Flo reaches settlement with FTC over misuse of period-tracking data
What's the story
Flo, a popular period tracking app with a user base of over 100 million, was allegedly sharing user data with Facebook and Google discreetly. This was also reported in 2019 by The Wall Street Journal. The app underwent a Federal Trade Commission (FTC) inquiry, where it was alleged that it shared sensitive data with third parties that provided them with marketing and analytics services.
Underhanded
Flo lied about data privacy, sold user information to Facebook
According to The Wall Street Journal, the app shared highly confidential user information, such as the exact dates of their periods and pregnancy plans with third parties. The users had not issued consent as the Terms of Service did not have provisions for such dealings. Facebook could potentially have matched sensitive health information to user profiles in a possible breach of privacy.
Open secrets
Targeted advertising: A data-driven industry, where ethics should be paramount
A 2019 study published in JAMA Network Open highlighted how most apps aimed at depressed people and smokers share user data with Facebook and Google, who are market leaders in targeted advertising. It is not surprising that the industry depends on data of users' activities to "improve" recommendations. Most services provide options to opt out, but their effectiveness is suspect.
Only on paper
Settlement with FTC still leaves users unsettled
As part of the FTC settlement, Flo has to notify users about how their data was misappropriated and seek their permission before it shares more personal information henceforth. The glaring issue with this settlement is that it still heavily relies on the app developers to honor their word, the lack of which is exactly why the complaint was filed in the first place.
Unrepentant
Flo denies wrongdoing; claims it doesn't share information without permission
Flo refused to admit any wrongdoing and the charges amounting to breach of privacy leveled by the FTC. The company issued a boilerplate statement claiming that it has the utmost regard for the privacy of user data, and does not share information without the user's consent. The settlement mandates an independent audit of Flo's privacy practices, as it never limited third party access to user data.