Stardust app shares reproductive data with US analytics firm
Period tracker Stardust has been caught sharing sensitive reproductive health data with a US analytics firm, raising significant questions about the regulatory risks of foreign health apps under European privacy laws.
Research by Mozilla has revealed that Stardust, a period-tracking application, is transmitting highly sensitive user health data to RudderStack, a third-party analytics company. The shared information includes birthdates, birth control types, reproductive goals, and specific symptoms. Although the data is linked to a unique identifier rather than a name, regulators like the US Federal Trade Commission have long warned that such identifiers do not actually make the data anonymous or prevent it from being traced back to individuals.
This finding directly contradicts Stardust’s marketing, which prominently features the claim: "Your data is private. Period." It also echoes past controversies, as TechCrunch found in 2022 that the app falsely claimed to use end-to-end encryption. That report came during a surge in Stardust downloads following the US overturning of constitutional abortion rights. Security researcher Shoshana Wodinsky reached the latest conclusions by analyzing the network traffic of six different period trackers, finding that Stardust was the only app transmitting this category of data externally.
Apps frequently share data with third parties for storage, analytics, or payments, but this typically happens as invisible background activity. A Stardust spokesperson told the BBC that RudderStack is "contractually prohibited from selling or using it for its own purposes." However, because both Stardust and RudderStack are US-based companies, the data remains vulnerable to demands from US law enforcement. Stardust founder Rachel Moranis did not respond to requests for comment regarding whether the company has previously received such demands.
For European businesses and investors, these revelations highlight the ongoing compliance chasm between American health technology firms and European data protection standards. Under the GDPR, sharing special category data such as reproductive health requires explicit user consent and rigorous data processing agreements. Health applications that invisibly route sensitive data to analytics firms face substantial regulatory and financial risk in the European market. The inherent vulnerabilities to data breaches or legal demands represent liabilities that institutional investors in Europe are increasingly unwilling to tolerate.
The research ultimately underscores a growing market divergence and an opportunity for privacy-centric alternatives. Mozilla recommended the app Euki as "squeaky clean," noting that its core features keep all user health data strictly on the device. As regulatory scrutiny intensifies across Europe, health applications that fail to keep sensitive data entirely within the user's control will likely face severe commercial headwinds in the continent's digital economy.
