The FTC recently settled with Flo Health, Inc., a popular
fertility-tracking app, based on promises made about how health
data would be shared. In its complaint, the FTC alleged that while Flo
promised to keep users' health data private and only use it
to provide the app's services to users, in fact, health
information of over 100 million users was being shared with popular
third party companies. Namely, third parties who provided marketing
and analytics services to the app.
Like many app developers, Flo tracked both standard app events
such as launching or closing the app, as well as
“custom” app events. Custom app events record
user-interactions unique to those using the Flo app. For example,
if a user enters a menstruation date, that interaction is logged as
a custom app event. Flo used those custom app event to improve app
functionality and identify features that might be of interest to
the user. Flo also gave each custom app event a descriptive title,
such as
