Key Findings
- All 14 popular Android baby trackers in a 2026 code audit were built to share data with third parties, and 10 switched on the advertising ID by default [1].
- In 8 of those 14 apps, the store privacy label did not match the code or the privacy policy [1].
- Baby apps have leaked photos and logs through open databases and APIs, and connected monitors have a long record of security flaws [2,3,4].
- In the US, an infant's data in a tracker filled in by a parent most likely sits outside both HIPAA and COPPA [5,6].
- Apps without ads or an advertising ID were the more privacy-friendly ones in the audit [1].
Introduction
Parents log a great deal about a newborn: every feed, every nap, every diaper, weight and length, illnesses, photos and, in apps that start in pregnancy, due dates and pregnancy loss. Baby tracking apps and connected baby monitors turn that log into a health record of a person who cannot read a privacy policy or agree to one.
This review asks a single question: are there privacy concerns with baby trackers, and how strong is the evidence for them? It covers four kinds of evidence: independent audits of what the apps do with data, breaches and regulator actions, the security record of connected monitors, and the laws that apply. It ends with what the evidence says lowers the risk.
Methods
We searched for audits, peer-reviewed and academic studies, regulator decisions, court reporting, security research and news reports published up to 27 October 2026, in four strands run in parallel: incidents and audits of baby and pregnancy apps; connected baby hardware; law in the United States, the European Union and the United Kingdom; and parent attitudes and safeguards. Primary sources were preferred: the audit itself over coverage of it, a regulator's own release over a law firm's summary of it.
Every factual claim was then checked against its source on 27 October 2026, in a separate pass that read each cited page: 81 claims across 61 sources. Claims the source did not support were removed. Claims the source supported only in part were reworded to what the source says. Pages that could not be opened were replaced with another source carrying the same fact, or the claim was dropped. Allegations in settled regulator complaints are reported as allegations. Of the 61 sources checked, 56 remain: the others were dropped with the claims they carried or replaced with a better source.
This is a narrative review, not a systematic one: there was no fixed search string, database list or screening protocol. Sources were found through general web search and then read on the journal's, regulator's, court's or publisher's own site. The search, the notes, the draft and the claim-by-claim check were done with AI research tools, and the report was read by Cutiko before publication.
References are classified by source type to help readers assess their relevance and evidentiary strength. Primary research, official records, and original security investigations are prioritized where available.
Results
Every app in the leading audit was built to share data with third parties
The strongest evidence is a static code audit of 14 popular Android baby tracking apps, published in February 2026 in the peer-reviewed journal Internet Policy Review by researchers at York University, Canada [1]. The sample took apps with at least one million downloads in the EU and UK Google Play stores, and AI-driven apps with at least 10,000. It included BabyCentre, What to Expect, Huckleberry, Glow Baby, Baby Daybook and Baby Tracker by NighP.
- All 14 apps contained third-party data-sharing mechanisms, covering data that included due dates and pregnancy loss [1].
- 10 of 14 (71%) had the advertising ID switched on by default [1].
- 8 of 14 (57%) showed clear discrepancies between their store privacy labels, their privacy policies and their code [1].
- None had taken Google Play's Families Policy into account, and six collected device identifiers that policy forbids [1].
The audit read each app's code, its privacy policy and its store label; it did not capture network traffic [1]. "Shared" here means the app is built and declared to send data to third parties, through the SDKs in its code. It shows what each app is set up to do, not exactly what each one sent in everyday use.
The worst cases were free, ad-funded apps. Baby Tracker by NighP runs ten SDKs, all collecting data from the moment the app is launched, and is among four apps sending data to advertising networks in China and India. Baby Care (Wachanga) shares the advertising ID with five SDKs, including Russia's Yandex. Onoco and Baby Time mention no third-party sharing in their labels or policies, yet their code talks to Google and Facebook [1]. BabyCentre and What to Expect, both owned by Ziff Davis, disclose sharing "consumer health data" with advertisers, and What to Expect's code holds labels for miscarriage, stillbirth and child loss [1]. Glow Baby, Huckleberry and Baby Care use the data for their own AI model development, with few ways to opt out [1].
