Tracked & Targeted: Reproductive Health App Surveillance & Criminalization of Black Women

Center for Policy Analysis and Research Technology and Health Equity

May 2026

Tracked and Targeted: Reproductive Health App Surveillance and the Criminalization of Black Women Daniel Ikem, Technology and AI Research Fellow

I. Introduction After the 2022 Supreme Court decision in Dobbs v. Jackson Women’s Health Organization overturned the constitutional right to abortion, the data that Black women and people who menstruate share with period and pregnancy tracking apps has taken on new legal significance.

In states that moved to criminalize abortion, including self-managed abortion, or pregnancy outcomes such as miscarriage and stillbirth, this data is no longer just personal; it is potential evidence. Apps like Flo, Clue, Natural Cycles, and Ovia, part of a rapidly growing sector known as “FemTech,” or female-focused health technology, collect cycle dates, pregnancy status, symptom logs, and location data from millions of users. In states that have criminalized abortion or certain pregnancy outcomes, this data can be subpoenaed, purchased from data brokers, or shared with law enforcement, often without users’ knowledge or meaningful consent. Most standalone reproductive health apps are not covered by the Health Insurance Portability and Accountability Act (HIPAA) because they collect data directly from consumers outside a treatment, insurance, or provider relationship. As a result, much of the reproductive health information generated through these apps falls into a regulatory gap between health privacy law and consumer data practices.

1

While this shift affects all users of reproductive health apps, Black women face heightened risk due to existing disparities in healthcare surveillance, pregnancy-related criminalization, and maternal health outcomes. Moreover, reproductive health apps have created a new and underregulated channel for that harm. In the two years following Dobbs, prosecutors initiated over 400 pregnancy-related criminal cases across sixteen states, with Alabama (192), Oklahoma (112), and South Carolina (62) accounting for 89% of documented prosecutions. 1 These cases do not, on the current public record, establish widespread use of reproductive health app data in prosecution. They do, however, illustrate the broader legal environment in which reproductive information of many kinds can be repurposed for investigation and criminal enforcement. Meanwhile, research using mobile phone panel data found a 66.7% reduction in weekly time spent on FemTech apps after the draft Dobbs majority opinion was leaked, signaling the Court’s intent to overturn Roe v. Wade weeks before the official June 24, 2022 decision. The magnitude of the decline was shaped by demographic factors including race, age, and income. 2

Alabama

Oklahoma

South Carolina

This brief examines what data reproductive health apps collect, under what legal conditions that data can be accessed by third parties or government actors, and which state-level frameworks offer the most effective protection for pregnant Black women and other Black birthing people.

It closes with targeted policy recommendations for legislators to ensure that state privacy frameworks keep pace with the risks these technologies pose, particularly for Black women and other communities already subject to disproportionate health system surveillance. This brief is intentionally state-focused because no federal statute specifically governs reproductive health app data. The only significant federal effort to close this gap was the U.S. Department of Health and Human Services’ (HHS) April 2024 HIPAA Privacy Rule (89 FR 32976), which would have prohibited the use or disclosure of protected health information (PHI) for investigations related to lawful reproductive healthcare and required attestations from requestors. In June 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 HIPAA Privacy Rule amendments protecting reproductive health data, ruling that HHS exceeded its statutory authority. Thus, what follows is an examination of how this gap operates, who bears its weight, and what state legislatures can do to close it.

3

II. The Rise of Reproductive Health Apps Reproductive health apps emerged in the early-to-mid 2010s as part of a rapidly growing FemTech industry, which is projected to reach $140 billion by 2035. 3 Flo, the most widely used, was founded in 2015 and reports over 420 million downloads and 77 million monthly active users worldwide. 4 Clue, launched in 2013 as the first science-based, gender-neutral menstrual tracking app, states that it has reached 10 million monthly active users across 190 countries. 5 Natural Cycles, founded in 2013, became the first app to receive U.S. Food and Drug Administration (FDA) clearance as a digital contraceptive in 2018. 6 Ovia Health, also launched in 2013, markets itself as a “family benefits solution” and has been integrated into employer-sponsored health programs. 7

$60.89B

420M

Revenue, 2025

Flo Downloads

$140B Forecast Year, 2035

87M Flo and Clue App Monthly Combined Users

These apps are marketed as empowerment tools, platforms that give users knowledge and control over their reproductive health without requiring a doctor’s visit or prescription. People use them to predict the timing of their next period, monitor symptoms such as mood, pain, sleep, and sexual activity, estimate fertility windows to plan or avoid pregnancy, and share cycle data with healthcare providers. 8,9 A recent global analysis estimates that menstrual tracking apps have been downloaded over 200 million times worldwide, with leading apps like Clue, Flo, and Period Tracker dominating the market. 10 For many people, these apps can function as a primary source of reproductive health information and bodily awareness, especially where access to care is limited or for younger users. Period tracking apps more broadly have been shown to increase menstrual literacy and bodily awareness. 9 Because the apps require no prescription, no appointment, and no insurance, they fall outside the regulatory frameworks designed to protect health information. The privacy risk arises not only from the sensitivity of the data collected but also from the fact that this information is generally governed by consumer contracts, platform integrations, and commercial data practices rather than by medical confidentiality rules. Users receive the accessibility of a consumer product but none of the privacy safeguards of a clinical one.

