> This is one of the most egregious abuses of privacy imagineable.

For people who haven't used these kinds of apps, Flo includes day-by-day tracking of:

  - sex and sex drive
    - didn't have sex
    - protected sex
    - unprotected sex
    - high sex drive
    - masturbation
  - mood: 
    - calm
    - happy
    - [...]
    - sad
    - depressed
    - obsessive thoughts 
    - apathetic
    - very self-critical
  - symptoms (cramps, tender breasts, acne, many more)
  - vaginal discharge (none, spotting, sticky, eggwhite, etc, "unusual")
  - other (travel, stress, disease/injury, alcohol)

There's a ridiculous amount of potential here for just purely creepy oversharing of information that a woman might presume is safe to enter into an app.

There's also a lot of things here that are maybe legally dangerous to be disclosing outside of a doctor-patient context (the last several "mood" items).

This is abhorrent.

It's worth pointing out that traditional data brokers are able to track menstrual cycles based on purchase activity. Nobody can opt out of this and it's been going on for a few decades. It can be used for ad targeting by presenting the target with the optimal content for each week.

Yes, there was this study about clothing purchase correlation:

https://thechart.blogs.cnn.com/2010/08/05/women-buy-sexier-c...

How does this work? Is it that women change their general purchase habits around that time, or that they buy specific products?

You run a 28 day autocorrelation and see what pops out. Start with the obvious purchases then artificially synchronize the purchase history of a group of women to be on the same phase and run another autocorrelation on their aggregate purchases to get the non-obvious signal.

I would imagine women who are buying menstrual products are very likely either about to begin their period or are in the midst of it. Also, things like midol are probably strong indicators.

Hmm, I'm not sure–all the women I know buy massive packs from Costco because it's something that they might as well buy in bulk and save money on. I didn't think of medicine, though–you're probably right about that.

Painkillers and chocolate purchases should be slightly correlated.

I did not hear about that one. It does sound interesting. Is there some sort of of study discussing it you could link?

For me the canonical example is this story in Forbes about a man who complained to Target about baby-product advertising directed at his teenage daughter.

https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...

To spoil an important point of the article: They had a personalized Target account and the daughter had been openly buying pregnancy related products for weeks, her father was the only one not aware of it.

Why is that worth pointing out?

It shows how this could be done for cycle analytics as well...If I remember the target case correctly it was not the buying of a pregnancy test, but general products like more body lotion etc. Things that correlate to the symptoms of the hormons present.

This is freaky, with this data and a rough identity (ads wise) you could literally AB test what ads / suggestive content affects someone's mood and relationship. How bone headed do you have to be to actually ask "what could someone do with this info, seems innocuous to me"?

Perhaps they didn’t think it was innocuous at all?

The FTC brings privacy cases under its 'unfair and deceptive acts or practices in commerce' prohibition, which does not provide it the legal basis to impose civil penalties. There are possibly other things it could have required (the recent Ever case requiring deletion is a good example), but it is currently constrained on what it can force for a first violation. The two Democratic FTC Commissioners issued a useful statement on what else they would have required: https://www.ftc.gov/system/files/documents/public_statements...

You can revive a dead comment if you feel it was unjustly killed. Just click the timestamp then click "vouch".

Thanks for this, I've heard of this option but assumed it was unavailable to my account.

It's available to everyone with a fairly reasonable amount of karma (30, I think?)

I don't see how it's worse than the ubiquitous data brokers built into our society like the private credit bureaus that charge you to access your own data which has a de facto green light from us and our government.

It would be inconsistent to punish this little app severely when we don't care about much more egregious violations. It's tragic that we're only able to care about small things that fit into our tiny laser beam of public outrage.

I do get with the frustration, but with the current state of US (federal) laws it is probably the best remedy available now (unlike GDPR where you can really go and score larger fines and even jail time if it is grossly negligent or intentional).

management could be jailed for fraud.

it is the usual thing where the powerful we say “best we could do” but for the weak we find a way to get them in jail if we don’t like them

i get the frustration.

no you dont