Authored By: Biata Simpeh
London School Of Economics and Political Science
In 2015, the Royal Free London NHS Foundation Trust gave Google DeepMind the fully identifiable medical records of 1.6 million patients without consent.[1] This scandal brought into question what consent should look like in healthcare, when both private and public bodies are entrusted with such valuable information and whether or not the current UK regulation is effective enough in ensuring personal data remains protected.
According to the BMJ, three of the most popular period-tracking apps alone account for 250 million downloads worldwide.[2] In recent years, women have exercised autonomy and sovereignty over their bodies through such apps, being able to observe and understand complex changes in their bodies, such as hormonal fluctuations and periods in their cycle, on their phones and other devices. Such technology has been revolutionary for women across the world and plays a significant role in daily life. However, advantages are not without their downsides. In recent times, the question of privacy and data protection within these apps has arisen, with concerns that predatory companies are determined to access and distribute the data of unsuspecting users as part of their service.
This article will explain the ways in which tat the current regulation we have in the UK is not applied in a way in which consent and data privacy are absolutely respected. Section I will cover the existing privacy framework that currently applies in the UK, before Section II, which will examine the main criticisms of data protection regulation that exists.
I . The Existing Legal Framework
UK GDPR
Information rights and data privacy are currently upheld by the GDPR in the UK, which ensures that there is enough transparency of data usage in public bodies. The ICO (Information Commissioner’s Office) reports to Parliament and enforces the laws of the Data Protection Act and the DUAA (Data Use and Access Act 2025) as well as the GDPR.
Under the UK GDPR, most sexual health data is considered “special category data”[3] which means that it can only be processed under certain conditions listed under Article 9, often being that explicit consent to collect data about use of the app rather than data belonging to public health or research, due to most models of “Mentruapps” being largely commercial. The standard for such consent is that it must not be used as a gateway to prevent or enable the functions of such apps or websites.
According to the UK and EU GDPR, transparency about how the data is being used and collected is highly valued, with companies potentially facing compliance and reputational risk if such standards are not adhered to. Valid consent under the GDPR is defined by the ICO as “freely given, specific, informed and unambiguous”[4], for which further conditions are set out in Article 7. What should be highlighted as perhaps the most important aspect of consent and digital privacy is the right to withdraw consent at any time.
DUAA
Additionally, the DUAA ( Data Use and Access Act 2025) is a new act of Parliament that has had a significant impact on data protection laws in the UK to “promote innovation and economic growth”[5] whilst attempting to still protect “people and their rights”. The DUAA amends both the UK GDPR and the Data Protection Act as well as the PECR (Electronic Communications Regulations). According to the ICO, the DUAA will further innovation for companies, as it enables organisations to “re-use people’s personal information”[6] to make significant automated decisions about them, so long as the appropriate safeguards are applied, as well as specific cookies used to collect information for statistical purposes to be collected without consent. Another notable change to past data protection law is the introduction of an “assumption of compatibility”, which enables organisations to assume that “some re-uses of personal information”[7] are permitted with a compatibility test, as long as the data is reused for a similar purpose. Regulation like this has a profound impact on how companies use data and how such data can be stored and distributed to third parties.
It is important to consider that this reform is incredibly new, and so the effects from such legislation may not be directly traceable as of yet.
Criticism of current regulations
FemTech (Female Technology) is not yet a distinct category under the GDPR, and it is instead categorised under health data with third parties, such as employers, who use that information to inform hiring or firing decisions without consent from the data subject. Alaattinoğlu’s[8] audit of popular “menstruapps” revealed consent was more often assumed to be on a grand scale, and that is evidence that the protections of the law are fine on paper but not being enforced in practice, especially since FemTech is worth over $100 billion.[9] As the volume and value of intimate health data increases, companies need to treat consent as a formality and not as a safeguard in terms of data, so that what Article 9 says about data at hand is not being applied Alaattinoğlu highlights a deep problem: the power imbalance between individuals and the companies that process their data. She argues that Western data protection law reflects a neoliberal ideal in which individuals are made responsible for managing their own health, a responsibility that is transferred onto users through the binary choice to accept or reject an app’s terms and conditions.[10] This is not entirely fair to the GDPR and DUAA, which were designed precisely to prevent this kind of individualised exploitation. Nevertheless, Alaattinoğlu’s point is that in practice, consent mechanisms still place the full burden of protecting one’s own data on the user, which is exactly why data privacy regulation needs reform.
Period apps and websites couple feminist language that period tracking apps as women ‘take control’ of their bodies and “reclaim [their] month”[11], with the storage of personal data the metaphorical ‘price’ it requires. Such marketing language makes the user feel more in control of their data than they currently are, which in turn gives such companies more access to data as women subconsciously do not want to reject the empowerment that knowledge about their own body provides.