4

The HIPAA Gap Most reproductive health apps, including Flo, Clue, Natural Cycles, and Ovia, are not covered

by HIPAA. HIPAA’s privacy and security rules apply only to “covered entities”—healthcare providers, health plans, and healthcare clearinghouses—and to the “business associates” that handle protected health information on their behalf. 11 Consumer-facing apps that collect health data directly from users, outside of any treatment or insurance relationship, fall outside that definition and are instead governed primarily by their own terms of service and the Federal Trade Commission’s general consumer protection authority. The result is that the most intimate health data millions of women generate daily exists entirely outside the federal health privacy framework. This vulnerability is analytically distinct from the privacy of reproductive health information held by hospitals, insurers, or other HIPAA-covered entities. Consumer app data and provider-held protected health information are governed by different legal regimes, even when they concern the same pregnancy or reproductive event. A 2025 peer-reviewed study evaluating four major reproductive health apps confirmed significant privacy and security shortcomings, including IP address tracking, third-party data sharing for advertising purposes, and the potential for data misuse. 8 Yet the same features that make these apps valuable – detailed symptom logging, location tracking, pregnancy intention data, and integration with wearable devices – also make them potent sources of evidence in states where pregnancy outcomes can trigger prosecution. Data types collected by major apps include menstrual cycle dates; pregnancy status and intention; symptom logs covering mood, sexual activity, and medication; GPS coordinates; browsing behavior; and biometric data from connected wearables. As one leading scholar has argued, reproductive health surveillance extends far beyond abortion to encompass contraception, pregnancy, infertility, and loss of pregnancy. Individual solutions, such as deleting periodtracking apps, are ultimately insufficient to address what is fundamentally a structural dataprivacy problem demanding systemic legal and policy reform. 12

5

These downstream exposure pathways are not identical in either legal significance or evidentiary support. Some are established through federal enforcement actions, others through investigative reporting, and still others through pending litigation allegations. Sharing mechanisms documented through federal enforcement actions and investigative reporting include: Advertising and analytics firms. In 2021, the Federal Trade Commission (FTC) documented that Flo Health shared sensitive health data, including whether users intended to become pregnant, with Facebook, Google, and other marketing firms despite privacy promises. The FTC, not HHS, had to act because Flo is not a HIPAA-covered entity. 13 Data brokers. The FTC demonstrated that data broker Kochava sold an “Expecting Parents” audience segment based on consumers’ use of pregnancy and fertility tracking apps, covering 61 million unique mobile identifiers in one week. Using a data sample, the FTC was able to track a mobile device from a reproductive health clinic to a single-family residence, effectively identifying the individual. 14 Employers. Investigative reporting revealed that Ovia Health provides a “family benefits solution” to employers who can access aggregated employee health data, including high-risk pregnancy percentages, most common medical queries, and planned returnto-work dates through an internal employer portal. 7 Third-party trackers embedded in apps. A 2025 class action alleges that Natural Cycles, an FDA-cleared digital birth control app marketed as privacy-protective, embedded hidden tracking technologies from Google, TikTok, and other third parties that captured users’ reproductive and sexual health data in real time and transmitted it without consent. 15

6

III. No Federal Floor: How Existing Law Fails Federal law fails Black women and other reproductive health app users along two separate dimensions. First, most reproductive health app data falls outside HIPAA altogether because it is collected directly by consumer-facing platforms rather than by covered entities or their business associates. Second, the federal government’s effort to strengthen privacy protection for provider-held reproductive health information was vacated in 2025, leaving no minimum baseline of legal protections set by federal law even within the HIPAA system. This section addresses both, beginning with the failed regulatory effort to strengthen HIPAA protections and turning next to the constitutional and statutory loophole that allows commercial brokers to sell data the government would otherwise need a warrant to obtain.

Federal Protection Attempted and Lost No federal statute specifically protects reproductive health data from being used in criminal investigations or prosecutions. In the wake of Dobbs, the Biden Administration’s HHS attempted to close this gap. In April 2024, HHS issued a final rule (89 FR 32976) that would have prohibited the use or disclosure of protected health information for investigations related to lawful reproductive healthcare, required attestations from requestors, and mandated revisions to Notices of Privacy Practices. 16 It was the most significant federal effort to address the HIPAA gap following Dobbs. However, the rule faced an immediate legal challenge. Even so, the rule addressed only protected health information held within HIPAA-regulated systems. It would not have directly governed most standalone period, fertility, or pregnancy-tracking apps collecting data outside clinical and insurance relationships.

