MIA Fem initially sent a detailed statement in response to Privacy International for publication, which Privacy International also shared with BuzzFeed News for this article. After being subsequently contacted by BuzzFeed News, MIA Fem first asked for a copy of a draft of this article and details about which parts of its response would be quoted. It later threatened legal action against Privacy International and sent another email to BuzzFeed News, saying, “we hereby urge you to erase all the material erroneously obtained without prevarication and delays. We shall be waiting on your confirmation of the erasure.”
“Considering that the unauthorized disclosure has already happened, we hereby urge you to erase all the material erroneously obtained without prevarication and delays. We shall be waiting on your confirmation of the erasure.”
“The Ad SDK [Facebook’s software development kit] helps us earn revenue by displaying ads that our users can opt out of by subscribing to Maya’s premium subscription,” the company said in an email to Privacy International and BuzzFeed News.
“All data accessed by Maya are also essential to the proper functioning of the product. Predicting information pertaining to menstrual cycles is complex and dependent on thousands of variables,” the email added. “Location information, the significance of which is highlighted in the report, helps us triangulate regional variations in cycle lengths and thus help improve accuracy of our prediction over time.”
A spokesperson for Facebook said the platform requires app developers to be clear with users about the information they are sharing with Facebook and have a “lawful basis” for the disclosure and use of data.
“We have systems in place to detect and delete certain types of data such as Social Security Numbers, passwords, and other personal data, such as email or phone number,” the spokesperson said. “We have begun looking at ways to improve our system and products to detect and filter out more types of potentially sensitive data.”
MIA Fem asks users about all kinds of habits ranging from smoking to coffee consumption and tampon use. This data isn’t immediately shared with Facebook, Privacy International’s analysis found, but it enables MIA Fem to suggest articles to app users. Those articles — which are tailored to a user’s selected interests — are shared with Facebook. It also shared “reminders” within the app to take birth control medication with Facebook.
The apps’ behavior raises questions about how much users can knowingly consent to such private information being shared with outside companies like Facebook — especially when apps have lengthy terms of service that few users bother to read.
“This is the kind of practice that highlights how consent isn’t a sufficient guardrail against privacy violations,” said Lindsey Barrett, a staff attorney at Georgetown Law’s Intellectual Property Rights tech clinic. “No one reads privacy policies because they encounter too many of them for that to be reasonable, and even if they did, the policies are poorly written or won’t tell them what they need to know.”
“It can be embarrassing or foster low-self esteem to be barraged with targeted ads for acne medication, but how is facebook letting advertisers target people based on what information those apps glean on their contraception?” she said. “Who else is Facebook sharing that information with? There’s a dignity issue but there’s also a discrimination issue, all of which come into play when we’re talking about why individual privacy rights are important.”
Chandana Hiran, a 22-year-old former Maya user who lives in Mumbai, said she liked the app because it made it easy to track symptoms like cramps and irritability associated with her period, and for its graphic interface. But she had never thought about it from a privacy perspective.