Apps designed for feminine well being monitoring are exposing customers to pointless privateness and security dangers via their poor knowledge dealing with practices, in keeping with new analysis from UCL and King’s School London.
The examine, offered on the ACM Convention on Human Components in Computing Programs (CHI) 2024 on 14 Could, is essentially the most intensive analysis of the privateness practices of feminine well being apps to this point. The authors discovered that these apps, which deal with medical and fertility knowledge reminiscent of menstrual cycle info, are coercing customers into coming into delicate info that might put them in danger.
The crew analyzed the privateness insurance policies and knowledge security labels of 20 of the preferred feminine well being apps accessible within the UK and USA Google Play shops, that are utilized by a whole lot of thousands and thousands of individuals. The evaluation revealed that in lots of situations, person knowledge may very well be topic to entry from regulation enforcement or safety authorities.
Just one app that the researchers reviewed explicitly addressed the sensitivity of menstrual knowledge with regard to regulation enforcement of their privateness insurance policies and made efforts to safeguard customers towards authorized threats.
In distinction, most of the pregnancy-tracking apps had a requirement for customers to point whether or not they have beforehand miscarried or had an abortion, and a few apps lacked knowledge deletion capabilities, or made it troublesome to take away knowledge as soon as entered.
Consultants warn this mixture of poor knowledge administration practices may pose critical bodily security dangers for customers in nations the place abortion is a prison offence.
Feminine well being apps accumulate delicate knowledge about customers’ menstrual cycle, intercourse lives, and being pregnant standing, in addition to personally identifiable info reminiscent of names and e mail addresses.
Requiring customers to reveal delicate or probably criminalizing info as a pre-condition to deleting knowledge is a particularly poor privateness observe with dire security implications. It removes any type of significant consent provided to customers.
The implications of leaking delicate knowledge like this might lead to office monitoring and discrimination, medical insurance discrimination, intimate companion violence, and prison blackmail; all of that are dangers that intersect with gendered types of oppression, significantly in nations just like the USA the place abortion is against the law in 14 states.”
Dr Ruba Abu-Salma, lead investigator of the examine from King’s School London
The analysis revealed stark contradictions between privateness coverage wording and in-app options, in addition to flawed person consent mechanisms, and covert gathering of delicate knowledge with rife third-party sharing.
Key findings included:
- 35% of the apps claimed to not share private knowledge with third events of their knowledge security sections however contradicted this assertion of their privateness insurance policies by describing some stage of third-party sharing.
- 50% supplied express assurance that customers’ well being knowledge wouldn’t be shared with advertisers however had been ambiguous about whether or not this additionally included knowledge collected via utilizing the app.
- 45% of privateness insurance policies outlined a scarcity of duty for the practices of any third events, regardless of additionally claiming to vet them.
Most of the apps within the examine had been additionally discovered to hyperlink customers’ sexual and reproductive knowledge to their Google searches or web site visits, which researchers warn may pose a threat of de-anonymisation for the person and will additionally result in assumptions about their fertility standing.
Lisa Malki, first creator of the paper and former analysis assistant at King’s School London, who’s now a PhD scholar at UCL Laptop Science, mentioned: “There’s a tendency by app builders to deal with interval and fertility knowledge as ‘one other piece of information’ versus uniquely delicate knowledge which has the potential to stigmatise or criminalise customers. More and more dangerous political climates warrant a higher diploma of stewardship over the security of customers, and innovation round how we’d overcome the dominant mannequin of ‘discover and consent’ which at present locations a disproportionate privateness burden on customers.
“It is important that builders begin to acknowledge distinctive privateness and security dangers to customers and undertake practices which promote a humanistic and safety-conscious strategy to growing well being applied sciences.”
To assist builders enhance privateness insurance policies and practices of feminine well being apps, the researchers have developed a useful resource that may be tailored and used to manually and mechanically consider feminine well being app privateness insurance policies in future work.
The crew are additionally calling for crucial discussions on how these kinds of apps – together with different wider classes of well being apps reminiscent of health and psychological well being apps – take care of delicate knowledge.
Dr Mark Warner, an creator of the paper from UCL Laptop Science, mentioned: “It is essential to recollect how vital these apps are in serving to ladies handle totally different points of their well being, and so asking them to delete these apps just isn’t a accountable answer. The duty is on app builders to make sure they’re designing these apps in a method that considers and respects the distinctive sensitivities of each the information being immediately collected from customers, and the information being generated via inferences comprised of the information.”
Supply:
Journal reference:
Malki, L. M., et al. (2024). Exploring Privateness Practices of Feminine mHealth Apps in a Put up-Roe World. CHI ’24: Proceedings of the CHI Convention on Human Components in Computing Programs. doi.org/10.1145/3613904.3642521.