In October 2024, Dr. Carmen Purl, a Texas family physician, filed suit arguing that the rule exceeded HHS’s statutory authority and conflicted with Texas’s mandatory child abuse reporting obligations. On December 22, 2024, the court issued a preliminary injunction. Following the change in administration, the Trump Administration’s HHS declined to defend the rule on the merits, stating it was “under review by new leadership.” On June 18, 2025, Judge Matthew Kacsmaryk of the U.S. District Court for the Northern District of Texas vacated most of the rule in Purl v. U.S. Department of Health and Human Services, No. 2:24-cv-00228-Z, finding that HHS exceeded its statutory authority, unlawfully preempted state public health laws, and violated the major questions doctrine. 17 Third-party intervention efforts by the cities of Columbus, Ohio, and Madison, Wisconsin, along with Doctors for America, were denied at the trial level, and the appeal was voluntarily dismissed in September 2025, ending the last avenue for preserving the rule. 18 HHS itself did not appeal by the August 18, 2025 deadline, effectively abandoning the only federal effort to strengthen reproductive health data protections. 19 The Georgetown Law O’Neill

7

Institute confirmed that without the vacated rule, the 2000 HIPAA Privacy Rule permits but does not require covered entities to disclose protected health information to law enforcement, leaving individual providers to decide whether to share patient information with investigators. 17 The Purl decision left reproductive health data held by covered entities without enhanced federal protection. But even if the rule had survived, it would not have addressed a separate and arguably more dangerous vulnerability: the commercial data market. For that reason, the collapse of the 2024 rule matters most as part of a broader picture of federal insufficiency, not as the sole source of vulnerability for reproductive health app users.

The Data Broker Loophole In Carpenter v. United States (2018), the Supreme Court held that government acquisition of historical cell-site location information constitutes a Fourth Amendment search requiring a warrant. The case arose from an FBI investigation of armed robberies in Michigan, in which agents obtained 127 days of location data (12,898 data points) from Timothy Carpenter’s wireless carrier without a warrant, relying instead on a court order under the Stored Communications Act’s lower “reasonable grounds” standard. 20 In a 5–4 decision, Chief Justice Roberts declined to extend the third-party doctrine to this category of data, recognizing that cell-site records provide a “detailed, encyclopedic, and effortlessly compiled” chronicle of a person’s movements.

While Carpenter established that the government cannot compel carriers to produce location data without a warrant, it left open a critical gap: the decision does not restrict the government from purchasing the same data from commercial brokers. Legal scholarship building on Carpenter has argued that this loophole effectively circumvents the warrant requirement for the most intimate categories of health data. 21 For reproductive health app users, this distinction matters because sensitive location, inference, and behavioral data may be unavailable to the government through direct compulsion without legal process, yet still obtainable in commercially brokered form.

The bipartisan Fourth Amendment Is Not For Sale Act, sponsored in the House by Rep. Warren Davidson (R-OH) and in the Senate by Sen. Ron Wyden (D-OR), would require government agencies to obtain a court order before purchasing data from commercial brokers that they would otherwise need a warrant to collect directly. 22 The bill passed the House of Representatives in April 2024 by a vote of 219–199 but was not enacted before the 118th Congress adjourned in January 2025 and has not been reintroduced in the current session. 23,24 In the absence of federal action, state legislation is the only mechanism available to restrict warrantless data broker purchases of reproductive health information.

The collapse of federal legislative and regulatory efforts, the nullification of the HIPAA rule, the failure to enact the Fourth Amendment Is Not For Sale Act, and the absence of any restriction on data broker sales, confirms that state legislatures are now the primary arena for reproductive health data protection.

8

IV. A Patchwork of Protection: How States Compare With federal protection eliminated, state law is the only operative defense for reproductive health app data. The landscape as of early 2026 is a patchwork: six states (California, Connecticut, Maryland, Nevada, Virginia, and Washington) have enacted meaningful protections, while seven of the highest-prosecution states (Alabama, Idaho, Mississippi, Oklahoma, South Carolina, Tennessee, and Texas) lack a comparable consumer-health-data privacy framework. 25 As used in this brief, stronger protection refers to legal frameworks that combine broad definitions of consumer health data, affirmative consent requirements, restrictions on sale or transfer, geofencing or location-based protections, and meaningful enforcement mechanisms.

The states that provide the strongest protection share four common features: (1) broad definitions of consumer health data that include reproductive and sexual health information and, critically, data from which health conditions can be inferred; (2) affirmative consent requirements for data collection and sharing; (3) restrictions on data sales and data broker access; and (4) enforcement mechanisms with teeth, whether through private rights of action (Washington, Virginia) or attorney general enforcement authority (Nevada, Connecticut, Maryland). The highest-prosecution states share a different set of features: fetal personhood doctrines embedded in statute or case law, chemical endangerment or child neglect statutes interpreted to apply to fetuses, and the complete absence of consumer health data privacy protections.

Washington

!

Connecticut

Idaho

Maryland

Nevada

Virginia

California

!

High-Protection

!

9

High-Prosecution

!

Tennessee

Oklahoma

!

Mississippi

Texas

!

!

Alabama

!