A second, self-reported view points the same way. Surfshark's May 2026 review of the Google Play data safety declarations of 10 popular pregnancy and baby apps found that 8 of 10 share user data with third parties, often for targeted advertising. BabyCenter collects 16 data types and shares every one, and 8 of the 10 apps collect photos [7]. Because more than half of the labels in the code audit did not match the code [1], self-declared figures like these are best read as a floor.
Encryption in transit does not address every privacy risk. Consumer Reports' 2024 test of six baby tracking apps found all of them met modern network encryption standards, but said all "could stand to improve" on privacy and security [8]. Huckleberry's App Store label lists usage data that "may be used to track you" across other companies' apps and websites [9]. In these apps, much of the exposure lies in what the company does with the data once it arrives.
Parents say they care but rarely check. In a 2022 Harris Poll of US parents for Pixalate, 80% worried about their children's privacy in apps, yet 21% never check whether an app tracks their child's location [10]. An Oxford study of 220 parents, mostly in the UK, found they choose children's apps on content and function rather than on the personal data collected [11]. No survey has measured baby tracking app users in particular.
Breaches reach baby apps; fines so far land on pregnancy apps
The clearest breach of a baby app is Peekaboo Moments, a baby journal. In January 2020 an open database of about 70 million log files exposed baby photos and videos, birth dates and around 800,000 email addresses; the developer did not respond to the researcher who found it [2].
Glow, which also makes Glow Baby, has a run of incidents. In 2016 Consumer Reports found that anyone who knew a user's email address could link their account to hers [12], exposing data about sex lives, miscarriages and abortions [13]. In 2020 California's attorney general settled with Glow for a $250,000 civil penalty [14]. In October 2023 a bug in a developer API exposed names, locations and uploaded images of around 25 million Glow users, fixed about a week after it was reported [15]. In November 2024 What to Expect's password reset relied on a six-digit code with no limit on attempts, allowing full account takeover, and the developer gave no response [16,17].
Enforcement has targeted deliberate sharing. The FTC alleged that Flo Health disclosed health information, such as the fact of a user's pregnancy, to third parties including Facebook and Google, despite promising privacy; Flo settled [18]. In August 2025 a federal jury found that Meta violated the California Invasion of Privacy Act by collecting Flo users' answers through its SDK [19], after Flo, Google and Flurry settled the same lawsuit for a combined $59.5 million [20]. A proposed FTC order barred the fertility app Premom from sharing health data for advertising, with a $100,000 civil penalty, over data shared with third parties including two Chinese analytics firms [21].
UK cases show what data on new mothers and babies is worth. The Information Commissioner's Office fined the parenting club Bounty £400,000 for sharing over 34 million records with 39 organisations, including Acxiom and Equifax [22]. Emma's Diary was fined £140,000 for selling data on more than a million new mothers to Experian, which the Labour Party used to mail new mothers in marginal seats before the 2017 general election [23]. This review found no regulator fine against a baby tracking app itself, which reflects where enforcers have looked as much as any clean record.
Connected monitors show a decade of security failures
Smart cameras, socks and bassinets send video, audio and vital signs off the home network, and their security record has no clean stretch. Rapid7's 2015 test of nine baby monitors gave eight an F and one a D, citing hidden and hard-coded credentials and unencrypted video streams [3]. Bitdefender showed in 2020 that the iBaby M6S let an attacker stream video and download any stored clip, after trying to reach the company since May 2019 [24,25]. In 2021 it found a remote code execution flaw rated 9.6 out of 10 and a cloud storage bucket without access control behind Victure cameras, on more than 4 million devices [26,27]. Premium brands are not exempt: the Owlet Cam carried flaws in ThroughTek's Kalay SDK, used on more than 100 million devices, that let a user run commands as root, until ThroughTek patched the SDK in April 2024 [28].