Apps designed for feminine well being monitoring are exposing customers to pointless privateness and security dangers via their poor knowledge dealing with practices, in keeping with new analysis from UCL and King’s School London.
The examine, offered on the ACM Convention on Human Components in Computing Programs (CHI) 2024 on 14 Could, is essentially the most intensive analysis of the privateness practices of feminine well being apps to this point. The authors discovered that these apps, which deal with medical and fertility knowledge reminiscent of menstrual cycle info, are coercing customers into coming into delicate info that might put them in danger.
The crew analyzed the privateness insurance policies and knowledge security labels of 20 of the preferred feminine well being apps accessible within the UK and USA Google Play shops, that are utilized by a whole lot of thousands and thousands of individuals. The evaluation revealed that in lots of situations, person knowledge may very well be topic to entry from regulation enforcement or safety authorities.
Just one app that the researchers reviewed explicitly addressed the sensitivity of menstrual knowledge with regard to regulation enforcement of their privateness insurance policies and made efforts to safeguard customers towards authorized threats.
In distinction, most of the pregnancy-tracking apps had a requirement for customers to point whether or not they have beforehand miscarried or had an abortion, and a few apps lacked knowledge deletion capabilities, or made it troublesome to take away knowledge as soon as entered.
Consultants warn this mixture of poor knowledge administration practices may pose critical bodily security dangers for customers in nations the place abortion is a prison offence.
Feminine well being apps accumulate delicate knowledge about customers’ menstrual cycle, intercourse lives, and being pregnant standing, in addition to personally identifiable info reminiscent of names and e mail addresses.
Requiring customers to reveal delicate or probably criminalizing info as a pre-condition to deleting knowledge is a particularly poor privateness observe with dire security implications. It removes any type of significant consent provided to customers.
The implications of leaking delicate knowledge like this might lead to office monitoring and discrimination, medical insurance discrimination, intimate companion violence, and prison blackmail; all of that are dangers that intersect with gendered types of oppression, significantly in nations just like the USA the place abortion is against the law in 14 states.”
Dr Ruba Abu-Salma, lead investigator of the examine from King’s School London
The analysis revealed stark contradictions between privateness coverage wording and in-app options, in addition to flawed person consent mechanisms, and covert gathering of delicate knowledge with rife third-party sharing.
Key findings included:
- 35% of the apps claimed to not share private knowledge with third events of their knowledge security sections however contradicted this assertion of their privateness insurance policies by describing some stage of third-party sharing.
- 50% supplied express assurance that customers’ well being knowledge wouldn’t be shared with advertisers however had been ambiguous about whether or not this additionally included knowledge collected via utilizing the app.
- 45% of privateness insurance policies outlined a scarcity of duty for the practices of any third events, regardless of additionally claiming to vet them.
Most of the apps within the examine had been additionally discovered to hyperlink customers’ sexual and reproductive knowledge to their Google searches or web site visits, which researchers warn may pose a threat of de-anonymisation for the person and will additionally result in assumptions about their fertility standing.
Lisa Malki, first creator of the paper and former analysis assistant at King’s School London, who’s now a PhD scholar at UCL Laptop Science, mentioned: “There’s a tendency by app builders to deal with interval and fertility knowledge as ‘one other piece of information’ versus uniquely delicate knowledge which has the potential to stigmatise or criminalise customers. More and more dangerous political climates warrant a higher diploma of stewardship over the security of customers, and innovation round how we’d overcome the dominant mannequin of ‘discover and consent’ which at present locations a disproportionate privateness burden on customers.
“It is important that builders begin to acknowledge distinctive privateness and security dangers to customers and undertake practices which promote a humanistic and safety-conscious strategy to growing well being applied sciences.”
To assist builders enhance privateness insurance policies and practices of feminine well being apps, the researchers have developed a useful resource that may be tailored and used to manually and mechanically consider feminine well being app privateness insurance policies in future work.
The crew are additionally calling for crucial discussions on how these kinds of apps – together with different wider classes of well being apps reminiscent of health and psychological well being apps – take care of delicate knowledge.
Dr Mark Warner, an creator of the paper from UCL Laptop Science, mentioned: “It is essential to recollect how vital these apps are in serving to ladies handle totally different points of their well being, and so asking them to delete these apps just isn’t a accountable answer. The duty is on app builders to make sure they’re designing these apps in a method that considers and respects the distinctive sensitivities of each the information being immediately collected from customers, and the information being generated via inferences comprised of the information.”
Supply:
Journal reference:
Malki, L. M., et al. (2024). Exploring Privateness Practices of Feminine mHealth Apps in a Put up-Roe World. CHI ’24: Proceedings of the CHI Convention on Human Components in Computing Programs. doi.org/10.1145/3613904.3642521.