South Carolina

High-Prosecution States The national Black population share is 13.7%. 26 Four of the seven highest-prosecution states far exceed that baseline: Mississippi (37.7%), Alabama (26.5%), South Carolina (25.7%), and Tennessee (16.4%). 26 Of these, Mississippi, Alabama, and South Carolina rank among the eight states nationally with the highest Black population share. 26 Oklahoma and Alabama together account for 304 of the 412 documented post-Dobbs cases. 1 The convergence of aggressive prosecution frameworks and large Black populations is consistent with, and raises concern about, the same structural conditions that produce some of the nation’s deepest racial disparities in maternal health outcomes.

State

Key Privacy Law

Alabama

None

Idaho

None

Mississippi

None

Oklahoma

None

South Carolina

None

Tennessee

None

Texas

Texas Data Privacy and Security Act (2024)

Key Details 192 cases in two years postDobbs; chemical endangerment statute applied to fetuses; up to 10-year sentence Near-total ban; site of FTC v.

Kochava data broker case; cases documented post-Dobbs Near-total ban; child endangerment statutes; among top 6 prosecution states 112 cases in two years postDobbs; felony child neglect charges; fetal personhood arguments used by District Attorneys (DAs) 62 cases in two years post-Dobbs; child neglect/ endangerment statutes; sixweek abortion ban Near-total ban; Fetal Assault Law precedent (2014 to 2016); cases documented post-Dobbs Private physician-led challenge that vacated federal HIPAA rule (Purl v. HHS); state privacy law lacks affirmative consent, sale restrictions, location-based protections, or private right of action for reproductive health data.

10

V. The Medical-to-Carceral Pipeline: Why Black Women Bear the Burden Reproductive health app surveillance does not operate in isolation. It is part of an existing infrastructure that already channels Black women and other Black birthing people disproportionately from the clinic to the courtroom. Understanding the app data problem requires understanding the pipeline it feeds. The strongest evidence concerns racialized surveillance in clinical settings, where peer-reviewed research and tracked prosecution data document how Black women are disproportionately drawn into the medical-to-carceral pipeline.

App-based surveillance is best understood as an emerging extension of that pipeline rather than as a separately documented prosecutorial pattern, since the public record does not yet contain comparable evidence of app data being used at scale in pregnancy prosecutions.

Repurposed for Prosecution: The Criminalization of Black Mothers Through Surveillance Data In 264 of the 412 post-Dobbs pregnancy-related criminal cases, information supporting criminal prosecution was obtained or disclosed in a medical setting. 1 Prenatal visits, emergency room admissions, and hospital deliveries generate records that can be repurposed for criminal proceedings. This medical-to-carceral pipeline operates with built-in racial bias at every stage.

A study of peripartum drug testing, for example, found that Black women and their newborns were 1.5 times more likely to be tested for illicit drugs than non-Black women after controlling for clinical risk factors. 32 A 2023 study of over 26,000 live births in Michigan found that Black newborns had 2.72 times the odds of being drug tested compared with white newborns. 33 When pregnant people disclosed drug use, clinicians were more likely to order urine drug testing for Black patients than for their white counterparts, suggesting clinician racial bias. 34 Reproductive health apps introduce a new entry point to this pipeline, one that operates outside clinical settings but produces data of comparable evidentiary value. App data is not identical to clinical documentation, but it can serve similar evidentiary functions by recording timing, symptoms, reproductive intent, movement patterns, and other details that may later be used to infer pregnancy-related decision-making. Location pings, symptom logs, and menstrual cycle records can be subpoenaed, purchased from brokers, or obtained from third-party trackers embedded in the apps themselves. The overlap between racially disparate medical surveillance and the legal vulnerability of reproductive app data raises serious concern that digital selftracking may reinforce existing patterns of reproductive scrutiny in the states most likely to criminalize pregnancy outcomes.

11

Scale and Concentration Black women experience maternal mortality at more than three times the rate of white women, with 50. 3 deaths per 100,000 live births compared to 14.5 for white women in 2023. 27 Pregnancyrelated prosecutions are concentrated in states with the largest racial disparities in maternal health outcomes; Alabama alone accounted for 192 cases in two years. 1 The Pregnancy Justice data does not provide a racial breakdown of the 412 post-Dobbs cases, a gap the organization itself has acknowledged. That limitation is important. The demographic and legal patterns identified here should be understood as evidence of structural exposure and likely disparate impact, not as direct race-disaggregated proof of app-based prosecution. However, the structural conditions in the highest-prosecution states point strongly toward racially disparate impact. Alabama is the clearest example, accounting for nearly half of all documented cases and has one of the highest Black maternal mortality rates in the nation. 1 The state relies on a chemical endangerment statute originally enacted to address methamphetamine exposure in children, a statute whose application to pregnant people has been criticized for disproportionately targeting low-income Black women in the state’s Black Belt counties. 28,29 This pattern extends beyond Alabama, where in self-managed abortion cases, people of color are twice as likely to face homicide charges as white individuals. 30 More than one-third of Black women in restrictive states say Dobbs has made them fear arrest related to pregnancy. 31 Together, these patterns describe a system already calibrated to draw Black women into criminal proceedings throughout their reproductive lives, the precise system into which reproductive health app data is now being added.

