Whether they track sleep, count steps, or track periods, there are free apps today that promise to improve every aspect of your life.
But, as the saying goes, “there is no such thing as a free lunch.”
That’s what the experts say anyway, who say the developers could be bringing you into the product.
Privacy experts warn that health tracking apps, especially those that are downloaded for free, may use your personal health data for advertising or other commercial purposes.
Such data may include how often people have sex, whether women are pregnant, and how often their periods typically last.
While your fitness tracking app may not directly sell your step count or exercise routine, it could use the data to determine your daily routines.
As long as you agree to their terms and conditions, app companies can collect data about your location, habits, activities, and other sensitive information and sell it to third parties, warns privacy specialist Beth Barker-Paton.
She is the current associate partner at research and design consultancy Etic Lab and former director of online privacy company Kuva, which offers secure and transparent online work platforms that promise not to collect or store personal data.
“Personal information, such as the number of steps you take or how long you sleep, can be used for advertising purposes,” says Ms Barker-Paton.
Companies cannot directly sell health data, such as step counts or exercise routes, as agreed in some companies’ terms and conditions.
But that data can be used to infer a lot about your location, habits, and even hobbies.
This valuable information can then be sold to target you with ads for products and services based on that data, says Barker-Paton.
“This information is sold to third parties for targeted advertising,” he told MailOnline.
Andrew Whaley, senior technical director at technology security firm Promon, adds that even if the data is anonymized, as many companies pledge to do, companies can still infer where you spend your time and build advertising portfolios around that information.
“If you looked at someone’s running routes, for example, they might be very close to where they live or where they work, so you could probably pinpoint that,” he said.
You may find swimming logs that may reference a gym membership.
“So even though those records are anonymous, if you knew enough about an individual, you could identify their records.”
While all this data collection is concerning, experts are particularly concerned about the rise of period trackers.
Researchers at Chupadados, a Brazil-based cybersecurity guide, analyzed the terms and conditions of more than 200 menstrual tracking apps in 2018.
They found that many of the apps made money by sharing users’ personal information with companies to target users with specific ads.
And in 2022, an analysis of the 25 most popular menstrual cycle tracking apps in the UK by the Organization for Health and Care App Review, a company that assesses the safety of health apps for the NHS, found up to four out of five applications. share users’ personal data with third parties.
More recently, last September, the Information Commissioner’s Office launched a review of period and fertility tracking apps, after an increasing number of women reported concerns about data security.
This followed a survey, commissioned by the regulator, which revealed that women were more concerned about how their data was used (59 per cent) and how secure it was (57 per cent) than the cost or ease of use of a application.
The survey also found that more than half of women who used the apps experienced an increase in fertility or baby-related ads after signing up.
There have also been fears in the US about data recorded by period tracking apps being used to expose women having abortions following the overturning of Roe v Wade.
The data shared from menstrual tracking apps is one of the most worrying, according to experts, due to the sensitive information that companies can collect.
Some experts have urged women to delete the apps from their phones or use encrypted versions out of fear that authorities in states that have now criminalized abortions could access the data.
Barker-Paton warned users of period apps everywhere, especially the free versions, that they could be revealing very personal and valuable data.
“Remember that most, if not all, menstrual apps have a free version,” she says.
‘And even if they charge, the only way companies can afford to offer this at scale… is because their business model is primarily based on selling their data.
“If you don’t pay for privacy, you pay with it.”
Data that users could reveal include how often they have sex, whether they get pregnant, and how long their periods typically last.
This, combined with other data, such as your location, can be used to “tailor ads more effectively,” says Barker-Paton.
He warned that this was an example of the “surveillance economy” where data, including data on people’s health, is a commodity that can be bought and sold.
“It is essential that users, especially women, understand that by using these types of applications, they could be inadvertently sharing sensitive health information that could be used for commercial purposes,” she says.
“Before using such services, it is advisable to remove personal data from applications and understand the privacy implications.”
There is growing interest in AI: “many millions are paid for data sets” used to train AI models, warns Whaley.
But now not only advertising should be a cause of concern for users.
Companies also have a growing interest in AI, as the data sets used to train such computer programs are worth millions, Whaley warns.
In theory, this data could come from health apps.
«There is a huge interest in AI and training models and this data will be very useful for that. “It could be used en masse without exposing an individual’s data,” he says.
Whaley says that while it’s still emerging, if the practice takes hold, it could affect everyone.
For example, he explained that if fitness apps sell this data for insurance purposes, the AI would be trained with data from very physically active people.
This could mean that they end up inadvertently discriminating against less active people because their data is simply not representative, he adds.
But protecting yourself by first reading an app’s terms and conditions can be tricky.
Whaley says the wording many companies use is “deliberately vague” as they want to leave the door open to monetizing user data at some point.
“If privacy is a major concern, people should think critically about the need for each app and the permissions it requests,” Barker-Paton says.