Which US states protect period tracker data?

Twenty-three states and the District of Columbia have some form of shield law touching reproductive health care or data, per KFF's tracking, but they vary enormously in what they actually cover. Virginia is the clearest case for cycle data specifically: it protects against search warrants, subpoenas and court orders seeking menstrual health data. Washington takes a different approach through its My Health My Data Act, which regulates how consumer health data can be collected and shared at all.

What is Washington's My Health My Data Act?

It is the first US law written to protect consumer health data that falls outside HIPAA — the gap that period apps, fitness trackers and symptom checkers live in. It is in full force. Violations are per se violations of the state Consumer Protection Act, the Attorney General can seek civil penalties, and it carries a private right of action allowing individuals to sue directly, with treble damages capped at $25,000.

Does HIPAA protect my period tracking app data?

Almost certainly not. HIPAA applies to covered entities — health plans, clearinghouses, and most healthcare providers — and their business associates. A consumer period tracking app you download yourself is generally none of those. This is the single most common misconception about health app privacy: the data feels medical, but the law that governs medical records mostly does not reach it.

Do shield laws stop another state from demanding my data?

Not cleanly. Shield laws are state laws, and interstate conflicts over them are actively unresolved — a shield in your state does not automatically bind a court elsewhere, and how these conflicts resolve is still being worked out. The Center for Democracy & Technology's January 2026 report Shield Laws in Flux is the current authority on exactly this uncertainty.

Does the law protect data stored only on my phone?

Data that no company holds cannot be demanded from a company, which sidesteps most of this entirely. Your device is still subject to lawful search, and device encryption is a separate protection. The general point holds: legal protections vary by state and are contested, while data that was never collected is not subject to any of it.

Period tracker data and the law, state by state

A plain map of what actually exists — which laws reach cycle data, which don't, and the one that most people wrongly assume covers them.

Short answer: 23 states and DC have some shield-law protection touching reproductive health data, but coverage is wildly uneven and only a few reach data held by apps. Virginia is the clearest for cycle data — it protects against warrants, subpoenas and court orders for menstrual health data specifically. Washington takes a different route, regulating how consumer health data can be collected and shared at all. And HIPAA almost certainly does not apply to your period app, which surprises nearly everyone.

Not legal advice; I’m not a lawyer. This is a sourced map, current as of August 2026, of a landscape that is genuinely in motion. Where things are unresolved, I say so.

The misconception worth clearing first: HIPAA

Most people assume health data is health data, and that HIPAA covers it. It generally does not.

HIPAA governs covered entities — health plans, healthcare clearinghouses, and most healthcare providers — plus the business associates handling data on their behalf. A period app you downloaded yourself is usually none of these. Your cycle log at your gynaecologist’s office is protected health information. The same information typed into a consumer app usually is not.

That gap is precisely why Washington wrote a new law rather than relying on the old one.

Washington: My Health My Data Act

The first US law aimed squarely at consumer health data outside HIPAA. It is in full force, and what makes it unusual is enforcement rather than scope:

Violations are per se violations of Washington’s Consumer Protection Act.
The Attorney General can pursue civil penalties.
It carries a private right of action — individuals can sue directly, recovering actual damages, costs and fees, with treble damages capped at $25,000.
A separate provision prohibits geofencing around facilities providing health services.

Most privacy laws depend entirely on a regulator choosing to act. A private right of action is what changes a company’s risk calculus, and it is why this law gets cited far more often than its single-state scope would suggest.

Virginia: the one that names menstrual data

Virginia is the most directly relevant to this article’s subject. Its consumer protections for reproductive and sexual health information include protection against the issuance of search warrants, subpoenas and court orders for menstrual health data.

That is about as specific as US law currently gets on cycle tracking, and it is worth knowing precisely because it is the exception rather than the rule.

The wider shield-law picture

Per KFF’s tracking, 23 states and DC have shield laws of some kind related to reproductive or gender-affirming care. The category name hides how different they are:

Most protect providers and patients from out-of-state legal action — important, but not about app data.
Some extend to medical information and location data.
A few reach data held by businesses, including health apps.

Recent movement: Massachusetts amended its shield law in 2025 to cover reproductive and gender-affirming care data, and New York strengthened its protections in December 2025. This is an area where a statement more than a few months old may already be stale — one reason every claim here carries a date.

The unresolved part

Shield laws are state laws, and the hard question is what happens when states disagree. A protection in your state does not automatically bind a court in another, and the mechanics of interstate conflict here are still being worked out.

The Center for Democracy & Technology’s January 2026 report Shield Laws in Flux: State Protections for Reproductive and Gender-Affirming Health Care Data in an Era of Interstate Conflict is the current authority, and its title is the finding. Anyone telling you this is settled is not reading the same material.

What this means practically

Three things follow, and only the last is fully in your control.

Your protection depends on geography — yours, and the company’s. That is a strange basis for a health decision, but it is the current state of things.
The law is moving, in both directions, and faster than most people track. What is true in August 2026 may not hold next year.
None of this applies to data that was never collected. A company with no copy of your cycle has nothing to produce, in any state, under any court’s order. That is the one protection that does not depend on your zip code.

Which is the argument for choosing on architecture rather than on jurisdiction — see can police access your period tracker data? for how that plays out mechanically, and the Period Tracker Privacy Index for what each app actually declares it collects.

Sources

KFF — State Shield Laws: Protections for Abortion and Gender-Affirming Care Providers
Center for Democracy & Technology — Shield Laws in Flux (January 2026)
Washington State Attorney General — My Health My Data Act guidance
Guttmacher Institute — Shield Laws Related to Sexual and Reproductive Health Care
Williams Institute, UCLA School of Law — Shield Law state fact sheets
Electronic Frontier Foundation — How Cops Can Get Your Private Online Data (2025)
US Department of Health & Human Services — HIPAA covered entities guidance

This page is only as current as its date. If a law has changed, please tell me at [email protected] and I will update it and note the correction.