FTC Drops 2021 Health App Notice, Keeps 2024 Rule in Place
The Federal Trade Commission has rescinded a 2021 policy statement that applied its Health Breach Notification Rule to health apps and connected devices such as fitness trackers. The agency says the move does not remove any protection for consumers, because a 2024 update to the underlying rule already covers the same apps and devices directly.
What the FTC actually did
On September 9, 2026, the FTC announced it was withdrawing the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. That statement had been the agency’s way of arguing, through guidance rather than a formal rule change, that its Health Breach Notification Rule reached health apps and connected devices collecting consumer health information. The FTC’s press release calls the 2021 statement “controversial” and says it became unnecessary once the Commission formally updated the Health Breach Notification Rule itself in 2024 to cover health apps and connected devices like fitness trackers.
In other words, the FTC is not reversing the substance of its position. It updated the actual rule in 2024, then removed the older guidance document that had been trying to reach the same result through interpretation.
Why this happened now
The FTC ties the withdrawal to a presidential executive order directing federal agencies to eliminate not just unnecessary rules, but also obsolete guidance documents and policy statements. The FTC’s release quotes the order’s description of such accumulated guidance as contributing to an “ever-expanding morass of complicated Federal regulation” without benefiting consumers. The agency is treating the 2021 statement as exactly this kind of leftover document: guidance whose job was already done by a subsequent, formally adopted rule.
Who this affects
Anyone using a health app, fitness tracker, or other connected device that collects health information is the relevant audience here, since the underlying question is whether a company must notify users if their health data is breached. According to the FTC’s release, that notification obligation continues to apply, because it now sits in the Health Breach Notification Rule itself following the 2024 update, not in the withdrawn 2021 policy statement. Consumers who track things like fitness, sleep, or other health metrics through an app or wearable device are not losing a breach-notification protection as a result of this announcement, based on what the FTC has published.
Companies that build or operate these apps and devices are also affected in a practical, compliance sense. They now have one governing document to consult, the updated rule, rather than a rule plus a separate policy statement layered on top of it.
What readers can check
The FTC’s release does not list specific consumer-facing action steps beyond describing the withdrawal itself. Readers who want to understand their own situation can look at two things directly:
- Whether an app or device they use collects health information and would fall under the FTC’s Health Breach Notification Rule as updated in 2024.
- The FTC’s own consumer protection resources, including the FTC’s announcement and its consumer.ftc.gov guidance, for how breach notification is supposed to work under current rules.
The release also repeats the FTC’s standard fraud-prevention reminder: the FTC itself will never demand money, make threats, tell someone to transfer money, or promise a prize, and suspected fraud or bad business practices can be reported at ReportFraud.ftc.gov.
What did not change
It is worth being precise about what this announcement is and is not. It is the removal of a 2021 guidance document. It is not a rollback of the Health Breach Notification Rule, which the FTC says was updated in 2024 to specifically cover health apps and connected devices like fitness trackers. The FTC’s own characterization is that the 2021 statement was rendered “unnecessary” by that 2024 rule update, not that the underlying consumer protection was eliminated.
Anyone who wants the full text and context of this withdrawal, including the FTC’s reasoning tied to the executive order on regulatory guidance, can read the agency’s press release directly at the link above before deciding whether any follow-up questions about a specific app or device apply to their own situation.
This is a News-lane report. It was drafted automatically from the linked primary source and published after automated checks that every figure appears in that source. It is summarised regulatory news, not evergreen guidance and not financial advice. See our AI content disclosure and disclaimer.
