A woman opens her period-tracking app and logs the first day of her last cycle. She taps an answer to a question about whether she is trying to get pregnant. It feels like writing in a diary.
In August 2025, a federal jury in California decided that, for users of the app Flo, it was closer to speaking into a wiretap. The jury found that Meta had violated the California Invasion of Privacy Act by collecting that kind of reproductive health information through software built into the app, including in-app events with names such as “R_SELECT_LAST_PERIOD_DATE.” Meta said it disagreed with the verdict and was weighing its options.
Most users assume their health data is protected like their medical records. Most of it isn’t. But the bigger surprise is where the leak usually happens. It is rarely a hacker. It is a line of advertising code the app developer put there on purpose.
The law people think applies, and the one that does
HIPAA, the US health privacy law, covers hospitals, doctors, insurers and their contractors. It does not cover a consumer app just because the app handles health information. A symptom checker, a fertility tracker or a meditation app that you download yourself generally sits outside it.
The US Federal Trade Commission has been trying to fill that gap with laws that were not written for it. In February 2023 it brought its first-ever enforcement action under the Health Breach Notification Rule against GoodRx, alleging that the prescription discount company shared users’ health information with Facebook, Google and other advertising platforms without authorisation. GoodRx agreed to a $1.5 million civil penalty.
A month later, the FTC announced a settlement with the online therapy company BetterHelp. The agency alleged it had passed email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising, despite promising to keep such data private. BetterHelp agreed to pay $7.8 million, used for consumer refunds, and was banned from sharing health data for advertising.
In 2024 the FTC updated the breach notification rule to make explicit that health apps and connected devices are covered, and that an unauthorised disclosure, not just a hack, can count as a breach.
A “breach” that looks like marketing
That last point is the one users most need to understand. In the GoodRx, BetterHelp and Flo cases, nobody broke in. The companies installed standard software development kits and tracking pixels from ad platforms, the same tools every consumer app uses to measure whether its marketing works.
For a shoe retailer, telling Facebook that someone viewed a product page is routine. For a therapy platform, telling Facebook that someone filled out a mental health intake form is something else entirely. The code is identical. The meaning is not.
This is the uncomfortable incentive underneath consumer digital health. Most of these apps are free or cheap, and they compete for users through paid acquisition on the very platforms that want the data. The growth team’s standard toolkit and the privacy promise on the sign-up screen are in direct tension. In the cases above, the promise lost.
Why privacy policies don’t fix it
The conventional response is “read the privacy policy” or “give users more control.” Both put the burden on the wrong person.
A user cannot see which SDKs are embedded in an app. They cannot see what events are sent when they tap a button. Even a careful reader of a privacy policy will learn that data may be shared with “partners” for “analytics and advertising,” which describes almost every app ever made.
Consent screens don’t solve it either. The Flo case turned partly on whether users could reasonably expect that their menstrual information was being shared. The jury concluded they could not, and that there was no consent. A checkbox does little when nobody understands what it covers.
What would actually protect users
The most effective protections are not on the user’s side of the screen:
- Treat health events as radioactive in ad tooling. Developers should not send any in-app event from a health workflow to an advertising platform, full stop. Measure marketing on the sign-up page, not inside the symptom tracker.
- Hold clinicians and health systems to a higher bar when they recommend apps. When a doctor tells a patient to download something, the patient hears an endorsement. Health systems should ask vendors directly which third-party SDKs run inside the app.
- Make the platforms share the liability. The Flo verdict is significant because it was against the company receiving the data, not only the app that sent it. If receiving sensitive health signals carries legal risk, ad platforms have a reason to filter them out.
- Stop calling it a breach only when it’s a hack. The FTC’s updated rule points the right way. The public should, too.
How one tap becomes an ad signal
It is worth walking through the mechanism, because most clinicians and many developers have never seen it laid out.
A small company builds a symptom-tracking app for people with a chronic condition. To grow, it buys ads on a large social platform. To know whether those ads work, the platform gives it a software development kit, a few lines of code that report “events” back to the platform: app installed, account created, subscription purchased.
The marketing team wants to optimise further. It asks the developers to add more events, so that the platform’s algorithms can find people who look like the app’s most engaged users. A developer adds an event each time a user completes a symptom log, and names it after the screen it fires on.
