The Dutch privacy watchdog warns about period apps: what is going on (and what to check yourself)

On 4 August 2026 the Dutch Data Protection Authority (AP) published a striking call: be cautious about what you share with period apps. The regulator notes that nearly a quarter of Dutch women use one, that these apps collect very personal information, and that it is often unclear what happens with that data. An investigation into the sector is not ruled out.

We build a cycle app ourselves. So let us explain exactly what is going on, why this warning is justified, and how you can check how your own app measures up. Including ours.

What the regulator actually says

The core message: cycle data is not ordinary data. When you menstruate, which symptoms you have, when you have sex and whether you want to become pregnant, that is special category data under Article 9 of the GDPR, the most heavily protected category the law knows.

The AP therefore sets three requirements for period app providers:

• Demonstrate why you are allowed to process this data. Processing special category data is prohibited unless a valid exception applies (such as explicit consent).
• Make clear in advance what you do with the data. Not hidden in legal language, but understandable and findable, before someone uses the app.
• Digital resilience. Security must match how sensitive this data is.

Why the warning is justified

The history of this market proves the regulator right. The Norwegian Consumer Council documented in 2020 how ten popular apps, cycle apps among them, together shared data with at least 135 external parties. Since then, privacy organisations have filed several studies and complaints about how health data is shared in this market.

The pattern repeats: apps promise privacy in the app store and do something else in practice. Research by King's College London and UCL found that over a third of the cycle apps studied claimed in the app store not to share data with third parties, while their own privacy policy contradicted that.

How to check your app in five minutes

• Find the sub-processor list. A serious provider publishes who processes data on their behalf. No list to be found? That tells you enough.
• Read the first paragraph of the privacy policy. Understandable language, or legal fog?
• Check the business model. Free with no subscription and no clear source of revenue usually means: you are the product.
• Test deletion. Can you erase your account and everything in it from inside the app?
• Look where your data lives. EU servers mean the GDPR fully applies.

A more detailed version of this checklist is in a cycle app that does not sell your data: how do you actually know?

And PERIOD. itself?

We hold our own app to the same standard, in public. Our privacy policy names the legal basis for each processing activity, our sub-processor page lists every vendor with what they do and do not see, your cycle data lives on servers in Frankfurt, and you delete your account from inside the app. For anyone allergic to legal language there is our privacy policy in plain language.

And honestly: we welcome this. A regulator watching closely is exactly what this market needs. Apps that do things properly have nothing to fear.

Want a cycle app that takes the regulator's three requirements seriously? Download PERIOD. on the App Store or via Google Play. The basics stay free.