PERIODS FOR PROFIT AND THE RISE OF MENSTRUAL SURVEILLANCE

Menstruation is being monetized and surveilled, with the voluntary participation of millions of women. Thousands of downloadable apps promise to help women monitor their periods and manage their fertility. These apps are part of the broader, multi-billion dollar, Femtech industry, which sells technology to help women understand and improve their health. Femtech is marketed with the language of female autonomy and feminist empowerment. Despite this rhetoric, Femtech is part of a broader business strategy of data extraction, in which companies are extracting people’s personal data for profit, typically without their knowledge or meaningful consent. Femtech can oppress menstruators in several ways. Menstruators lose control over their personal data and how it is used. Some of these uses can potentially disadvantage women in the workplace, insurance markets, and credit scoring. In addition, these apps can force users into a gendered binary that does not always comport with their identity. Further, period trackers are sometimes inaccurate, leading to unwanted pregnancies. Additionally, the data is nearly impossible to erase, leading some women to be tracked relentlessly across the web with assumptions about their childbearing and fertility. Despite these harms, there are few legal restraints on menstrual surveillance. American data privacy law largely hinges on the concept of notice and consent, which puts the onus on people to protect their own privacy rather than placing responsibility on the entities that gather and use data. Yet notice and consent is a myth because consumers do not read, cannot comprehend, and have no opportunities to negotiate the terms of privacy policies. Notice and consent is an individualistic approach to data privacy that envisions an atomized person pursing their own self-interest in a competitive marketplace. Menstruators’ needs do not fit this model. Accordingly, this Essay seeks to reconceptualize Femtech within an expanded menstrual justice framework that recognizes the tenets of data feminism. In this vision, Femtech would be an empowering and accurate health tool rather than a data extraction device.


INTRODUCTION
The technology industry has recognized that periods are profitable. However, these profits do not flow to menstruators; 1 rather, they enrich private businesses. Period trackers, or smartphone apps that help menstruators monitor their cycles, are a primary driver of "Femtech," a term covering a variety of tech tools to help women manage their reproductive health. 2 The Apple app store alone offers over 1,000 period trackers, and the booming Femtech industry is expected to be worth $50 billion by 2025. 3 In addition to period trackers, the Femtech sector includes a "smart" birth control case designed to improve pill taking habits; a fertility tracking app that measures basal temperature to predict fertility; a digital sensor that tracks pregnancy contractions; a breast pump that digitally measures and records milk production; a pelvic floor trainer that sends biofeedback data to a mobile app as women perform kegel exercises; and an app for menopausal symptom management. 4 The rhetoric surrounding Femtech centers on empowerment through knowledge of the self. A popular period tracker called Clue promises "a scientific and fluff-free way to learn about your body." 5 Similarly, Flo pitches itself as a "one-stop solution for all things female health and well-being." 6 Inventors and investors tout Femtech's attention to women's health issues, which have long been sidelined, underfunded, and understudied by the mainstream health care sector and researchers. Indeed, the first iteration of Apple's health tracking app in 2014 offered no menstrual tracking features whatsoever, thus reflecting Silicon Valley's male dominance over tech design and production. 7 By contrast, Femtech promises to help women manage their reproductive health, including periods, fertility, pregnancy, childbirth, and menopause.
However, the feminist rhetoric does not match the reality. The tech industry's profit motive, unconstrained by a neoliberal (i.e., individualistic and market-driven) legal framework failing to regulate personal data, skews Femtech incentives away from women's needs and toward a surveillance paradigm that is counter to menstrual justice. Despite its participatory ethos, Femtech can oppress menstruators in several ways: it deprives them of control over their personal data; it generates data that can be used to discriminate; it lacks adequate data security; it is inaccurate; it enforces a harmful gender binary; and it reinforces stigmas against menstruation. In this way, it is counter to menstrual justice. To date, the menstrual justice movement has largely focused on oppression faced by menstruators in the analog world of workplaces, schools, prisons, and stores. 8 Menstrual justice is defined by its goal "to identify, reduce and remedy harm from structural oppression of menstruators while supporting their multidimensionality, inclusion, dignity, liberty and equitable treatment through law, policy and practices and in collaboration with other social justice movements." 9 To fully achieve these objectives, the menstrual justice movement needs to recognize the oppression imposed by menstrual surveillance and to incorporate the lessons and activism of data feminists. Accordingly, this Essay describes the oppressive harms of Femtech; analyzes the lack of legal recourse; and asserts the need for the menstrual justice movement to align with data feminists to harness technology to benefit menstruators.

