The Patchwork: Where Reproductive Health Data Law Stands in 2026

Privacy · 2026-03-12 · 8 min read

A federal HIPAA rule was struck down, a state bill was vetoed, and a jury ruled against Meta over period-app data. Here's what changed since 2025, and what it means for the data in your cycle app.

On August 1, 2025, a federal jury in California found that Meta violated the state's Invasion of Privacy Act by collecting sensitive data from users of the Flo period-tracking app. A plaintiffs' law firm said it was the first time Meta had been held responsible for recording communications through its software kit.

Why the Law Matters for an App on Your Phone

Many people assume their health information is covered by HIPAA. Once it's in an app, it usually isn't. HIPAA applies to doctors, hospitals, insurers and their contractors. A period tracker you downloaded yourself is generally none of those, so what it can collect and share is set by state law, consumer protection law and its own privacy policy.

Since 2025, each of those layers has moved. Some protections got stronger. One got much weaker. The result is a map that depends on where you live.

The Federal Rule That Didn't Last

In April 2024, the US Department of Health and Human Services published a rule limiting when HIPAA-covered providers could disclose reproductive health information, for example to investigate someone for seeking lawful care. On June 18, 2025, a federal judge in the Northern District of Texas vacated most of that rule nationwide in Purl v. HHS, finding that the department had exceeded its statutory authority.

Even while it was in force, the rule never reached app makers. Its loss means records held by clinics have fewer federal protections again, while app data was never covered to begin with.

What the States Did

  • **Washington**: The My Health My Data Act, in force since March 31, 2024 (June 30, 2024 for small businesses), requires consent before consumer health data is collected or shared, and can be enforced by the attorney general or through private lawsuits. The first class action under it was filed against Amazon in February 2025, over data allegedly gathered by an Amazon advertising software kit inside other companies' apps.
  • **Virginia**: SB 754, signed in March 2025 and effective July 1, 2025, amended the Virginia Consumer Protection Act to bar obtaining, disclosing, selling or disseminating reproductive or sexual health information without the consent of the consumer. Its definition covers menstruation, ovulation, pregnancy and the ability to conceive, and it can be enforced through private lawsuits as well as by the attorney general.
  • **New York**: The legislature passed the New York Health Information Privacy Act in January 2025. Governor Hochul vetoed it on December 19, 2025, citing its broad definitions and scope. A revised bill, S9269, was introduced in February 2026 and passed both houses in June 2026. When I checked the New York Senate bill page on October 30, 2026, it showed no signature or veto.

Laws like these help, but they share a limit. They decide when a company may share your data. They don't change the fact that the company has it, and data a company holds can still be breached, sold along with the business, or requested by law enforcement.

What the Flo Case Showed

The Flo litigation began in 2021 and covered users who entered menstruation and pregnancy information into the app between 2016 and 2019. The plaintiffs argued that this data reached companies including Meta and Google through the advertising and analytics software kits built into the app. Google and other defendants settled earlier, and Flo settled during the trial. Meta did not settle, lost at trial, and said it vigorously disagrees with the verdict.

The mechanism is the important part. Nobody at Flo had to decide to sell a user's cycle. Third-party kits, added for ordinary product reasons, carried the data out as a side effect. Any app that includes such kits has the same exposure, whatever its privacy policy promises.

Questions Worth Asking Your Cycle App

  • Does it need an account, an email address or a phone number?
  • Does it sync your logs to its own servers?
  • Which third-party SDKs does it include for analytics, ads or crash reporting?
  • What does its App Store privacy label say, and what network activity does the App Privacy Report show for it?
  • If you delete your data, is any copy left anywhere but your phone?

How HushCycle Is Built

HushCycle doesn't rely on any of these laws to keep your data private. The app's own code makes no network requests, and an automated test fails the build if networking code or any third-party package is added. There is no account, no analytics and no crash reporting. The only traffic is the App Store purchase flow, which goes to Apple. Its App Store label is Data Not Collected.

Your periods, flow, symptoms and test readings stay in the app's own storage on your iPhone, with iOS Complete file protection. You can set a 6-digit PIN, and a decoy PIN that opens a separate, empty vault. If you want a copy, you export an encrypted backup sealed with your own passphrase and save it where you choose; HushCycle has no copy. A company that holds nothing has nothing to hand over.

Sources

  • Lowey Dannenberg, 'Flo Health class action' (verdict of August 1, 2025). https://lowey.com/cases/flo-health-class-action/
  • BankInfoSecurity, 'Jury holds Meta accountable in landmark privacy decision', August 2025. https://www.bankinfosecurity.com/jury-holds-meta-accountable-in-landmark-privacy-decision-a-29115
  • Georgetown O'Neill Institute, 'Purl's HIPAA ruling rolls back essential reproductive privacy protections nationwide', 2025. https://oneill.law.georgetown.edu/purls-hipaa-ruling-rolls-back-essential-reproductive-privacy-protections-nationwide/
  • Groom Law Group, 'Texas judge vacates HIPAA reproductive health care rule: what happens now', June 2025. https://www.groom.com/resources/texas-judge-vacates-hipaa-reproductive-health-care-rule-what-happens-now/
  • Washington Attorney General, 'Protecting Washingtonians' personal health data and privacy'. https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
  • WilmerHale, 'First lawsuit filed under Washington's My Health My Data Act', February 20, 2025. https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250220-first-lawsuit-filed-under-washingtons-my-health-my-data-act
  • Code of Virginia, Va. Code 59.1-198, 59.1-200 (subdivision 85) and 59.1-204. https://law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-200/
  • Cooley, 'Virginia enacts new broad consent requirement for collection of reproductive and sexual health information', April 4, 2025. https://www.cooley.com/news/insight/2025/2025-04-04-virginia-enacts-new-broad-consent-requirement-for-collection-of-reproductive-and-sexual-health-information
  • New York State Senate, bill S929 (2025), history through veto of December 19, 2025. https://www.nysenate.gov/legislation/bills/2025/S929
  • New York State Senate, bill S9269 (2025-2026 session), page read October 30, 2026. https://www.nysenate.gov/legislation/bills/2025/S9269
  • NYCLU, 'Gov. Hochul signs shield law, vetoes integral hospital transparency and health data privacy bills', December 20, 2025. https://www.nyclu.org/press-release/gov-hochul-signs-shield-law-vetoes-integral-hospital-transparency-and-health-data-privacy-bills

Related products