Period-tracking apps are sharing people’s intimate data with Facebook

Some period-tracking apps are sending Facebook personal information about the women who use them.

In order to work, the apps require women to enter information about their menstrual cycle as well as information about their sexual activity. According to a report released Monday by the United Kingdom-based advocacy group Privacy International, a number of those apps then share that information with Facebook, Buzzfeed reports.

Specifically, the group said the apps MIA Fem and Maya sent information about women’s use of contraception, when their monthly periods were, and whether or not they experienced symptoms like cramps and swelling to the social network. 

For some perspective, the app Maya currently has over 5 million downloads. The makers of MIA say that it has more than 2 million users around the world. We’ve reached out to the developers of both apps for comment and additional details on how they use user data, but have yet to receive a response. Maya’s owner, Plackal Tech, told Buzzfeed that it doesn’t share any personally identifiable data or medical data with Facebook. 

Data is being shared with Facebook through the social network’s Software Developer Kit (SDK). The SDK allows developers to collect user data so Facebook can show users targeted ads. Beyond being used for advertising, the data can also be collected by Facebook and used outside of the social network.

Facebook has reportedly reached out to the developers of both apps to discuss how they are potentially violating the company’s terms of service. Facebook requires app developers to disclosed to users what information — if any — is being shared with Facebook. In the case of the two apps, it seems like that is not happening. The fault in this particular situation appears to be with the app developers, not the social network.

Privacy, in general, has been a growing concern as it pertains to Facebook, specifically following the Cambridge Analytica scandal. The Federal Trade Commission fined Facebook $5 billion over its use of private data in the wake of the scandal.

During court proceedings for a class-action lawsuit focused on Cambridge Analytica, the company’s lawyer, Orin Snyder, said that there is “no expectation of privacy” on Facebook.

“There is no invasion of privacy at all, because there is no privacy,” Snyder said while trying to convince U.S. District Court Judge Vince Chhabria toss out the lawsuit. Snyder argued that users had given consent to share their data with third parties. “You have to closely guard something to have a reasonable expectation of privacy,” he said.

Facebook CEO Mark Zuckerberg has made a number of statements over the past year stressing the company’s desire to make a privacy-focused social platform.