FemTech apps and devices exploit regulatory gaps, study finds

FemTech, the fast-growing industry of apps, wearables and connected devices aimed at women’s health and wellbeing, is on course to become a 75-billion-dollar sector by 2025. Yet a new study argues that the technologies collecting some of the most intimate data a person can share are operating in a regulatory vacuum, and that many products are already exploiting the resulting gaps. Researchers from Royal Holloway, University of London, ETH Zurich and Newcastle University reviewed the laws governing FemTech in the United Kingdom, the European Union and Switzerland, and then put a basket of commercial products to the test. Their findings, published in Frontiers in the Internet of Things, reveal a sector that collects vast quantities of sensitive information, tracks users without valid consent, and slips between legal categories designed for a pre-digital era.

The team, led by Maryam Mehrnezhad of Royal Holloway together with Thyla Van Der Merwe and Michael Catt, set out to answer three questions: what gaps exist in applicable laws when it comes to female-related data; how do FemTech systems misuse those gaps, whether intentionally or not; and how do these systems violate the regulations that do apply. They chose the United Kingdom and Switzerland as study sites because neither is an EU member, yet both have substantial business operating within the European Economic Area, making them subject to EU rules such as the General Data Protection Regulation while also governed by their own domestic frameworks.

The regulatory review covered four main instruments: the GDPR, the Swiss Federal Act on Data Protection, the United Kingdom’s Medical Devices Regulations 2002 overseen by the Medicines and Healthcare products Regulatory Agency, and the EU’s Regulation 2017/745 for medical devices. The researchers manually searched each law’s public documents for FemTech-related keywords including period, fertility, pregnancy, abortion, menopause, ovulation, lactation and hormone. The result was striking: none of the regulations mentions FemTech data directly. The GDPR does protect special category data such as health, sex life and sexual orientation, and the Swiss law protects data touching the intimate sphere, but the researchers found no specific data protection rules for FemTech data collected and processed outside clinics and medical settings.

The medical device regulations fared no better. The UK’s Medical Devices Regulations 2002 is more than two decades old and contains nothing on the security and privacy aspects of modern connected products, let alone FemTech-related data. The EU’s 2017/745 regulation does classify devices for the control or support of conception as medical devices, but its risk management provisions address safety only, with no mention of security or privacy risks. The researchers note that the MHRA is developing a new Software and AI as a Medical Device Change Programme, including a work package on cyber-secure medical devices, and argue that such efforts are needed immediately.

To see how companies behave within this patchwork, the team purchased ten off-the-shelf products spanning the sector’s categories, from the Elvie smart breast pump and Daysy cycle computer to the Perifit kegel trainer, the Frida by Vibio sex toy, the Livia menstrual pain reliever, the Balance menopause app and the Bellabeat Ivy health tracker. Between September 2022 and April 2023, two authors independently set up each device and its Android app on Google Pixel 6 phones, logged what data was requested or automatically gathered, and repeated any inconsistent experiments jointly. They then audited the products’ websites and apps for privacy notices, consent mechanisms and trackers.

The data inventory was extensive. User data included names and contact details, lifestyle information such as weight, diet and sleep, cycle length and ovulation days, pregnancy test results and due dates, nursing times and volumes, details of reproductive organs such as cervical mucus and muscle strength, sexual activities including contraceptive use, medical information such as medication types and lab report scans, and physical and emotional symptoms. More surprisingly, many systems also collected data about other people: nursing and sleep data about babies, social media profiles, and details of partners including names, ages, photos and partnered sexual activity. Several apps also demanded access to dangerous phone permissions, including the camera, microphone, storage, contacts, location and WiFi and Bluetooth radios.

On consent, the picture was damning. Under the GDPR and the ePrivacy Directive, consent to tracking must involve an unambiguous positive action, be separated from other matters, and offer genuine choices to accept or reject without nudging. The researchers found that all but one of the apps and websites studied appeared to violate these requirements. Most presented users with a privacy wall, forcing agreement to terms and a privacy policy before the service could be used, or highlighted the accept option while burying the alternative. The sole exception was the Balance Menopause App, which presented valid consent in its app, though its website did not. Privacy policies offered little reassurance: only four even referenced FemTech-related data, and those that did often contradicted themselves, such as one fertility app claiming to require explicit consent for health data while treating the mere submission of that data as the consent itself.

Tracking was pervasive. Using the Exodus Privacy audit platform, which statically analyses Android app code for tracker signatures, the researchers found between one and nine trackers embedded in each app. Using the privacy-focused Brave browser, they found that most product websites activated trackers before any user engagement with the cookie notice. One website, hidratespark.com, spawned more than seventy trackers while left open without interaction, and even attempted to access motion sensors when visited from a mobile device. By contrast, the Daysy cycle computer and Lady Comp fertility tracker each contained just one tracker, Google Tag Manager, showing that minimal tracking is technically feasible in this sector.

The researchers argue that these practices translate into differential harms for real people. Intimate data can be weaponised by ex-partners and family members through tech abuse and cyberstalking, particularly where devices offer shared remote modes. Employers and insurers represent further threat actors: FemTech data has reportedly been shared with third parties including employers, and insurance firms with access to family health histories could discriminate on the basis of inferred pre-existing conditions. Governments and political and religious organisations have also been identified as interested in such data, a concern sharpened by the overturning of Roe v. Wade in the United States and reports of data marketplaces selling information about period app users. Data breaches in this domain are especially serious because the data mixes health, biometric, genetic, sexual and even religious and political information, and marginalised groups have more to lose from disclosure.

The study also exposes how companies game the boundaries between legal categories. Apps that handle medical records can register on the Google Play Store under Health and Fitness, Entertainment or Tools categories rather than Medical, avoiding scrutiny; of the ten apps studied, only one was listed as medical. Companies often deliberately frame products as wellness or wellbeing offerings to escape medical device regulation, meaning cycle tracking apps reach the market largely unvetted even as the ovulation and pregnancy tests they accompany are regulated. The authors conclude that neither general data protection law nor medical device regulation, alone or combined, adequately protects users, and they call for domain-specific, sectorial regulation that explicitly acknowledges FemTech risks, alongside certification systems, compliance testing and penalties, with particular attention to marginalised user groups. Some movement is under way, including the UK regulator’s recent auditing project on FemTech apps and the EU’s proposed European Health Data Space, but the researchers warn that without explicit recognition of these technologies’ risks, users will continue to trade their most personal data for services that could be built to collect far less.

Subject of Research: Security, privacy and regulatory gaps in female-oriented health technologies (FemTech)

Article Title: Mind the FemTech gap: regulation failings and exploitative systems

Article References: Mehrnezhad, M., Van Der Merwe, T., & Catt, M. (2024). Mind the FemTech gap: regulation failings and exploitative systems. Frontiers in the Internet of Things, 3, Article 1296599. https://doi.org/10.3389/friot.2024.1296599

Image Credits: AI Generated

DOI: 10.3389/friot.2024.1296599

Keywords: FemTech, privacy, data protection, GDPR, medical devices, health apps, IoT security, tracking, consent, women's health, regulation, digital health