12

The people who could benefit most from cycle monitoring, symptom tracking, and early pregnancy detection may also face the strongest incentives to avoid creating digital records of their reproductive lives.

13

The Self-Tracking Paradox These surveillance patterns have behavioral consequences. Research using mobile phone panel data found that FemTech app usage dropped sharply after the leak of the draft Dobbs opinion in May 2022, with the magnitude of decline varying by race, age, and income. 2 Although the available study identifies demographic variation in the size of that decline, more research is needed to determine how this withdrawal from self-tracking is distributed across specific racial groups and legal environments. This avoidance behavior creates a self-reinforcing trap.

Black women already receive lower-quality obstetric care, and their pain and symptoms are systematically minimized by providers. 35 A 2016 landmark study found that a significant share of white medical trainees held false beliefs about biological differences between Black and white patients, such as the belief that Black people have thicker skin or less sensitive nerve endings, leading to lower pain assessments and less appropriate treatment recommendations. 36 A 2023 KFF survey found that 22% of Black women who had been pregnant or given birth in the prior decade reported being refused pain medication they believed they needed. 37 In response to these failures of the traditional healthcare system, many have turned to reproductive health apps as essential tools to document symptoms, track patterns, and advocate for themselves within a system that routinely disbelieves them. Yet these same women are now leaving the tools that offered a measure of autonomy over their own care, not because the apps failed them, but because the legal environment has made self-tracking an act of potential self-incrimination. The result may be a widening gap: the people who could benefit most from cycle monitoring, symptom tracking, and early pregnancy detection may also face the strongest incentives to avoid creating digital records of their reproductive lives. For Black women in restrictive states, that tension is especially acute because digital self-tracking now exists alongside longstanding barriers to respectful, trustworthy, and equitable care.

14

VI. Policy Recommendations Because federal protection has collapsed, the primary pathway for reproductive health data protection is now state legislation. The six states profiled below have demonstrated that comprehensive protection is legislatively achievable, and each offers a tested template that other states can adapt. The recommendations that follow identify four state-level actions, followed by two remaining federal pathways that policymakers should pursue in tandem.

The recommendations below respond to four distinct vulnerabilities identified in this brief: overcollection of sensitive reproductive data, downstream sharing to third parties, government acquisition through commercial brokers or legal process, and weak enforcement when misuse occurs.

A Closer Look at the Six State Models: High-Protection States California. California’s approach combines the state’s Confidentiality of Medical Information Act (CMIA), attorney general guidance extending CMIA coverage to apps, and AB 45 (effective 2026), which prohibits location tracking within 1,850 feet of family planning centers.

Connecticut. Public Act 23-56 (2023) requires opt-in consent for processing consumer health data and includes a location-based geofencing prohibition. Unlike most state privacy laws, it applies to all entities regardless of size, meaning small reproductive health apps are not exempt.

Maryland. The Maryland Online Data Privacy Act (effective 2026) applies a “strictly necessary” data minimization standard, more restrictive than the “reasonable necessity” standard used in most state privacy laws. It flatly prohibits the sale of sensitive data, including reproductive health information, and includes a location-based ban near family planning centers.

Nevada. SB 370 (2023) closely mirrors Washington’s My Health My Data Act in substantive scope but diverges in enforcement: attorney general enforcement only, with no private right of action. It includes a location-based ban extending 1,750 feet from healthcare facilities.

Virginia. SB 754 (2025) is one of the strongest state laws enacted to date because it explicitly covers inferred and derived data, information extrapolated from other data points about a user’s health condition.

It includes $500 minimum statutory damages per violation, a private right of action, and no revenue thresholds.

Washington. The My Health My Data Act, signed by Governor Inslee on April 27, 2023, was the first state law to protect consumer health data outside HIPAA. It applies with no revenue or processing thresholds, extends to out-of-state companies serving Washington residents, and carries a private right of action enforceable under the state’s Consumer Protection Act. A location-based provision restricts geofencing around healthcare facilities.

15

California

Connecticut

Key Privacy Act: Confidentiality of Medical Information Act (CMIA) + Assembly Bill (AB) 45 (2026)

Key Privacy Act: Public Act 23-56 (2023)

Key Detail: Attorney General (AG) guidance extending CMIA to apps; locationbased ban near family planning centers (2026)

Key Detail: Opt-in consent; location-based ban; AG enforcement; applies to all entities regardless of size

Nevada Maryland Key Privacy Act: Maryland Online Data Privacy Act (MODPA) (enforcement 2026) Key Detail: “Strictly necessary” data minimization standard; prohibits sale of sensitive data; location-based ban

Key Privacy Act: Senate Bill (SB) 370 (2023) Key Detail: Mirrors My Health My Data (MHMD) Act; AG enforcement only; location-based ban within 1,750 feet

Virginia

Washington

Key Privacy Act: SB 754 (2025)

Key Privacy Act: My Health My Data (MHMD) (2023)

Key Detail: Covers inferred/derived data; $500 minimum statutory damages; private right of action; no revenue thresholds

Key Detail: Signed April 27, 2023. First state law protecting consumer health data outside HIPAA. Broadest scope; private right of action; location-based ban; no revenue thresholds; extends to out-of-state companies

16

State-Level Recommendations Enact data minimization statutes for reproductive health apps.