I. The Menstrual Surveillance Model
Most period trackers do not charge users money; rather, they earn profits by selling user's data to advertisers and other industries interested in assessing women. To access period trackers, users typically turnover not only demographic data such as name, birthday, and email address, but also deeply personal information, such as their sexual positions and practices; moods and feelings; and indicators such as the physical characteristics of menstrual flow or the quality of cervical mucus. The apps are programmed to incentivize users to constantly enter additional information, such as by rewarding users with access to special features. 10 One study of ten popular apps, including period trackers, found that the apps were sending information including gender, age, IP addresses (a unique indicator linked to a networked device), GPS locations, and user behavior to at least 135 companies involved in advertising and behavioral profiling, ranging from Big Tech platforms such as Amazon and Facebook, to small companies in the targeted ad industry. 11 In this profit model, women perform the invisible labor of providing data for male-dominated corporate interests. 12 Femtech is part of a much larger web of "surveillance capitalism," in which "human experience [is] free raw material for translation into behavioral data." 13 In 2021, the Federal Trade Commission settled allegations that Flo -a period and fertility tracking app used by more than 100 million consumers -was sharing its user's data with outside data analytics companies including Facebook and Google despite promising users that their data would remain private. 14 In 2020, the Washington Post wrote that a fertility app called Premom was sending users' personal data to three Chinese companies engaged in targeting advertising. 15 That same year, California's Attorney General settled a case with Glow, another period and fertility tracking app, after it found that the app was allowing third-party access to user information without the user's consent. 16 Further, Glow had major security flaws that "stalkers, online bullies, or identity thieves" could use to harm users. 17 These and many other investigations demonstrate that menstruators do not control their data; rather, their data is being used in attempt to control them, particularly their purchasing decisions. 18 In fact, advertisers are particularly interested in identifying pregnant women because of the opportunity to generate brand loyalty at the start of a major life change. Thus, in the United States, a pregnant woman's data is worth fifteen times that of the average person. 19 Targeted advertising may seem annoying, yet harmless. However, for women who have lost pregnancies or chosen to have abortions, this sort of targeted profiling can be psychologically painful because it is based on data scraping about their health status that may no longer be accurate. 20 Journalist Olga Massov wrote about how she was unable to change a period app's default settings after she lost a pregnancy due to miscarriage. 21 As a result, the app emitted a constant stream of alerts, such as updates about the size of the fetus or likely cravings she would experience. For women who have lost pregnancies, these constant reminders "served as painful reminders that their bodies have somehow failed, even if they knew that wasn't true." Femtech companies can analyze their troves of personal data to infer sensitive attributes such as sexual orientation and religious beliefs. Such inferences not only power targeted advertising, but also can be used for more nefarious purposes such as "discrimination, manipulation, and exploitation." 22 Based on data scraped from Femtech tools, women may find themselves paying higher rates for loans or insurance or being denied employment by applicant screening systems. 23 This is because the data is linked to gender, and gender-based decision-making can be deployed in ways that are discriminatory to women. These harms are usually invisible; consumers rarely learn the reasons behind these algorithmically determined outcomes.
The risk of discrimination is heightened in the workplace, where many employers are adopting Femtech as part of workplace wellness programs designed to help employers minimize health care spending and engage in workforce planning. 24 For instance, Ovia is a fertility, pregnancy, and parenting app adopted by numerous companies who collectively employ ten million employees. 25 Many employers give workers financial incentives to use the apps, such as gift cards and health insurance discounts. 26 While these apps can assist employees in monitoring their health, they also raise the specter of pregnancy discrimination and reduced health care benefits. As Karen Levy, an information science professor, states, "The real benefit of self-tracking is always to the company. People are being asked to do this at a time when they're incredibly vulnerable and may not have any sense where that data is being passed." 27 Indeed, Ovia's terms of service grant the company "a royalty-free, perpetual, and irrevocable license, throughout the universe" to "utilize and exploit" the user's personal data for research and marketing. 28 With this data in hand, discrimination can result from "[e]mployers who consciously or unconsciously believe in certain stereotypes about women, including the beliefs that women who are menstruating are distracted or incompetent, that women who are trying to get pregnant are poor candidates for investment and promotion, or that mothers are less committed to their work than fathers . . ." 