18 ms·

FTC Settlement with Fertility-Tracking App for Facebook/Google SDK Data Sharing

159 points by averysmallbird 6y ago

908087 6y ago
Am I missing something, or are they really being let off with less than a slap on the wrist, and no fines? Not really sending a great message here, FTC.
MarkSweep 6y ago
If anyone is looking for an alternative to Flo, as of iOS 13 the built-in Health app has similar functionality: https://support.apple.com/en-us/HT210407 https://support.apple.com/en-us/HT210407
- Darkphibre 6y ago
  Open inquiry: Anything out there recommended for Android or PC?
  - jwlit 6y ago
    For Android, there's Clue : https://helloclue.com/ https://helloclue.com/
  - zaq1 6y ago
    I would recommend Drip, which is available on F-Droid. FOSS with very minimal permissions. I'd suggest checking it for trackers with ClassyShark (also on FD). https://f-droid.org/packages/com.drip https://f-droid.org/packages/com.drip Screenshots feature a modern looking UI.
  - BelenusMordred 6y ago
    Anything on f-droid is going to be good. Last time this story came up I saw a comment saying there was two prominent apps there. It's scary how many people don't immediately go for the open source alternative before checking the Google play store. Most people publishing on f-droid use their real name, have verifiable open source activity, have a professional reputation to maintain and have their apps open to world to be scrutinised. Checking F-Droid should be your first choice everytime.
    - judge2020 6y ago
      > Anything on f-droid is going to be good I fail to see how an app being on F-Droid inherently mean it’s going to be privacy-friendly.
      - BelenusMordred 6y ago
        Android SDKs themselves can be leaky and are incredibly widespread, this is a clear flaw in mobile appsec and not that well known. That said basically everything benefits from the sun shining in on it. F-Droid alerts you to anything dodgy under the hood, has reproducible builds[1] and in general has none of the complete shitshow that is playstore. In my 5EYES country Google's playstore has to secretly insert malware if the government wants it and there's no way for the end user to tell if that's the case. Tell me a common use for a mobile app and we can compare what is available on both play store and f-droid. [1] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
        judge2020 6y ago
        I’m more pointing out how it’s not a silver bullet (and how a silver bullet for app privacy doesn’t exist); nothing is perfect and f-droid is no exception, even if it is better than Play Store. Nothing is stopping an app from uploading user data for a good purpose then selling it to third parties.
        BelenusMordred 6y ago
        > nothing is perfect and f-droid is no exception, even if it is better than Play Store Not wearing a seatbelt isn't perfect, and yet we all still do it :)
        Ntrails 6y ago
        > Not wearing a seatbelt isn't perfect, and yet we all still do it :) Provably false.
  - smokey_the_bear 6y ago
    I recommend fertility friend, from their privacy policy “ FertilityFriend.com is fully funded by its VIP service fees and has been so since we started. It does not rely on any type of data trading for any of its funding or any other purpose. In other words, you are not the product. Clear and straightforward, our charting service is what we sell and nothing else.” They also have a more data driven approach to fertility than most other sources.
- mtlynch 6y ago
  I know of another one called POW! made by indie developer Benedicte Raae: https://www.usepow.app/ https://www.usepow.app/ The data is all client-side encrypted, so she doesn't collect any sensitive user data that could be sold or abused. I've never used it, but I think the privacy-first mission is cool.
  - raae 6y ago
    Hey, this is Benedicte. If the app is not for you there is also the newsletter about privacy, menstrual health and POW!: https://www.usepow.app/newsletter https://www.usepow.app/newsletter
- bmvcant 6y ago
  There is a secure app called garbage bin: Open the lid, firmly grasp your iPhone, place it over the bin, open your hand and drop it. Use pen and paper and the problem is solved.
  - yjftsjthsd-h 6y ago
    No encryption, no backups, no on-device analysis (stats, charts), inconvenient to use: Not secure, not an app, not a good alternative.
    - etrabroline 6y ago
      >not an app That foible stands out as humorous. Why does a solution to a problem need to be a smart phone app? lol Otherwise excellent points.
      - yjftsjthsd-h 6y ago
        I was specifically responding to: > There is a secure app called garbage bin hence calling out that it isn't. (But sure, I actually am fine with non-app solutions when they're actually good)
edoceo 6y ago
Is this related to the US Fertility company's data breach? Leaked SSN and DoB data, rouge code was on there for a month before they found it. Edit: it's a different breach of a different fertility related company. Finally data-breaches are sexy ;)
ndiscussion 6y ago
To quote a dead comment: "Am I missing something, or are they really being let off with less than a slap on the wrist, and no fines? Not really sending a great message here, FTC." Agreed. This is one of the most egregious abuses of privacy imagineable.
- swebs 6y ago
  You can revive a dead comment if you feel it was unjustly killed. Just click the timestamp then click "vouch".