Maryland’s Online Data Privacy Act, which takes effect in 2026, applies a “strictly necessary” standard to all sensitive data processing, including reproductive health information, and flatly prohibits the sale of sensitive data. Other states should adopt comparable data minimization requirements for reproductive health apps, prohibiting the collection of health data beyond what is strictly necessary to provide the requested service. Data minimization is the most fundamental protection because it limits the volume of data that can be accessed, subpoenaed, or purchased in the first place.

Extend shield law coverage to consumer health app data.

Washington’s My Health My Data Act applies to any entity collecting consumer health data with no revenue or processing thresholds and includes a private right of action for violations. Other states should extend reproductive health shield law coverage beyond healthcare providers to any entity that collects, processes, or shares reproductive health information, regardless of whether that entity is a HIPAA-covered entity. At a minimum, such protections should limit compelled disclosure, restrict voluntary cooperation with out-of-state reproductive investigations, and apply to entities that collect, infer, process, or transfer reproductive health information outside HIPAA-covered settings.

Restrict law enforcement purchase of data from brokers without a warrant.

The Fourth Amendment Is Not For Sale Act framework, which passed the U.S. House in 2024 but was not enacted, provides a model for state-level legislation. States should close the loophole that allows government agencies to buy reproductive health data from commercial data brokers without a warrant, subpoena, or any court oversight. This is the most direct mechanism for preventing the Kochava scenario, in which location data and app-derived audience segments are sold to entities that can identify individual clinic visitors.

Require privacy-by-design disclosures from platforms.

The FTC’s revised Health Breach Notification Rule (16 C.F.R. Part 318, 2024) explicitly covers health and wellness apps not subject to HIPAA and requires breach notification whenever identifiable health data is disclosed without authorization, including to advertising platforms.39 At a minimum, those disclosures should clearly identify what categories of data are collected, why they are collected, how long they are retained, which third parties receive them, whether inferred reproductive-health profiles are created, how users can delete their data, and how the company responds to law-enforcement requests. States should mandate that reproductive health apps disclose data collection practices, third-party sharing arrangements, and law enforcement request policies in standardized, accessible formats. Users cannot make informed decisions about data sharing when privacy policies are written to obscure rather than inform.

17

Federal Pathways That Remain Open While the primary arena is state legislation, two federal actions remain within reach and should be pursued in tandem.

Pursue FTC rulemaking to classify excessive reproductive health data collection as an unfair trade practice.

The Electronic Privacy Information Center (EPIC) has argued that the Federal Trade Commission already possesses statutory authority under Section 5 of the FTC Act to classify excessive data collection as an unfair trade practice, without new congressional authorization.38 A targeted rulemaking applied to the FemTech sector could establish baseline data minimization standards, restrict third-party sharing, and mandate disclosure requirements. This may offer a more immediate federal pathway than new legislation, although any such rulemaking would likely face legal and political challenge.

Reintroduce and enact the Fourth Amendment Is Not For Sale Act. The bill passed the U.S. House in April 2024 by a bipartisan 219–199 vote, but it expired in the 118th Congress.22 Reintroduction in the 119th Congress and enactment would close the data broker loophole that Carpenter v. United States left open, restoring the warrant requirement for the sensitive location and health data the government would otherwise need to subpoena directly.

Taken together, these recommendations demonstrate that reproductive health data exposure is not a bug in particular apps but a feature of the ecosystem. Multiple leading reproductive health apps have been sanctioned, investigated, or accused of sharing user data through one or more of these channels, including advertising and analytics disclosures, employer-facing reporting structures, data-broker ecosystems, and embedded third-party trackers.

18

VII. Conclusion The post-Dobbs legal environment has made reproductive health app data newly vulnerable to surveillance, commercial transfer, and potential evidentiary use. Black women and other Black birthing people bear the compounding weight of this transformation: higher maternal mortality, disproportionate prosecution, greater healthcare surveillance, and deeper mistrust of the systems designed to help them. Although public evidence remains limited on prosecutions specifically involving app data and disaggregated by race, the existing legal and technological architecture already reveals a substantial risk of extending longstanding reproductive inequities into digital self-tracking environments. The federal government’s most significant effort to close the protection gap, the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy, was vacated by a federal court in June 2025, less than a year after taking effect. While federal legislation remains possible, no bill currently before Congress specifically targets reproductive health app data. The Fourth Amendment Is Not For Sale Act, if reintroduced, would address the data broker pathway. In the absence of federal action, state legislation has emerged as the most viable and proven pathway for protecting reproductive health app data.

