Period tracking apps are sending information about women’s sex lives and contraception use to Facebook, according to research by advocacy group Privacy International. The period-tracking apps said to be sharing this data have been downloaded millions of times — the app MIA Fem has clocked more than 2 million downloads, and another app, Maya, has been downloaded more than 5 million times, on Google Play.

Period-trackers are apps used to log period cycles, to prepare for future period cycles, to track health during period cycles, as well as moods and cramps, and to track ovulation if an individual intends to conceive. This also often involves logging when one last had sex and if any contraception was used. Previously this year, the Wall Street Journal reported the period-tracking app Flo had also shared private user health data with Facebook, though the app wasn’t mentioned in this recent report.

Such apps often use Facebook’s Software Development Kit (SDK), which helps developers collect user data to refine and add new features. But, any personal information a user puts into an app built via the SDK may also be accessible to Facebook. The data can then be used by Facebook to show targeted ads to users, which can often feel like a violation of privacy.

“It can be embarrassing or foster low-self esteem to be barraged with targeted ads for acne medication, but how is Facebook letting advertisers target people based on what information those apps glean on their contraception?… Who else is Facebook sharing that information with? There’s a dignity issue but there’s also a discrimination issue, all of which come into play when we’re talking about why individual privacy rights are important,” Lindsey Barrett, a staff attorney at Georgetown Law’s Intellectual Property Rights Tech Clinic, told Buzzfeed News.

Related on The Swaddle:

Period Tracking Apps Are a Contraceptive Gift to a Tech‑Savvy Woman … Or Are They?

Barrett added, “This is the kind of practice that highlights how consent isn’t a sufficient guardrail against privacy violations. No one reads privacy policies because they encounter too many of them for that to be reasonable, and even if they did, the policies are poorly written or won’t tell them what they need to know.”

According to Privacy International, the app MIA Fem shares users’ birth control medication reminders with Facebook. The app asks users about habits like smoking, coffee consumption, and tampon use, and then uses this data to suggest articles to app users. These articles, tailored to user interest, are also shared with Facebook. The app Maya shares data with Facebook before a user agrees to the app’s privacy policy. The app also shares information about when contraception is used, what kind of contraception is used, moods, when a user has had sex, and even shares a diary-like section in which users write personal notes.

While MIA Fem has not responded publicly, Plackal Tech, which owns Maya, told Buzzfeed News in an email that they do not share personally identifiable data or medical data with Facebook. “All data accessed by Maya are also essential to the proper functioning of the product. Predicting information pertaining to menstrual cycles is complex and dependent on thousands of variables,” the company said, side-stepping the issue of data sharing with a platform known to facilitate the manipulation of users’ data against them.

Facebook’s spokespersons also told Buzzfeed News that they have a “lawful basis” and specific systems in place to look for data violations. They also said, “We have begun looking at ways to improve our system and products to detect and filter out more types of potentially sensitive data.”