The consent era arrives for health apps

What's actually shifting

For a decade the working assumption in consumer health software was that data became protected only when a covered entity touched it. Everything else — a symptom search, a supplement order, a mood log — was ordinary consumer data, and ordinary consumer data gets a pixel.

Three forces are closing that gap at once: federal enforcement that treats deceptive privacy promises as an unfair practice, state statutes that define sensitive health data broadly and don't care whether you're a covered entity, and breach-notification rules with a wider reach. The FTC's August intervention on tracking-technology consent is the piece that speaks directly to implementation.

What we found when we looked

We run a network capture on first launch for every app we test. The category median has been three third-party SDKs on launch, and we've flagged apps requesting location permission with no plausible use for it — six of twenty-two sleep apps in our most recent permission audit. Two dropped the request within a week of our email. Four did not.

None of that is unlawful on its face. It is, however, exactly the surface area that this regulatory wave is aimed at, and companies that treated it as a growth-team decision are about to discover it was a legal one.

What you can do now

Open the privacy settings of every health app you use and look for an analytics or advertising toggle — most have one, few advertise it. Then check whether the app offers a real data export and a deletion request that gets acknowledged. In our testing, the presence of a working deletion path is the single best predictor of everything else being handled decently.