Six states have demonstrated that effective protections are legislatively achievable. The frameworks enacted in Washington, Virginia, Maryland, Nevada, Connecticut, and California provide a tested model that other states, particularly those with the highest prosecution rates and the deepest racial disparities in maternal health, should adopt to protect pregnant people from data-driven surveillance and criminalization. The policy recommendations in this brief are designed to be immediately actionable, modeled on enacted legislation, and responsive to the specific mechanisms through which harm occurs. The states that have acted show that the path forward is clear. The states with the highest prosecution rates and deepest racial disparities in maternal health should follow their lead.

19

References 1.

Pregnancy Justice. (2025, September 30). Pregnancy as a crime: An interim update on the first two years after Dobbs. https://www.pregnancyjusticeus.org/resources/ pregnancy-as-a-crime-an-interim-update-on-the-first-two-years-after-dobbs/ 2. Basavaraj, N., Ananthakrishnan, U. M., & Tucker, C. E. (2024). The chilling effect of Dobbs: A study of mobile health apps usage (MIT Sloan Research Paper No. 7156-24).

SSRN. https://doi.org/10.2139/ssrn.4924919 3. Precedence Research. (2025). Femtech market size, share & trends analysis report, 2026–2035. https://www.precedenceresearch.com/femtech-market 4. Flo Health, Inc. (n.d.). About Flo. https://flo.health/about-flo 5. Clue by Biowink GmbH. (n.d.). About Clue. https://helloclue.com/about-clue 6. U.S. Food and Drug Administration. (2018). De Novo classification request for Natural Cycles (DEN170052). https://www.accessdata.fda.gov/cdrh_docs/reviews/ DEN170052.pdf 7. Harwell, D. (2019, April 10). Is your pregnancy app sharing your intimate data with your boss? The Washington Post. https://www.washingtonpost.com/ technology/2019/04/10/tracking-your-pregnancy-an-app-may-be-more-public-thanyou-think/ 8. Zadushlivy, N., Biviji, R., & Williams, K. S. (2025). Exploration of reproductive health apps’ data privacy policies and the risks posed to users: Qualitative content analysis.

Journal of Medical Internet Research, 27, e51517. https://doi.org/10.2196/51517 9. Kelly, B. G., & Habib, M. (2023). Missed period? The significance of period-tracking applications in a post-Roe America. Sexual and Reproductive Health Matters, 31(4), 2238940. https://doi.org/10.1080/26410397.2023.2238940 10. Rampazzo, F., Raybould, A., Leasure, D., et al. (2024). “UPDATE: I’m pregnant!”: Inferring global downloads and reasons for using menstrual tracking apps. Digital Health, 10, 20552076241298315. https://doi.org/10.1177/20552076241298315 11. U.S. Department of Health and Human Services. (2024). Covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/covered-entities/ index.html 12. Prince, A. E. R. (2023). Reproductive health surveillance. Boston College Law Review, 64(5), 1077–1144. https://bclawreview.bc.edu/articles/3080 13. Federal Trade Commission. (2021, June 22). FTC finalizes order with Flo Health, a fertility-tracking app that shared sensitive health data with Facebook, Google, and others. https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizesorder-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google 14. Federal Trade Commission. (2022). Complaint, FTC v. Kochava, Inc., No. 2:22-cv-00377 (D. Idaho). https://www.ftc.gov/system/files/ftc_gov/pdf/1.%20Complaint.pdf 15. S.A. v. NaturalCycles USA Corp., No. 3:25-cv-10421 (N.D. Cal. filed Dec. 4, 2025). https:// dockets.justia.com/docket/california/candce/3:2025cv10421/460776 16. HIPAA Privacy Rule To Support Reproductive Health Care Privacy, 89 Fed. Reg. 32976 (Apr. 26, 2024). https://www.federalregister.gov/documents/2024/04/26/2024-08503/ hipaa-privacy-rule-to-support-reproductive-health-care-privacy 17. Ravi, S. (2025, July 22). Purl’s HIPAA ruling rolls back essential reproductive privacy protections nationwide. O’Neill Institute for National and Global Health Law, Georgetown University Law Center. https://oneill.law.georgetown.edu/purls-hipaaruling-rolls-back-essential-reproductive-privacy-protections-nationwide/

20

21

18. Coates’ Canons, UNC School of Government. (2025). Final update on the 2024 HIPAA final rule regarding reproductive health. https://canons.sog.unc.edu/2025/09/finalupdate-2024-hipaa-final-rule/ 19. Mandelbaum, K., & Mihok, S. R. (2025, September 23). All is not lost as the sun sets on the HIPAA Reproductive Health Rule. Epstein Becker & Green Workforce Bulletin. https://www.workforcebulletin.com/all-is-not-lost-as-the-sun-sets-on-the-hipaareproductive-health-rule 20. Carpenter v. United States, 585 U.S. ___ (2018). https://supreme.justia.com/cases/ federal/us/585/16-402/ 21. Bhatia, R. (2024). A loophole in the Fourth Amendment: The government’s unregulated purchase of intimate health data. Washington Law Review Online, 98, 67–92. https:// digitalcommons.law.uw.edu/wlro/vol98/iss2/1 22. Fourth Amendment Is Not For Sale Act, H.R. 4639, 118th Cong. (2023). https://www. congress.gov/bill/118th-congress/house-bill/4639 23. American Civil Liberties Union. (2024, April 17). After House passes Fourth Amendment Is Not For Sale Act, ACLU urges Senate to stop government from spying on Americans without a warrant [Press release]. https://www.aclu.org/press-releases/housepasses-fourth-amendment-is-not-for-sale-act 24. GovTrack. (n.d.). H.R. 4639—118th Congress: Fourth Amendment Is Not For Sale Act. https://www.govtrack.us/congress/bills/118/hr4639 25. Murphy, S. (2025, September 26). Reproductive health data privacy: What now?

