Natural Cycles, a popular fertility app used by millions of women worldwide, is facing a federal class action lawsuit over allegations that it mishandled reproductive health data by sharing sensitive information with a third-party analytics company without adequate user consent. The lawsuit, filed in December 2025 as S.A. et al v. NaturalCycles USA Corporation in the Northern District of California (Case No. 3:2025cv10421), centers on claims that the Swedish company transmitted users’ menstrual cycle data, birth control usage information, and other intimate health details to Mixpanel—a commercial analytics platform—and failed to properly inform users about these third-party data transfers.
The case raises significant privacy concerns about how fertility-tracking apps handle some of the most sensitive personal information women provide, at a time when reproductive health data is increasingly viewed as valuable by marketers and data brokers. This lawsuit arrives amid growing scrutiny of period and fertility app privacy practices. Just months before the Natural Cycles case was filed, a California jury ruled against Meta in August 2025 in a privacy lawsuit involving Flo, another period-tracking app, establishing legal precedent that companies can be held liable for tracking practices involving reproductive health apps. The Natural Cycles case is currently in class certification proceedings, with no settlement reached yet, though significant legal developments are anticipated in the second half of 2026. The case does not focus solely on data sharing—it also includes allegations of false advertising regarding the app’s effectiveness as a contraceptive method, claims that contradict marketing promises made to women who relied on Natural Cycles to prevent pregnancy.
Table of Contents
- How Did Natural Cycles Share User Data Without Clear Consent?
- What Are the Specific Types of Reproductive Data at Risk?
- False Advertising Claims About Contraceptive Effectiveness
- How Does the Meta-Flo Precedent Strengthen the Natural Cycles Case?
- What Legal Standards Apply to Health Data Privacy?
- Natural Cycles’ Company Response and the Company Defense
- What to Expect in the Coming Months and Years
- Conclusion
How Did Natural Cycles Share User Data Without Clear Consent?
The core of the lawsuit centers on Natural Cycles’ relationship with Mixpanel, a software analytics company that collects and processes data to track user behavior and app functionality. According to the lawsuit, Natural Cycles transmitted intimate reproductive health information—including menstrual cycle patterns, birth control usage, and other sensitive health markers—to Mixpanel for analytics and data management purposes without obtaining explicit, informed consent from users first. The company allegedly did not adequately disclose to users that their reproductive health data would be shared with a third-party commercial entity or explain how Mixpanel would use, store, or potentially monetize that information. Natural Cycles has responded to these allegations by arguing that Mixpanel is a legitimate “database and account management service provider” that helps the app function properly—handling routine tasks like account management, troubleshooting, and system performance monitoring.
The company states that data shared with Mixpanel is not used for advertising purposes or sold to other parties, but rather serves internal operational needs. However, the lawsuit challenges whether users truly understood or agreed to this data sharing arrangement. Many women who downloaded and used Natural Cycles were likely focused on the app’s stated purpose—tracking fertility and preventing pregnancy—and may not have closely reviewed privacy policies or understood the technical details of which third parties had access to their sensitive information. The distinction matters because federal privacy laws and California’s consumer protection statutes generally require companies to obtain meaningful consent before sharing personal health data with third parties, particularly when data is transferred to commercial analytics firms. Simply burying this information in a lengthy privacy policy may not meet the legal standard of “informed consent,” which is why the class action lawsuit is proceeding despite Natural Cycles’ explanation of Mixpanel’s operational role.
What Are the Specific Types of Reproductive Data at Risk?
Natural Cycles users shared extraordinarily sensitive information with the app as part of normal use. The application collects detailed menstrual cycle data, tracking the exact dates of menstruation, ovulation predictions, and cycle patterns over months and years. Users also input information about their use of hormonal or non-hormonal birth control methods, whether they take fertility-related medications, and their intentions regarding pregnancy. Some users may have logged additional health information like sexual activity, mood, cervical fluid consistency, or basal body temperature—all of which provide a comprehensive map of a woman’s reproductive and sexual life. When this data was transmitted to Mixpanel, it became part of a commercial database managed by a third party.
