The honest answer on Flo's data practices, its FTC settlement, and what it means for your privacy.
Flo is the world's most downloaded period tracker. It's used by over 420 million people. So when questions about its data privacy practices emerge, they affect a lot of women. Here's exactly what happened and what you need to know.
In January 2021, the US Federal Trade Commission (FTC) reached a settlement with Flo Health after finding that the company had shared users' sensitive health data with third parties — including Facebook and Google — without informing users or obtaining their consent.
The data shared included period dates, pregnancy status, fertility intentions, and symptoms. This information was sent to Facebook's Analytics for Apps service and Google's Firebase Analytics, even though Flo's own privacy policy stated that such data would only be used to operate and improve the app.
The FTC required Flo to:
Flo did not pay a fine — the settlement was an agreement to change practices rather than a financial penalty.
Flo has made meaningful changes to its privacy practices following the FTC settlement:
These are genuine improvements. But trust, once broken, takes time to rebuild. And many users have switched to alternatives as a result.
Even with improvements, Flo still collects substantial personal health data:
In the free tier, some of this data is still used for ad targeting. The Premium tier reduces (but doesn't eliminate) ad-based data use.
No — and this is important to understand. HIPAA (the US health privacy law) only covers "covered entities" — healthcare providers, health insurers, and their business associates. Consumer apps like Flo are not HIPAA covered entities, which means they're not legally required to protect your health data the way a doctor's office is.
This is true of all consumer health apps, not just Flo. But it means the legal protection you might assume exists for your health data simply doesn't apply to period tracker apps.
WomensPal was built with privacy as a core requirement, not an afterthought. Unlike Flo, WomensPal's business model doesn't depend on monetising your health data.
WomensPal's data is encrypted at row level and never sold to advertisers, data brokers, or third parties. Your period dates, pregnancy status, and symptoms stay private.
WomensPal is 100% free — no subscription, no ads, no premium paywall. It doesn't need to sell your data because it has a different business model.
Full cycle tracking, ovulation prediction, pregnancy mode, symptom logging, phase-based insights — everything Flo offers, without the privacy tradeoffs.
No FTC settlements. No data selling. No paywall. Just private, accurate period tracking — free.
Start free — no subscription →Flo has improved its privacy practices since the 2021 FTC settlement, but its history of sharing health data with Facebook and Google raises legitimate concerns. If privacy matters to you, consider a privacy-first alternative like WomensPal.
The FTC found that Flo shared sensitive health data — including period dates, pregnancy status, and fertility information — with Facebook, Google, and Fabric without user consent. Flo settled and has since updated its practices.
WomensPal is privacy-first — your data is encrypted, never sold, and never shared with advertisers. It has all of Flo's features plus more, completely free.
No. HIPAA only covers healthcare providers, insurers, and business associates — not consumer health apps. This applies to all period trackers, not just Flo.