Network for Public Health Law. https://www.networkforphl.org/news-insights/ reproductive-health-data-privacy-what-now/ 26. U.S. Census Bureau. (n.d.). QuickFacts: United States. U.S. Department of Commerce. https://www.census.gov/quickfacts/fact/table/US/PST045225 27. Hoyert, D. L. (2025, February). Maternal mortality rates in the United States, 2023.

NCHS Health E-Stats. National Center for Health Statistics. https://www.cdc.gov/nchs/ data/hestat/maternal-mortality/2023/maternal-mortality-rates-2023.htm 28. Yurkanin, A. (2019, July 3). Alabama woman’s case highlights state’s aggressive prosecution of pregnant women. NPR. https://www.npr.org/2019/07/03/738586890/ 29. Brunson, J. (2022). Pregnant people caught in the war on drugs: A unique Alabama statute being used to criminally prosecute pregnant people for drug use. University of Miami Law Review. https://lawreview.law.miami.edu/pregnant-people-caught-inthe-war-on-drugs-a-unique-alabama-statute-being-used-to-criminally-prosecutepregnant-people-for-drug-use 30. CUNY School of Law, Human Rights and Gender Justice Clinic. (2024, October). U.S. criminalization of abortion and pregnancy outcomes [Report to the UN Human Rights Committee]. https://www.law.cuny.edu/academics/clinical-programs/hrgj/projects/ report-u-s-criminalization-of-abortion-and-pregnancy-outcomes/ 31. Kidd, C., Goodman, S., & Gallagher Robbins, K. (2024, May). State abortion bans threaten nearly 7 million Black women, exacerbate the existing Black maternal mortality crisis. National Partnership for Women & Families. https://nationalpartnership. org/report/state-abortion-bans-threaten-black-women/ 32. Kunins, H. V., Bellin, E., Chazotte, C., Du, E., & Arnsten, J. H. (2007). The effect of race on provider decisions to test for illicit drug use in the peripartum setting. Journal of Women’s Health, 16(2), 245–255. https://doi.org/10.1089/jwh.2006.0070 33. Schoneich, S., Plegue, M., Waidley, V., McCabe, K., Wu, J., Chandanabhumma, P. P., Shetty, C., Frank, C. J., & Oshman, L. (2023). Incidence of newborn drug testing and variations by birthing parent race and ethnicity before and after recreational cannabis legalization. JAMA Network Open, 6(3), e232058. https://doi.org/10.1001/ jamanetworkopen.2023.2058

34. Holland, C. L., Rubio, D., Rodriguez, K. L., Krans, E. E., Arnold, R. M., Krishnamurti, T., & Chang, J. C. (2023). Racial inequities in drug tests ordered by clinicians for pregnant people who disclose prenatal substance use. Obstetrics & Gynecology, 142(5), 1111– 1118.

35. Petersen, E. E., Davis, N. L., Goodman, D., Cox, S., Syverson, C., Seed, K., ShapiroMendoza, C., Callaghan, W. M., & Barfield, W. (2019). Racial/ethnic disparities in pregnancy-related deaths—United States, 2007–2016. MMWR Morbidity and Mortality Weekly Report, 68(35), 762–765. https://www.cdc.gov/mmwr/volumes/68/ wr/mm6835a3.htm 36. Hoffman, K. M., Trawalter, S., Axt, J. R., & Oliver, M. N. (2016). Racial bias in pain assessment and treatment recommendations, and false beliefs about biological differences between Blacks and whites. Proceedings of the National Academy of Sciences, 113(16), 4296–4301. https://doi.org/10.1073/pnas.1516047113 37. KFF. (2025). Racial disparities in maternal and infant health: Current status and key issues. Kaiser Family Foundation. https://www.kff.org/racial-equity-and-health-policy/ racial-disparities-in-maternal-and-infant-health-current-status-and-key-issues/ 38. Bernstein, S. (2023, July 13). Data minimization: Bolstering the FTC’s health data privacy authority. Electronic Privacy Information Center. https://epic.org/data-minimizationbolstering-the-ftcs-health-data-privacy-authority/ 39. 16 C.F.R. Part 318—Health Breach Notification Rule. Electronic Code of Federal Regulations. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318

22

May 2026 Center for Policy Analysis and Research Acknowledgements: Technology and AI Fellowship sponsored through partnership with American Institutes for Research Opportunity Fund