This poses real risks that extend beyond the immediate privacy concern. Reproductive health data is particularly vulnerable to misuse because it can reveal deeply personal lifestyle choices, contraceptive decisions, fertility struggles, and intentions around family planning. If such data were ever breached, sold to third parties, or accessed without authorization, it could be used for targeting women with unwanted marketing, sold to employers or insurers who might discriminate based on reproductive choices, or used to identify women for other purposes. One limitation of the current lawsuit is that it focuses on data sharing that was alleged to occur without consent, but does not address whether Mixpanel’s systems experienced data breaches or whether reproductive data was actually sold or misused beyond the initial sharing—though the threat of such misuse is itself a harm that law recognizes. The specific reproductive health data at issue distinguishes this case from typical app privacy violations involving location tracking or browsing history. Reproductive choices are deeply personal, often connected to religious or cultural beliefs, financial circumstances, and family planning decisions that users typically guard closely.
False Advertising Claims About Contraceptive Effectiveness
Beyond the data privacy allegations, the Natural Cycles lawsuit also includes claims that the company falsely advertised the app’s effectiveness as a contraceptive method. The lawsuit asserts that Natural Cycles promoted the app as highly reliable for pregnancy prevention but that real-world failure rates significantly exceeded the effectiveness claims made in marketing materials and promotional content. This claim echoes historical problems with the company’s advertising practices. In 2017, the U.K. Advertising Standards Authority ruled that Natural Cycles’ Facebook advertisements claiming the app was “highly accurate” at preventing pregnancy were misleading and violated advertising standards. The regulator found that the marketing claims were not adequately supported by scientific evidence and could mislead women into using the app without understanding its actual failure rates.
Fast forward to 2018, when a Swedish hospital reported that 37 women who had used Natural Cycles as their primary method of contraception sought abortions after experiencing unintended pregnancies. While no contraceptive method is 100 percent effective, the gap between marketed reliability and real-world outcomes raised serious questions about whether women understood the actual risks involved in using the app. The false advertising allegations in the current lawsuit build on this history, asserting that Natural Cycles continued to overstate contraceptive effectiveness even after the 2017 regulatory action in the U.K. and the 2018 hospital incident in Sweden. For women who chose Natural Cycles over other contraceptive methods based on company claims about effectiveness, an unintended pregnancy resulting from app failure represents both a serious personal and financial consequence. This claim also highlights a key difference between app-based contraception and other methods: women using an app must make daily decisions about relying on the algorithm’s predictions, and false claims about accuracy directly undermine informed consent to that level of risk.
How Does the Meta-Flo Precedent Strengthen the Natural Cycles Case?
The August 2025 ruling in California against Meta for its involvement with the Flo period-tracking app provides significant legal tailwind for the Natural Cycles lawsuit. In that case, a California jury found Meta liable for tracking practices involving Flo, establishing that companies can face legal consequences for similar privacy violations in the fertility and period-tracking app space. This precedent is directly relevant because it demonstrates that courts are willing to hold major technology companies accountable when they mishandle reproductive health data, and it may influence how judges and juries evaluate the Natural Cycles case. The Meta-Flo ruling also sends a signal about what constitutes liability in this context.
The jury found that tracking practices involving reproductive health apps cross a threshold that warrants legal consequences, even when companies might argue they need data for operational or analytical purposes. This creates a favorable legal landscape for the Natural Cycles plaintiffs, who make similar arguments about unauthorized data sharing. However, there is a key difference worth noting: the Meta case involved advertising-related tracking and targeted marketing, while the Natural Cycles case focuses on data sharing with an analytics platform that the company claims it uses for internal operations. Courts may view operational data sharing differently than advertising-driven tracking, so the precedent strengthens the Natural Cycles case but does not guarantee an identical outcome.
What Legal Standards Apply to Health Data Privacy?