The failures have moved from single devices to shared backends. In May 2026 a researcher extracted a single key from an app that gave access to devices in 118 countries on Meari Technology's platform [29], which supports more than 300 white-label camera brands sold on Amazon [30]. Consumer Reports said as many as 1.1 million Wi-Fi baby monitors and cameras were susceptible, with video feeds, stored photos, email addresses and location data easily accessible, and no recall or safety warning issued [4]. That is the number of devices that could be reached, not a count of devices attacked: no report has shown the flaw being used by anyone other than the researcher. Meari said the main issue has been resolved, but owners stay at risk until their device runs firmware 3.0.0 or later, and it is unclear whether every device can be updated [4]. A parent cannot tell from the box which backend a cheap monitor uses.
Outsiders are not the only risk. The FTC alleged that Ring gave employees broad access to customers' videos and that one employee viewed thousands of recordings belonging to female users [31], at least 81 of them according to the complaint [32]. Reused passwords are another route: in a 2019 case where a stranger spoke to a girl through a Ring camera in her bedroom, the company pointed to credentials reused across accounts [33].
Cloud dependence also means a company's fate decides what a family keeps. Miku filed for bankruptcy in August 2023 [34]; under new ownership, breathing monitoring moved behind a $10 monthly fee, and a mother who had paid about $700 for the monitor said "the videos we had from when she was a newborn are gone too" [35]. In 2024 Happiest Baby began charging $20 a month for premium Snoo features, including the sleep log [36]. Policies widen the reach: Owlet's July 2026 privacy policy says it may use customer data to "develop and train artificial intelligence and machine learning models" [37], and in 2017 Nanit kept data to improve its machine learning with no way for users to opt out [38].
Legal protections leave important gaps for infant data
Infants have legal protections, but they are uneven. In the United States, baby data falls between the main frameworks. HIPAA guidance says an app that serves consumers directly and collects information for them is "not likely to be subject to HIPAA" [5]. COPPA, whose amended rule required compliance from April 2026, governs personal information collected from children under 13 [6]; a tracker filled in by an adult about an infant most likely sits outside it. No ruling confirms that, but the structure of the rule points there.
The closest federal tool is the FTC's Health Breach Notification Rule, expanded in 2024 and in force since 29 July 2024 [39]. It applies to vendors of personal health records: services holding identifiable health information that have the technical capacity to draw information from multiple sources, such as a diet app where users enter their daily weight [40]. Sharing that information without the person's authorization, for example with an ad network along with mobile identifiers, counts as a breach that must be notified [40]. The rule does not reach every baby tracker automatically: whether a given app is covered depends on whether it meets these definitions. No case has been brought against a baby tracker under it. Of the two commissioners who dissented on the rule, Andrew Ferguson now chairs the FTC; Melissa Holyoak left in November 2025 [41].
State laws do more but reach fewer people. Washington's My Health My Data Act gives individuals a right to sue and drew its first class action, against Amazon's SDK, in February 2025 [42]. Connecticut's 2025 amendments extend its privacy law to any entity that processes sensitive data, from July 2026 [43]. New York's broader health privacy bill was vetoed in December 2025 [44]. The 2024 HIPAA rule on reproductive health records was mostly vacated in June 2025 [45], and as HIPAA guidance shows, it would not have reached consumer apps in any case [5].
Europe is stricter. Health data is special category data under the GDPR, and the UK regulator tells organisations it is "up to you, not the child" to protect a child's interests [46]. Recital 65 lets a person demand erasure of data given while a child, even once they are no longer a child [47]. US state privacy laws give their rights to the parent as the consumer, and this review found no US equivalent of Recital 65 for the grown child.
That matters because the data outlives its purpose. When 23andMe went bankrupt, 27 states and the District of Columbia sued, arguing that each customer's express, informed consent was needed before their genetic data could be sold [48]; a court approved the sale to a nonprofit led by the company's founder [49]. A database of infant health histories is the same kind of asset.
For hardware, the UK banned guessable default passwords on connected products, baby monitors included, from April 2024 [50], and the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities from 11 September 2026 [51]. Products sold in the US still have no mandatory security baseline [4].
