue thresholds; extends to out-of-state companies
Policy Recommendations
Given the current state of federal protection, the primary pathway runs through state legislatures. The four state-level recommendations below are each modeled on legislation already enacted in at least one state, no state would need to innovate from scratch. Two remaining federal pathways should be pursued in parallel.
For State Legislators
• Enact data minimization statutes for reproductive health apps. Adopt Maryland’s Online Data Privacy Act “strictly necessary” standard and prohibit the sale of sensitive health data.
• Extend shield law coverage to consumer health app data. Apply Washington’s My Health My Data Act model: no revenue thresholds, private right of action, reach to out-of-state companies serving residents.
• Restrict law enforcement purchase of data from brokers without a warrant. Enact the state equivalent of the My Health My Data Act to close the Carpenter loophole that lets agencies buy what they would otherwise need a warrant to collect.
• Require privacy-by-design disclosures from platforms. Mandate standardized disclosure of data collection, third-party sharing, and law-enforcement request policies, building on the FTC’s revised Health Breach Notification Rule (16 C.F.R. Part 318).14
For Federal Policymakers
• Pursue FTC rulemaking to classify excessive reproductive health data collection as an unfair trade practice. The FTC already has Section 5 authority to classify excessive data collection as an unfair trade practice without new congressional authorization.15 A targeted rulemaking for the FemTech sector could establish baseline minimization standards and disclosure requirements, the most actionable federal pathway because it requires no new legislation.
• Reintroduce and enact the Fourth Amendment Is Not For Sale Act. The bill passed the U.S. House 219–199 in April 2024 but expired with the 118th Congress. Reintroduction and enactment would close the data broker loophole Carpenter v. United States left open.16
The bottom line: Six states have demonstrated that comprehensive protection is legislatively achievable. The states with the highest prosecution rates and deepest racial disparities in maternal health should follow their lead.
Scan the QR code below to access a full list of references
Acknowledgements: Technology and AI Fellowship sponsored through partnership with American Institutes for Research Opportunity Fund