Georgetown Law
Technology Review

Period-tracking applications occupy a large share of the FemTech industry, offering users intimate insights into their reproductive health while simultaneously exposing them to unprecedented privacy risks. Period-tracking apps regularly disseminate highly sensitive health data under the protection of the notice and consent paradigm of privacy law, an outdated framework that places the burden of privacy protection on individual users who lack the time, information, and bargaining power to meaningfully control their data. This Note demonstrates how the notice and consent paradigm of privacy law fails to protect women while simultaneously reinforcing harmful gender stereotypes. Using Frasco v. Flo Health, Inc. as a case study, the Note illustrates the inadequacy of existing federal and state enforcement mechanisms to address the exploitation of sensitive health data. It proposes a revitalization of the Federal Trade Commission’s consumer protection authority to enact substantive rules governing health-related data practices, modeled on the regulatory framework established under COPPA, the Children’s Online Privacy Protection Act. Such reforms would shift the data management responsibility from individual users to the companies that seek to profit from their data.