Health data, particularly reproductive health information, receives special legal protection under several federal and state frameworks. HIPAA (the Health Insurance Portability and Accountability Act) protects health information held by healthcare providers, health plans, and healthcare clearinghouses, but does not directly cover consumer health apps like Natural Cycles—a gap that has long concerned privacy advocates. However, California’s consumer protection laws, including the California Consumer Privacy Act (CCPA) and California’s unfair competition statutes, provide broader protections for any personal information collected by companies operating in the state, including health apps.
Under these laws, companies generally must disclose what data they collect, how they use it, and with whom they share it—and they must obtain informed consent before engaging in uses that consumers would not reasonably expect. A woman downloading a fertility app likely expects the company to use her data to provide the app’s services and perhaps to improve the app itself, but sharing menstrual cycle data with a commercial analytics company is not a use most women would reasonably anticipate or expect based on the app’s marketed purpose. One significant limitation of the current legal framework is that it puts the burden on consumers to read and understand privacy policies—yet most users never thoroughly review these documents, making it easy for companies to engage in data sharing that technically complies with disclosure requirements while violating the spirit of informed consent. The Natural Cycles case will test how courts interpret these legal standards when applied to reproductive health data specifically.
Natural Cycles’ Company Response and the Company Defense
Natural Cycles has acknowledged sharing data with Mixpanel but has framed it as a necessary operational arrangement. The company states that Mixpanel functions as a service provider helping with “database and account management” and that the data shared is used for legitimate operational purposes—such as managing user accounts, diagnosing technical issues, and understanding how the app functions. From the company’s perspective, this is routine data processing that any app might perform, no different than a typical business using a software vendor to handle backend operations.
However, the lawsuit challenges this framing by questioning whether users actually understood and consented to this arrangement. Even if data sharing is described in a privacy policy, the critical legal question is whether the description was clear enough and prominent enough that users meaningfully consented. For a highly technical term like “database and account management service provider,” many ordinary users would not understand what data sharing actually occurs or what risks it entails. The company’s defense also does not address the broader issue of why Mixpanel, specifically, requires access to detailed reproductive health data to perform routine account management—or whether the data sharing was as minimal as necessary to achieve those operational goals.
What to Expect in the Coming Months and Years
The Natural Cycles lawsuit is currently in class certification proceedings, a critical stage where the court will determine whether the case can proceed as a class action on behalf of all affected users, or whether claims must be pursued individually. The court must find that the plaintiffs’ claims are typical of the broader class, that class members share common issues, and that a class action is the superior method for resolving the claims. This procedural stage will likely be resolved by late 2026 or early 2027, after which the case would either settle, proceed to trial, or be dismissed.
Significant legal developments are anticipated in the second half of 2026, according to current litigation timelines. No settlement amount or compensation figures have been announced, and Natural Cycles has not admitted liability or agreed to any settlement terms. The company continues to defend against the allegations, though the Meta-Flo precedent and the growing scrutiny of fertility app privacy practices may increase pressure toward settlement discussions. For affected users, the outcome of this case could determine whether Natural Cycles is required to compensate users whose data was shared without adequate consent, and it may force the company to implement stronger privacy protections going forward.
Conclusion
The Natural Cycles class action lawsuit represents a pivotal moment in the regulation of fertility and reproductive health apps. The case challenges both the privacy practices of app companies and the false advertising of contraceptive effectiveness, two issues that directly affect women’s health decisions and personal autonomy. The allegations that Natural Cycles shared menstrual cycle data and birth control information with Mixpanel without clear user consent raise fundamental questions about what “consent” means in the context of complex app privacy policies and whether companies can fulfill their legal obligations simply by disclosing data practices in fine print.
If the plaintiffs prevail in this case, it will establish important legal precedent requiring fertility app companies to obtain explicit, informed consent before sharing reproductive health data with third parties and could result in compensation for affected users. Even if the case settles without a full legal determination, it will likely pressure Natural Cycles and other fertility apps to strengthen privacy protections and clarify data-sharing practices. Women who used Natural Cycles should monitor the case’s progress and consider whether they meet the criteria for class membership—typically defined as anyone who used the app during the relevant time period. As this case develops, it will illuminate the gap between what privacy policies say and what users actually understand about where their most intimate health information travels.