Alaattinoğlu found that a complete rejection of their privacy policy greatly impacted the experience that users had on the software, which undermines the idea that consent under Article 9 of the GDPR must be freely given. Not only would permission to share personal data be assumed upon agreeing to the privacy policy, but not agreeing would lead to a reduced or prevented experience of the app. This would be to not use the platform altogether, despite the UK GDPR warning against this. Alaattinoğlu references Palmer’s idea of “freedom to negotiate”[12] where they argue that there should be a communication between the parties to ensure that a truly free and informed decision can be made, similar to that of “professional medicine”[13]. Closer to the standard of informed consent expected in professional medicine rather than a binary agreement. Her critique is persuasive: it explains why so many of the apps she audited technically obtained “consent” while failing to meet the substantive protections Article 9 was designed to guarantee.
Collective privacy also becomes an issue. Almeida et al.’s[14] point out that with data about pregnancy, fertility and general sexual health, knowledge about people other than the primary data subject is collected, which results in secondary data subjects unable to consent or object to the data that is also being collected, showing that there is a structural gap in who can and cannot consent “freely”[15] to the data that is given to such organisations and consequently third parties.
III. Conclusion
This article has argued that the UK GDPR and the DUAA, although having suitable legal standards on paper, such as rules about what constitutes explicit consent, privacy law is insufficient when it comes to implementation. What content looks like in practice does not meet the requirement of “freely given, specific, informed and unambiguous”[16], as pre-ticked boxes and combined terms and conditions are designed to confuse or mislead the user so that they agree to data being collected that they otherwise would not have. Additionally, the individual-centred model of consent can’t account for collective/relational data and secondary sources of data that cannot fully consent either. Power imbalances between the user and the organisation must also be taken into account for the data privacy legislation to be considered truly effective.
However, it should be considered that reforms like the DUAA 2025 are fairly recent and the effects on it on data collection are yet to be seen. Furthermore, there is a limited number of cases relating solely to period tracking websites, so as the industry grows in the future, the true effectiveness of such reform can be observed.
In conclusion, UK legislation provides the regulation to protect users’ period tracking apps’ data, but without stronger enforcement and a tighter model of consent, those tools are not currently being applied with the seriousness the intimacy of this data demands.
Table of Cases
Royal Free London NHS Foundation Trust (Undertakings, Health) [2017] UKICO 2017-66
Table of Legislation
Data (Use and Access) Act 2025
Data Protection Act 2018
UK General Data Protection Regulation (UK GDPR)
Bibliography
Alaattinoğlu D, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157
Almeida T, Shipp L, Mehrnezhad M and Toreini E, ‘Bodies Like Yours: Enquiring Data Privacy in FemTech’ (2022) NordiCHI Adjunct ’22
Information Commissioner’s Office, ‘Special category data’
Information Commissioner’s Office, ‘The Data Use and Access Act 2025 (DUAA) – what does it mean for organisations?’
Information Commissioner’s Office, ‘What is valid consent?
McMillan C, ‘Regulatory gaps in period tracking apps’ (2026) 394 BMJ e100515
[1] Royal Free London NHS Foundation Trust (Undertakings, Health) [2017] UKICO 2017-66
[2] Catriona McMillan, ‘Regulatory gaps in period tracking apps’ (2026) 394 BMJ e100515 https://www.bmj.com/content/394/bmj-2026-100515 accessed in 6 September 2026
[3] Information Commissioner’s Office, ‘Special category data’ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/special-category-data/ accessed in 6 September 2026
[4] Information Commissioner’s Office, ‘What is valid consent?’ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/ accessed in 6 September 2026
[5] Information Commissioner’s Office, ‘The Data Use and Access Act 2025 (DUAA) – what does it mean for organisations?’ https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/#laws accessed in 6 September 2026
[6] Information Commissioner’s Office, ‘The Data Use and Access Act 2025 (DUAA) – what does it mean for organisations?’ https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/#laws accessed in 6 September 2026
[7] Information Commissioner’s Office, ‘The Data Use and Access Act 2025 (DUAA) – what does it mean for organisations?’ https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/#laws accessed in 6 September 2026
[8] Daniela Alaattinoğlu, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157, 157–179, 172
[10] Daniela Alaattinoğlu, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157, 157–179
[11] Daniela Alaattinoğlu, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157, 157–179, 158
[12] Daniela Alaattinoğlu, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157, 157–179, 173
[13] Daniela Alaattinoğlu, ‘Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps’ (2022) 30 Feminist Legal Studies 157, 157–179, 166
[14] Teresa Almeida, Laura Shipp, Maryam Mehrnezhad and Ehsan Toreini, ‘Bodies Like Yours: Enquiring Data Privacy in FemTech’ (2022) NordiCHI Adjunct ’22
[15] Information Commissioner’s Office, ‘What is valid consent?’ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/ accessed in 6 September 2026
[16] [16] Information Commissioner’s Office, ‘What is valid consent?’ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/ accessed in 6 September 2026