  - ndiscussion 6y ago
    Thanks for this, I've heard of this option but assumed it was unavailable to my account.
    - saagarjha 6y ago
      It's available to everyone with a fairly reasonable amount of karma (30, I think?)
- averysmallbird 6y ago
  The FTC brings privacy cases under its 'unfair and deceptive acts or practices in commerce' prohibition, which does not provide it the legal basis to impose civil penalties. There are possibly other things it could have required (the recent Ever case requiring deletion is a good example), but it is currently constrained on what it can force for a first violation. The two Democratic FTC Commissioners issued a useful statement on what else they would have required: https://www.ftc.gov/system/files/documents/public_statements/1586018/20210112_final_joint_rcrks_statement_on_flo.pdf https://www.ftc.gov/system/files/documents/public_statements...
- zinekeller 6y ago
  I do get with the frustration, but with the current state of US (federal) laws it is probably the best remedy available now (unlike GDPR where you can really go and score larger fines and even jail time if it is grossly negligent or intentional).
Cd00d 6y ago
I'm curious if anyone has insight into the value of this kind of data. I work with alternative data for investors, mostly consumer spend behavior - things like point of sale transactions and online cart contents. These have value in that you can correlate panel behaviors with a company's revenue or identify trends in the market. But, for data like ovulation schedules or events like pregnancy, it seems that it's a lot of work (and based on the FTC ethically questionable) to see one-off events or target specific consumers a small set of products. I must be looking at the available opportunities with some kind of blind spot, because I don't get why companies would pay for this sort of data.
- core-e 6y ago
  At a minimum the last few on the mood list (depressed obsessive thoughts, apathetic, very self-critical) seem like great indicators of when someone might be the most receptive to advertising for SSRIs.
  - taneq 6y ago
    The fact that you can advertise these things at all is kind of shocking to me. I’d expect psychiatric drugs to be prescribed by a psychiatrist on their medicinal merits rather than purchased on an advertising-driven whim.
    - klyrs 6y ago
      Wait til you learn how they advertise drugs to your psychiatrist! https://www.washingtonpost.com/business/2019/01/30/stripper-turned-pharma-exec-gave-doctor-lap-dance-get-him-prescribe-drugs-officials-say/ https://www.washingtonpost.com/business/2019/01/30/stripper-...
      - taneq 6y ago
        Oh, I mean there's all manner of conflict-of-interest, perverse-incentive type stuff going on there - you kind of expect that (sadly) in big business - but it's another whole level of dodginess marketing prescription pharmaceuticals directly to laypeople. It seems only one step above roaming the streets giving out "free samples" wrapped in twists of aluminium foil.
1-6 6y ago
A menstrual cycle company named Flo. App-tly named (excuse the pun).
deleted 6y ago
[deleted]
tdaltonc 6y ago
It looks like the "sharing" here was "using 3rd party analytics tools," or is there something more here?
SergeAx 6y ago
So, what's the correct recipe here? Anonimyze your events before sending to third party analytics? Like event5, mood12?
- yjftsjthsd-h 6y ago
  Maybe there are some things where you just shouldn't use 3rd party analytics, if any.
  - arminiusreturns 6y ago
    This, especially considering that most research has shown that it's trivally easy to take anonymized data and de-anonymize it.
  - SergeAx 6y ago
    What is the difference between using Google Analytics and Google Spanner then? Or AWS Aurora vs AWS EC2 for that matter?
    - yjftsjthsd-h 6y ago
      My understanding is that Google promises not to use data in gcp databases, while it openly says it will use Analytics data for its own purposes. But yes, you should carefully consider that!
cavisne 6y ago
Whats the actual mechanism here for Google to get value from this data? You cant create a campaign targeting is_menstruating=true so how are these opaque key value pairs making them money?
j45 6y ago
This is abhorrent.
henearkr 6y ago
I hope the company Flo Health gets definitively banned from the Google Play store. They just show off how little they understand their business and the principles of medical confidentiality.
schoolornot 6y ago
Skimmed the complaint. Seems like they got in hot water for deceptive disclaimers and not committing to the tenants of the privacy shield. Had their TOS said "we may disclose your data to advertisers" in small font and not voluntarily entered into the EU-U.S. Privacy Shield they would be okay.
raae 6y ago
There is also this interesting article about app like these sharing data directly to the employer: https://www.washingtonpost.com/technology/2019/04/10/tracking-your-pregnancy-an-app-may-be-more-public-than-you-think/ https://www.washingtonpost.com/technology/2019/04/10/trackin... "Is your pregnancy app sharing your intimate data with your boss? As apps to help moms monitor their health proliferate, employers and insurers pay to keep tabs on the vast and valuable data"

Am I missing something, or are they really being let off with less than a slap on the wrist, and no fines? Not really sending a great message here, FTC.