29 Ovia boasts that it holds "one of the largest data sets on women's health in the world." The massive sets of health data held by Ovia and other Femtech companies raise concerns of data security. An investigation by Consumer Reports of five popular period tracking apps found that users could not control how their information is shared with third parties, or what those third parties do with the information. 30 While many of the apps required users to share their names and email addresses for access, none of them offered basic security protections such as multi-factor authentication. The lack of security heightens the specter of data breaches, in which hackers are stealing personal information for identity theft or sale. 31 Within the health care industry, between 2009 and 2019, there were 3,054 large-scale data breaches equating to seventy percent of the United States population. 32 The lure to hackers is financial: "[O]n the black market, a person's medical information sells for fifty times what credit card information sells for" 33 due to its detail and the lag time before consumers become aware of this form of identity theft. Given the value of health-related data, there is every reason to think Femtech companies have been and/or will be targeted as well. 27 Harwell, supra note 26. 28 Id (quoting Ovia's privacy policy).  Femtech also raises troubling issues of inaccuracy. Numerous studies by medical researchers have shown that period and fertility apps are not as accurate as they claim, and yet generally lack appropriate disclosures about their limitations. . Although the algorithms that fuel these apps are opaque and unpublished, it appears that their accuracy falters due to generalized assumptions about the "normal" length and timing of menstrual cycles. 34 One prominent study of seventy-three fertility apps found that the rate of accurate prediction of a user's day of ovulation was no more than twenty-one percent. 35 A 2020 meta study concluded that most apps are not accurate "even though they might contain information that supports pregnancy planning or are marketed specifically for this purpose." 36 Femtech is further problematic as a gendered surveillance tool. Many apps use pink color schemes and graphics, such as flowers and hearts, that reinforce feminine notions of gender performativity. 37 While this "fashionable girly" branding appeals to some women, a larger majority report being turned off by products that "just felt condescending or like they were designed by dudes who were designing what they thought a woman would like." 38 In addition to the appearance of their interfaces, these apps also make stereotypical, gendered assumptions about users and their goals in adopting Femtech. Developers assume that users identify as female, have male partners, and are using the app to track ovulation. 39 Such assumptions flatten users' experiences. Maggie Delano, an engineering professor, wrote about her experience with Glow, a period tracking app (created by four men), which offered users three "journeys": avoiding pregnancy, trying to conceive, or fertility treatment. 40 She reflected that the app is designed for "straight, sexually active, partnered, cis women with enough money for a smartphone to run the app," while telling "queer, unpartnered, infertile, and/or women uninterested in procreating that they aren't even women." 41 And importantly, some individuals who menstruate do not identify as women, but as men or nonbinary. 42 The messaging of these apps also reinforces gendered behaviors in the analog world. At one point, the Glow app reminded women who were trying to get pregnant to wear nice underwear on a fertile day, while sending notices to their partners to bring home flowers. 43 The gendered nature of period trackers is so dominant that one popular app's marketing strategy hinges on countering this frame by touting its gender neutrality and diversity of its users. 44 Finally, Femtech apps can inadvertently reinforce stigmatization of menstruation. As media professor Mikki Kressbach explains, women have long "talked around" menstruation with jokes and euphemisms, which in turn suggest that menstruation should remain concealed. Apps embed this tension. For instance, many apps use amusing animations and graphics to represent various menstrual symptoms and moods, such as an animated balloon to represent bloating. On the one hand, this lighthearted framing can make it more socially palatable to talk about menstruation; on the other hand, it reinforces "the perception that menstruation is an uncontrollable abject process that should be managed and suppressed."

II. Limitations of Law
American law fails to protect and secure the personal data generated by the menstrual surveillance industry. To begin with, the United States lacks a comprehensive data privacy law giving people rights to control access to and use of their data. 46 Instead, we have a patchwork regime of sectoral laws. 47 In the United States, health information is governed by the Health Insurance Portability and Accountability Act ("HIPAA"), which created national standards to protect patient information. 48 However, HIPAA only protects information gathered by "covered entities," which are generally medical providers, such as doctors and hospitals. 49 It does not govern medical information gathered from mobile apps, thus leaving "a gaping hole in the privacy Americans have come to expect when it comes to their personal medical information," 50 especially given that that apps -unlike a doctor's visit --generate "24/7 monitoring in order to create a digital doppelgänger of the person" 51 from both self-reporting and sometimes electronic monitoring of the physical body.
