FTC Rescinds 2021 Health App Data Breach Policy

The Federal Trade Commission has rescinded a 2021 policy statement that had broadened the scope of federal breach notification requirements for makers of health apps, wearables and other connected devices. The agency described the guidance as outdated and unnecessary, marking the latest move by regulators to pare back Biden-era interpretations of consumer protection law.

The withdrawn document, issued under the FTC’s Health Breach Notification Rule, had asserted that companies offering health-related applications and connected devices were subject to breach reporting obligations even if they were not traditional health care providers or insurers covered by federal medical privacy law. That interpretation applied to a wide range of products, including fitness trackers, period-tracking apps, and other consumer wellness technology that collect sensitive personal health information but fall outside the Health Insurance Portability and Accountability Act, commonly known as HIPAA.

In announcing the rescission, the commission characterized the 2021 statement as an unnecessary layer of guidance that no longer served a useful regulatory purpose. The agency did not detail specific enforcement actions tied to the reversal, and the underlying Health Breach Notification Rule itself remains in effect. The move instead removes the commission’s expanded interpretive stance on how that rule applies to the fast-growing digital health sector.

The announcement comes amid a broader push by the current FTC leadership to reassess and, in some cases, unwind policy statements adopted during the previous administration. Agency officials have argued that some guidance documents issued in recent years exceeded what was necessary to enforce existing statutes, prompting a review of older interpretive materials across multiple areas of consumer protection and antitrust policy.

The digital health industry has expanded rapidly over the past decade, with millions of consumers using smartphone apps and wearable devices to track everything from heart rates and sleep patterns to reproductive health and mental wellness. Because many of these products are offered directly to consumers rather than through licensed medical providers, they typically fall outside HIPAA’s protections, leaving the FTC’s breach notification rule as one of the few federal tools specifically aimed at safeguarding this category of sensitive data.

Consumer advocates have long raised concerns that gaps in federal privacy law leave health app users vulnerable, particularly after several high-profile incidents in which companies shared or sold user health data without adequate disclosure. The 2021 policy statement had been viewed by some privacy groups as a way to close part of that gap by holding non-traditional health companies to breach reporting standards similar to those imposed on regulated medical entities. Industry groups, meanwhile, had argued the interpretation was overly broad and created compliance uncertainty for technology firms that do not consider themselves health care companies in the traditional sense.

Legal and compliance experts say the rescission is likely to prompt digital health companies to revisit their internal breach response protocols, even though the core notification rule remains on the books. Some caution that removing the interpretive statement could create ambiguity about which types of data incidents trigger reporting obligations, while others contend it simply restores a narrower reading of the rule that existed before 2021.

The FTC has not indicated whether it plans to issue new guidance to replace the withdrawn statement or whether further updates to health data enforcement policy are forthcoming. The commission’s announcement, detailed on its website, was reported by the Federal Trade Commission.

For now, companies operating in the health app and wearable device space are left to navigate a regulatory landscape with one less interpretive marker, even as scrutiny of consumer data practices continues across federal and state agencies.