MarkSweep 6y ago

If anyone is looking for an alternative to Flo, as of iOS 13 the built-in Health app has similar functionality: https://support.apple.com/en-us/HT210407 https://support.apple.com/en-us/HT210407

Darkphibre 6y ago
Open inquiry: Anything out there recommended for Android or PC?
- jwlit 6y ago
  For Android, there's Clue : https://helloclue.com/ https://helloclue.com/
- zaq1 6y ago
  I would recommend Drip, which is available on F-Droid. FOSS with very minimal permissions. I'd suggest checking it for trackers with ClassyShark (also on FD). https://f-droid.org/packages/com.drip https://f-droid.org/packages/com.drip Screenshots feature a modern looking UI.
- BelenusMordred 6y ago
  Anything on f-droid is going to be good. Last time this story came up I saw a comment saying there was two prominent apps there. It's scary how many people don't immediately go for the open source alternative before checking the Google play store. Most people publishing on f-droid use their real name, have verifiable open source activity, have a professional reputation to maintain and have their apps open to world to be scrutinised. Checking F-Droid should be your first choice everytime.
  - judge2020 6y ago
    > Anything on f-droid is going to be good I fail to see how an app being on F-Droid inherently mean it’s going to be privacy-friendly.
    - BelenusMordred 6y ago
      Android SDKs themselves can be leaky and are incredibly widespread, this is a clear flaw in mobile appsec and not that well known. That said basically everything benefits from the sun shining in on it. F-Droid alerts you to anything dodgy under the hood, has reproducible builds[1] and in general has none of the complete shitshow that is playstore. In my 5EYES country Google's playstore has to secretly insert malware if the government wants it and there's no way for the end user to tell if that's the case. Tell me a common use for a mobile app and we can compare what is available on both play store and f-droid. [1] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
      - judge2020 6y ago
        I’m more pointing out how it’s not a silver bullet (and how a silver bullet for app privacy doesn’t exist); nothing is perfect and f-droid is no exception, even if it is better than Play Store. Nothing is stopping an app from uploading user data for a good purpose then selling it to third parties.
        BelenusMordred 6y ago
        > nothing is perfect and f-droid is no exception, even if it is better than Play Store Not wearing a seatbelt isn't perfect, and yet we all still do it :)
        Ntrails 6y ago
        > Not wearing a seatbelt isn't perfect, and yet we all still do it :) Provably false.
- smokey_the_bear 6y ago
  I recommend fertility friend, from their privacy policy “ FertilityFriend.com is fully funded by its VIP service fees and has been so since we started. It does not rely on any type of data trading for any of its funding or any other purpose. In other words, you are not the product. Clear and straightforward, our charting service is what we sell and nothing else.” They also have a more data driven approach to fertility than most other sources.
mtlynch 6y ago
I know of another one called POW! made by indie developer Benedicte Raae: https://www.usepow.app/ https://www.usepow.app/ The data is all client-side encrypted, so she doesn't collect any sensitive user data that could be sold or abused. I've never used it, but I think the privacy-first mission is cool.
- raae 6y ago
  Hey, this is Benedicte. If the app is not for you there is also the newsletter about privacy, menstrual health and POW!: https://www.usepow.app/newsletter https://www.usepow.app/newsletter
bmvcant 6y ago
There is a secure app called garbage bin: Open the lid, firmly grasp your iPhone, place it over the bin, open your hand and drop it. Use pen and paper and the problem is solved.
- yjftsjthsd-h 6y ago
  No encryption, no backups, no on-device analysis (stats, charts), inconvenient to use: Not secure, not an app, not a good alternative.
  - etrabroline 6y ago
    >not an app That foible stands out as humorous. Why does a solution to a problem need to be a smart phone app? lol Otherwise excellent points.
    - yjftsjthsd-h 6y ago
      I was specifically responding to: > There is a secure app called garbage bin hence calling out that it isn't. (But sure, I actually am fine with non-app solutions when they're actually good)

edoceo 6y ago

Is this related to the US Fertility company's data breach? Leaked SSN and DoB data, rouge code was on there for a month before they found it. Edit: it's a different breach of a different fertility related company. Finally data-breaches are sexy ;)

ndiscussion 6y ago

To quote a dead comment: "Am I missing something, or are they really being let off with less than a slap on the wrist, and no fines? Not really sending a great message here, FTC." Agreed. This is one of the most egregious abuses of privacy imagineable.