Summary of the evidence
| Risk | Where it is worst | Strongest evidence |
|---|---|---|
| Sharing with ad and analytics SDKs | Free, ad-funded and media-owned apps | 14 of 14 apps built to share data (code audit); 71% have the ad ID on by default [1] |
| Privacy labels that do not match the code | Across the category | 8 of 14 apps [1] |
| Breach of photos and logs | Developers with open databases or APIs | Peekaboo Moments, Glow [2,15] |
| Exposure of live video | Budget Wi-Fi cameras on shared backends | Up to 1.1 million Meari devices found vulnerable [4] |
| Loss or sale of data when a company changes hands | Cloud-dependent products | Miku [35]; 23andMe [48] |
| AI training on family data | Apps and monitors with AI features | Glow Baby, Huckleberry, Baby Care [1]; Owlet [37] |
What lowers the risk
Business models can reveal privacy risks that app-store labels do not. The auditors named Baby Daybook, Baby+ and Baby Tracker (Amila) as more privacy-friendly; they are three of the four apps in the sample that did not switch on the advertising ID by default [1]. Some small apps go further. Buggy needs no account, keeps baby logs off the cloud and declares no data collected [52]. Baby Journal encrypts family data with keys stored only on the devices of the people in the family, so its operator cannot read it [53]. Neither claim has been independently audited.
The trade-off is real. Data kept only on one phone is hard to share between two parents and a grandparent, and end-to-end encryption rules out features computed on a server. Paid plans are no guarantee either: Huckleberry, which sells them, still declares data used to track you [9].
Photos need their own care. A photo taken at home can carry GPS coordinates in its metadata [54]. Human Rights Watch found photos of 362 Australian and 358 Brazilian children in an AI training dataset, taken without consent [55], some from an unlisted video that did not show up in search [56], and AI models trained on them cannot forget them [55].
Discussion
The core problem is structural, not accidental. The person whose health record is being built cannot consent; the person who consents is treated as the only user; and advertising-supported business models can incentivize the third-party data flows identified in the audit. Together these practices can exploit gaps in children's privacy protections and raise questions about how platform policies apply to apps used by parents to record children's data.
For parents choosing a tracker, the evidence points to a short list of checks. Those with a citation follow from the reviewed sources; export, deletion and caregiver access are our own recommendation, not a finding of any study:
- No ads and no advertising ID. Ad SDKs are the main route data leaves the app [1].
- Read both the store label and the privacy policy. They disagreed in more than half the apps audited, and words like "may be shared" are a warning [1].
- No AI training on family data without an opt-in, and a clear answer on whether it happens [1,37].
- Export and real deletion, so the record can leave with the family, and caregiver access by invitation that can be taken back.
- Location stripped from photos before they are shared [54].
- For cameras, a unique password and two-step sign-in, since reused passwords are a known way in [33].
The open question is where enforcement lands next. The FTC's breach rule and the Flo verdict both describe a baby tracking app that sends health logs to advertising SDKs [40,19], but no one has yet brought that case against one.
Limitations
The main audit is a static analysis of Android apps; it did not capture what crossed the network, and iPhone apps may behave differently [1]. The Surfshark figures rest on self-declared labels. No survey has measured baby tracking app users specifically, and this review found no case in which baby tracking data was demanded by police or a court. Some regulator pages are no longer online, so the Bounty and Emma's Diary fines rest on news reports. A few sources were paywalled or blocked automated reading; where that happened, the claim was confirmed through a second source or removed. Vendor pages describe each company's own practice and have not been audited. Several legal developments (state laws, the HIPAA ruling, the EU reporting date) are cited from law-firm and policy-group summaries rather than the legal texts themselves. Cutiko's own app was not audited as part of this review.
Conclusions
Yes, there are privacy concerns with baby trackers, and they are documented rather than hypothetical. The largest risk is ordinary business practice: every app in the leading audit was built to share data with third parties, most switched on the advertising ID by default, and more than half had labels that did not match the code. Breaches and monitor vulnerabilities add to it, and US law leaves important gaps in protection for the infant's own data. Data a company never collects cannot be breached, sold in a bankruptcy, subpoenaed or locked behind a subscription later.