In lieu of a comprehensive data privacy law, the United States relies on selfregulation by companies that collect and use data and puts the burden on consumers to protect their own data. This notice and consent approach seeks to provide consumers with information about a mobile app or website's privacy policy, so that the consumer can decide whether or not to engage with the app or site. 52 Theoretically, the notice-consent approach provides consumers with autonomy, while allowing tech companies room to innovate. Practically, however, this approach fails to protect consumers because it 46 See Michele Gilman, Five Privacy Principles (from the GDPR) the United States Should Adopt to Advance Economic Justice, 52 ARIZ. STATE L.J. 368, 400 (2020). By contrast, in the European Union, the General Data Protection Regulation (GDPR) places obligations on the entities that gather personal data and individual rights to consumers. Id. at 412-13. 47 There are also some states that have been more active in regulating data privacy; the most far-reaching statute is the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 (West 2020). wrongly assumes fair contractual bargaining positions between corporate providers and their consumers. Numerous studies show that consumers do not, and cannot, read privacy policies that are lengthy and rife with legalese. 53 Even when consumers disagree with a provision, they have no leverage to negotiate better terms with the app's owner. Furthermore, data collectors can reserve the right to change their policies in the future at any point, even without user consent.
The Federal Trade Commission (FTC) has the power to sue companies whose practices are "unfair and deceptive." 54 A company that violates its stated privacy policy or provides inaccurate information could find itself in the FTC's crosshairs. However, the FTC is limited in its enforcement resources. 55 Moreover, the FTC's regulatory powers can only focus on broken promises, and cannot give bite to the notion of consumer consent. Meanwhile, the Food and Drug Administration (FDA) generally does not regulate medical apps, limiting its review of medical devices to those that pose patient safety risks in the event of device failure. 56 Contraceptive apps are a sole exception. In 2018, the FDA approved a fertility app called Natural Cycles as a low-to-moderate risk medical device. 57 Natural Cycles relies on user reports of basal temperature and period data to indicate which days are likely to result in conception and has a ninety-three percent accuracy rate. 58 However, the review process has been challenged for a lack of rigor, and there are concerns as to whether consumers will over-rely on FDA approval. 59 In light of this regulatory dead zone, privacy advocates urge Femtech users to carefully select apps with greater privacy controls, and to set their devices to use twofactor authentication to access apps, turn on ad blockers, and turn off geolocation tracking. 60 Although these are necessary steps, they are not affirmative protection or consent-they are self-defense. As the activists of the organization Coding Rights have stated, "The principle of consent is directly related to physical and psychic protection in queer and feminist circles." 61 To be valid, consent must be freely given, reversible, informed, enthusiastic, and specific. 62 In these situations, consent is an "exercise of selfdetermination and liberty." 63 By contrast, the neoliberal concept of notice and consent in privacy law "tends to diminish the concept of consent to simple, non-active resistance, making excuses that tend to legitimize abuses." 64

III. Menstrual Justice & Data Feminism
Menstrual justice centers the elimination of oppression based on a person's status as a menstruator. The menstrual surveillance industry runs counter to this vision because it hinges on the extraction and use of personal data. In contrast, the theoretical construct of data feminism can better fulfill the goals of menstrual justice. Data feminism, as articulated by data scholars Catherine D'Ignazio and Lauren F. Klein, is "a way of thinking about data, both their uses and their limits that is informed by direct experience, by a commitment to action, and by intersectional feminist thought." 65 It is founded on the principle that data reinforce structural power inequalities. As Femtech illustrates, data extraction systems "create a profound asymmetry between who is collecting, storing, and analyzing data, and whose data are collected stored, and analyzed." 66 Elite White men outcomes of the design process." 74 A diverse range of menstruators would be assembled to provide input on their needs and expectations and to reflect on their interactions with Femtech tools. Medical professionals would also be integral to Femtech design, grounding these tools in sound research and clinical practice. The apps would provide accurate and non-stereotyped educational information about reproductive health, and they would be honest with users about appropriate uses and limitations. The algorithms that fuel Femtech would be tested before deployment, as well as audited regularly for accuracy and bias. Data would be collected only to the extent necessary to provide the services sought; data retention would be time-limited; and users could demand its erasure at any time. Sharing data with for-profit third parties would be absolutely barred. Shared data used for medical research would be collected only with informed consent and anonymized so that information could not be re-traced to individual users. Data security would be enhanced, with concrete remedies for users in the event of breaches.
If Femtech tools are offered without a profit motive, it means that non-corporate entities would be central to supporting this model. This model's goals would include advancing public health and women's empowerment. Femtech tools could be created and supported by non-profits and foundations, as well as medical professionals and hospitals. Developers might charge users a fee, but would do so on a sliding scale or with subsidies to ensure access to low-income users. Employers might still pay developers for wellness apps offered to employees, but such uses would entail the protections outlined above. Currently, many Femtech tools appear to be "free," but in reality come at a steep cost to privacy, autonomy, and justice. Thus, it is essential to develop a Femtech model that is not driven by profit acquired by selling its users' personal data.
All menstruators deserve to better understand and control their reproductive health. Femtech has the potential to enhance menstrual justice-but only if we demand it.