At no point does anyone decide to “sell health data.” Each step is a normal marketing practice. But the result is that the ad platform now receives a stream of signals tied to device identifiers, telling it that specific people are actively managing a specific condition. That is exactly the kind of information the Flo jury found users did not expect to be shared, and the kind the FTC alleged GoodRx and BetterHelp disclosed.
The key point is that this happens by default, through ordinary tools, often without a single person in the company thinking about privacy. That is why privacy policies and consent screens are such weak protections. They describe a system nobody designed on purpose.
The strongest counterargument
The case for the current model is worth taking seriously.
Free and cheap health apps exist because advertising and marketing analytics make them economically viable. A meditation app or a period tracker that had to charge every user a meaningful fee would reach far fewer people, and those it lost would be disproportionately poorer users. Measurement tools help small companies compete with large ones by showing which marketing works. And the data sent is often hashed, aggregated or limited to identifiers rather than clinical detail.
Some of this holds. Cheap digital tools do broaden access, and not all event data is equally sensitive. A signal that someone opened an app is different from a signal that they logged a miscarriage.
But the argument has a limit. It assumes that users understand the trade and accept it. The Flo verdict, and the GoodRx and BetterHelp cases, suggest many do not. BetterHelp’s users were told their health information would be used only for limited purposes; the FTC alleged otherwise. When the promise and the practice diverge, the “free service in exchange for data” bargain was never actually struck.
There is also a question of who carries the risk. The economic benefit goes to the app and the ad platform. The exposure, whether social, employment-related or legal, falls on the user. In a period when reproductive health information can carry legal consequences in some jurisdictions, that asymmetry is not abstract.
Second-order effects
Clinical trust may take collateral damage. When patients learn that a health app shared their data, they rarely distinguish between the app, the clinic that recommended it, and the health system in general. Privacy failures in consumer apps can erode willingness to share information with clinicians, which harms care.
Research data may be skewed. People who distrust apps may avoid digital tools or enter less accurate information. If digital health data is increasingly used for research and service planning, the people who opt out, often those with the most to fear, will be under-represented.
Litigation may move faster than regulation. The Flo verdict relied on a decades-old California wiretapping statute that carries a penalty of $5,000 per violation. Applied to large user bases, that kind of exposure could reshape company behaviour faster than any new federal privacy law. It could also produce inconsistent, state-by-state rules that are hard for smaller developers to navigate.
Ad platforms may start filtering. If receiving sensitive health signals becomes a legal liability, the platforms themselves have strong incentives to detect and discard them. That would do more to protect users at scale than any number of privacy notices.
A test clinicians can run
Health professionals often recommend apps to patients, and few check what those apps do with data. A simple set of questions would change that:
- Does the app’s privacy policy say it shares data with advertising or social media platforms, even in “de-identified” form?
- Does the developer say which third-party SDKs are embedded, and will they put that in writing?
- Is the app covered by HIPAA or an equivalent national health privacy law, or is it a consumer product?
- Can the patient use the core features without creating an account linked to their email or phone number?
If a vendor can’t or won’t answer, that is itself an answer.
What this means for decision-makers
For health systems and payers that license or recommend apps, it means building a technical privacy review into procurement. Checking the privacy policy is not enough; someone needs to look at the network traffic an app actually generates.
For regulators, it means continuing the shift the FTC made in 2024, treating unauthorised disclosure as a breach, and closing the gap between HIPAA-covered entities and everyone else who handles health information. Outside the United States, it means enforcing existing rules on sensitive data, which in many places are stronger on paper than in practice.
For developers, it means separating health workflows from marketing infrastructure by design, and treating any event fired inside a health feature as sensitive by default.
For clinicians, it means recognising that a recommendation carries your credibility, and asking the questions above before giving one.
What to watch next
Watch the appeals in the Flo case and whether similar wiretapping claims succeed against other platforms. Watch whether the FTC continues to bring Health Breach Notification Rule cases under its updated rule. And watch whether any major ad platform announces that it will automatically block health-related events. That single change would protect more users than a decade of consent screens.
The takeaway
The privacy risk in health apps is not mainly that hackers will steal your data. It is that the business model quietly depends on sharing signals about you with the companies that sell ads, and that the law has only recently started to treat that as a harm.
Users can’t fix that by reading harder. The fix has to come from developers who wall off health data from marketing tools, from the platforms that receive it, and from the clinicians who recommend these apps as if they were medical devices.
Would you recommend a health app to a patient without knowing what’s embedded inside it? Tell us how your organisation checks.
