Millions of parents across Europe use mobile baby-tracking applications. These digital aides generate intimate data sets by accessing sensitive information about (un)born babies, pregnancies, and family caregiving routines. Crucially, the tracking infrastructures embedded in these apps enable what we call extraction-by-design, whereby routine caregiving inputs are captured, standardised, and repurposed for behavioural profiling and monetisation within an opaque digital economy. We ask: (i) How do baby-tracking apps extract and circulate sensitive health data? (ii) How do tracking infrastructures enable behavioural profiling and monetisation? and (iii) What data governance interventions are needed to strengthen the current regulatory environment? We conducted a mixed-method audit of 14 of the most downloaded Android baby-tracking apps. We combine a manifest data audit (qualitative analysis of app manifests using large language models), reviews of privacy policies and data safety agreements, and walkthroughs of app interfaces to assess how data is collected, processed, and shared. All 14 apps shared data with third parties, including sensitive due dates and pregnancy loss data. Many also transmitted identifiers across borders, often without meaningful consent. We conclude by arguing for policy interventions that treat (infant) data privacy as a matter of collective public interest, including clear limitations on inference-based profiling.
Pybus et al. (Sun,) studied this question.