Your Body Is Now a Data Source. Who Owns It?

Your smartwatch knows you're breathing right now. In certain circumstances, that fact alone could be used against you in court.

That's not a hypothetical. It's where we are in 2026.

The Bargain Nobody Read

The pitch was irresistible: track your steps, your sleep, your heart rate, and live better. Millions accepted. Flo, the period-tracking app, now has 48 million users who log their moods, body temperature, ovulation windows, and sexual activity. BetterHelp has over 2 million users who've shared their struggles with depression, intimacy, and medication. Smartwatches sit on the wrists of hundreds of millions globally, logging data points that would have required a full medical workup a decade ago.

What most users didn't read—buried in terms of service few humans have ever finished—was what happened next.

BetterHelp sold its users' most intimate mental health disclosures to Facebook and other ad platforms. The FTC caught up with them in 2022 and imposed $7.8 million in fines. Flo and Premom both settled FTC complaints for sharing reproductive health data—including sexual activity and pregnancy status—with third parties, including companies operating in China, without meaningful user disclosure. A Mozilla Foundation investigation found that most mental health apps fail basic privacy audits. Some suicide prevention services were found to be piping crisis data to Facebook through automated pixel-tracking tools.

The data economy doesn't distinguish between your fitness goals and your most vulnerable moments. If it's collectible, it's valuable. If it's valuable, it's at risk.

When Health Data Becomes Evidence

The stakes escalated sharply after Dobbs v. Jackson Women's Health Organization in 2022. In states where abortion has been criminalized, prosecutors can—and likely will—subpoena health app data as evidence. A missed period combined with weeks of logged nausea doesn't require a confession. The app already told the story.

Some femtech companies responded by localizing data on-device, refusing to log IP addresses, or offering anonymous modes. But as legal experts note, the only truly safe data is data that was never collected. A business model built on data collection has a structural conflict with user protection when the law comes knocking.

Sponsored

Advertise with Us

[email protected]

Sponsored

The problem extends well beyond reproductive health. Researchers have demonstrated that smartwatch data can identify cocaine use and sexual activity. Digital pills—the first FDA-approved version treats schizophrenia—report medication compliance back to doctors and, potentially, parole officers. Smart bandages and implanted cardiac monitors generate continuous streams of physiological data. The body is becoming a sensor array, and the readout is increasingly available to parties far beyond your physician.

The State Was Already Watching

If corporate data harvesting feels invasive, government biometric collection operates at a different scale entirely.

The FBI's Next Generation Identification (NGI) system—billed as the world's largest biometric database—holds voice profiles, palm prints, faceprints, iris scans, tattoo records, fingerprints, and genetic data. Its Combined DNA Index System (CODIS) contains 21.7 million DNA profiles, representing roughly 7% of the entire US population. Many states run parallel databases, sometimes built through legally questionable means. Orange County, California ran a "spit and acquit" program: prosecutors dismissed misdemeanor charges in exchange for a DNA sample—a sample that could later be used in unrelated prosecutions.

New Jersey's case is perhaps the most striking. State law requires a blood sample from every newborn for genetic disease screening—a legitimate public health measure. What most parents don't know is that after testing, the sample is retained for 23 years. State police subpoenaed one such sample to link a newborn's DNA to her father, helping solve a 15-year-old crime. The New Jersey public defender's office sued; legislators are pushing to limit retention to two years. But decades of samples already exist.

Next-generation DNA technology is making collection even easier. Environmental DNA—the genetic material we all shed constantly—can now be collected from surfaces and processed in minutes rather than months, a technology originally developed to identify US soldiers' remains on the battlefield. The same tool that honors the fallen can now track the living.

Face recognition is already operational in American policing. In a routine Manhattan theft case, detectives converted security footage to still images, ran them through the NYPD's face-recognition system, and identified a suspect. The technology worked. The question is what happens when it doesn't—and who bears the cost of a false match.

Three Lenses, Three Verdicts

This isn't a story with a clean villain.

Medical professionals point to genuine life-saving applications. Smart pacemakers, digital medication trackers, and connected bandages that detect early infection represent real advances in patient outcomes. Precision medicine depends on data. Restricting collection doesn't just protect privacy—it also limits care.

Law enforcement has its own coherent argument. DNA databases have exonerated the wrongfully convicted and solved cold cases that would otherwise remain open wounds for victims' families. Face recognition identified a thief when nothing else would have. The tools work. The question is governance, not existence.

Privacy advocates and legal scholars raise the structural concern that data collected for one purpose will inevitably migrate to others. Today's fitness data is tomorrow's insurance underwriting input. Today's mental health record is tomorrow's background check liability. Today's period tracker is tomorrow's prosecution exhibit. The history of data is a history of scope creep—and the people least able to protect themselves are usually the ones most exposed.