swebs 6y ago
You can revive a dead comment if you feel it was unjustly killed. Just click the timestamp then click "vouch".
- ndiscussion 6y ago
  Thanks for this, I've heard of this option but assumed it was unavailable to my account.
  - saagarjha 6y ago
    It's available to everyone with a fairly reasonable amount of karma (30, I think?)
averysmallbird 6y ago
The FTC brings privacy cases under its 'unfair and deceptive acts or practices in commerce' prohibition, which does not provide it the legal basis to impose civil penalties. There are possibly other things it could have required (the recent Ever case requiring deletion is a good example), but it is currently constrained on what it can force for a first violation. The two Democratic FTC Commissioners issued a useful statement on what else they would have required: https://www.ftc.gov/system/files/documents/public_statements/1586018/20210112_final_joint_rcrks_statement_on_flo.pdf https://www.ftc.gov/system/files/documents/public_statements...
zinekeller 6y ago
I do get with the frustration, but with the current state of US (federal) laws it is probably the best remedy available now (unlike GDPR where you can really go and score larger fines and even jail time if it is grossly negligent or intentional).

Cd00d 6y ago

I'm curious if anyone has insight into the value of this kind of data. I work with alternative data for investors, mostly consumer spend behavior - things like point of sale transactions and online cart contents. These have value in that you can correlate panel behaviors with a company's revenue or identify trends in the market. But, for data like ovulation schedules or events like pregnancy, it seems that it's a lot of work (and based on the FTC ethically questionable) to see one-off events or target specific consumers a small set of products. I must be looking at the available opportunities with some kind of blind spot, because I don't get why companies would pay for this sort of data.

core-e 6y ago
At a minimum the last few on the mood list (depressed obsessive thoughts, apathetic, very self-critical) seem like great indicators of when someone might be the most receptive to advertising for SSRIs.
- taneq 6y ago
  The fact that you can advertise these things at all is kind of shocking to me. I’d expect psychiatric drugs to be prescribed by a psychiatrist on their medicinal merits rather than purchased on an advertising-driven whim.
  - klyrs 6y ago
    Wait til you learn how they advertise drugs to your psychiatrist! https://www.washingtonpost.com/business/2019/01/30/stripper-turned-pharma-exec-gave-doctor-lap-dance-get-him-prescribe-drugs-officials-say/ https://www.washingtonpost.com/business/2019/01/30/stripper-...
    - taneq 6y ago
      Oh, I mean there's all manner of conflict-of-interest, perverse-incentive type stuff going on there - you kind of expect that (sadly) in big business - but it's another whole level of dodginess marketing prescription pharmaceuticals directly to laypeople. It seems only one step above roaming the streets giving out "free samples" wrapped in twists of aluminium foil.

1-6 6y ago

A menstrual cycle company named Flo. App-tly named (excuse the pun).

deleted 6y ago

[deleted]

tdaltonc 6y ago

It looks like the "sharing" here was "using 3rd party analytics tools," or is there something more here?

SergeAx 6y ago

So, what's the correct recipe here? Anonimyze your events before sending to third party analytics? Like event5, mood12?

yjftsjthsd-h 6y ago
Maybe there are some things where you just shouldn't use 3rd party analytics, if any.
- arminiusreturns 6y ago
  This, especially considering that most research has shown that it's trivally easy to take anonymized data and de-anonymize it.
- SergeAx 6y ago
  What is the difference between using Google Analytics and Google Spanner then? Or AWS Aurora vs AWS EC2 for that matter?
  - yjftsjthsd-h 6y ago
    My understanding is that Google promises not to use data in gcp databases, while it openly says it will use Analytics data for its own purposes. But yes, you should carefully consider that!

cavisne 6y ago

Whats the actual mechanism here for Google to get value from this data? You cant create a campaign targeting is_menstruating=true so how are these opaque key value pairs making them money?

j45 6y ago

This is abhorrent.

henearkr 6y ago

I hope the company Flo Health gets definitively banned from the Google Play store. They just show off how little they understand their business and the principles of medical confidentiality.

schoolornot 6y ago

Skimmed the complaint. Seems like they got in hot water for deceptive disclaimers and not committing to the tenants of the privacy shield. Had their TOS said "we may disclose your data to advertisers" in small font and not voluntarily entered into the EU-U.S. Privacy Shield they would be okay.

raae 6y ago

There is also this interesting article about app like these sharing data directly to the employer: https://www.washingtonpost.com/technology/2019/04/10/tracking-your-pregnancy-an-app-may-be-more-public-than-you-think/ https://www.washingtonpost.com/technology/2019/04/10/trackin... "Is your pregnancy app sharing your intimate data with your boss? As apps to help moms monitor their health proliferate, employers and insurers pay to keep tabs on the vast and valuable data"