Law & your data
Period data and the law.
What can actually be demanded, from whom, and where the law reaches — a calm, sourced map of a landscape that is genuinely still in motion.
Written by Abhishek Agarwal, maker of Dew. How this is sourced →
The short version: if your cycle sits on a company’s servers, it can be sought through legal process. If it only ever exists on your phone, there is no company to serve. Everything else on this page is detail on that one distinction.
Nothing here is legal advice — I’m an engineer, not a lawyer. It is a sourced map, current as of August 2026, and where the answer is genuinely unsettled I say so instead of tidying it up.
Start with the correction
The story almost everyone repeats — that a period app got someone prosecuted in Nebraska — is not what happened. That 2022 case turned on Facebook Messenger direct messages produced by Meta under a search warrant, alongside medical records. No period app data was involved.
The real lesson is broader, not narrower: the data that got produced came from an ordinary messaging app nobody thinks of as sensitive. The risk category is readable data held by a company that can be served — and cycle trackers are one example of that, not a special case. Full detail in can police access your period tracker data?
The gap HIPAA leaves
Most people assume health data is covered by HIPAA. For consumer apps it generally isn’t. HIPAA reaches healthcare providers, plans and clearinghouses — not an app you downloaded yourself. Your cycle at the doctor’s office is protected health information; the same facts typed into a tracker usually are not.
Washington wrote the My Health My Data Act precisely because of that gap. It is in full force, violations are per se violations of the state Consumer Protection Act, and unusually it carries a private right of action — people can sue directly. That last detail is what actually changes company behaviour.
Where protections exist
Twenty-three states and DC now have shield laws of some kind, though they differ enormously. Most protect providers and patients rather than app data. A few go further: Virginia protects specifically against warrants, subpoenas and court orders seeking menstrual health data — about as direct as US law currently gets.
The unresolved part is what happens when states disagree. The Center for Democracy & Technology’s January 2026 report Shield Laws in Flux is the current authority, and its title is the finding. The state-by-state picture is in period tracker data and the law, state by state.
What the apps themselves declare
Law is one half; the other is what a company collects in the first place. We read the App Store privacy label of 14 period trackers on : 7 declare they use your data to track you, 10 link health data to your identity, and only 2 collect nothing at all.
The full table, with every source and date, is the Period Tracker Privacy Index.
The one protection that doesn’t depend on geography
Shield laws vary by state, are contested between states, and change. None of that uncertainty touches data that was never collected. A company holding no copy of your cycle has nothing to produce — in any state, under any court’s order.
That is the argument for choosing a tracker on architecture rather than on jurisdiction or on promises. What that looks like in practice is in what “private” actually means, and if you’re currently on a cloud tracker, should you delete your period app? covers moving without losing your history.
the series
The full series
Can police access your period tracker data?
Sometimes — and it depends almost entirely on one thing: whether the app keeps your cycle on a company's server or only on your phone. Here's what can actually be demanded, and from whom.
read →
Should you delete your period app?
Probably not — but you should probably move. Deleting the app rarely deletes the data, and the question that actually matters is where your cycle is stored, not whether an icon is on your phone.
read →
Period tracker data and the law, state by state
Twenty-three states and DC now have shield laws touching reproductive health data. A handful go further and name menstrual data explicitly. Here's what exists, what it covers, and what it doesn't.
read →
Why I read fourteen privacy labels in one sitting
I built a period tracker, so I had a guess about what the others were doing. I was wrong about the number — and the app that beat mine isn't mine.
read →
Common questions
Frequently asked
- Can period tracker data be subpoenaed?
- Data held on a company's servers can be sought through legal process — subpoena, court order or warrant — and a company holding readable data can generally be compelled to produce it. Data that exists only on your phone has no company to serve, so investigators would need lawful access to the device itself. The determining factor is where the data is stored, not what the app's privacy policy promises.
- Does HIPAA cover period tracking apps?
- Almost never. HIPAA applies to covered entities — health plans, clearinghouses and most healthcare providers — and their business associates. A consumer period app you download yourself is generally none of these. The same cycle information is protected in your doctor's records and largely unprotected in a consumer app, which is the gap Washington's My Health My Data Act was written to close.
- Has period app data ever been used in a US prosecution?
- There is no publicly documented US prosecution built on period-tracking app data. The 2022 Nebraska case frequently cited as an example did not involve a period app — the evidence was Facebook Messenger direct messages produced by Meta under a search warrant, together with medical records.
- Which states protect menstrual health data?
- Twenty-three states and DC have some form of shield law touching reproductive health data, with wide variation in scope. Virginia protects specifically against search warrants, subpoenas and court orders for menstrual health data. Washington's My Health My Data Act regulates how consumer health data may be collected and shared at all, and carries a private right of action.
- What's the most reliable way to protect cycle data?
- Use a tracker that keeps no copy on any company's server. Legal protections vary by state, are actively contested between states, and can change. Data that was never collected is outside all of it — there is nothing to subpoena, sell, share or breach.
the app
Get Dew. Quiet by design.
A private period tracker that lives on your iPhone. No account, no ads, no data sold — by design.
Download on the App Store →Dew tracks cycles. It does not diagnose or replace a doctor.