THE Federal Trade Commission has withdrawn its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The policy had sought to apply the FTC’s Health Breach Notification Rule to health apps and devices that collect consumer health information. The agency notes that, in 2024, the Health Breach Notification Rule was updated to extend coverage to health apps and connected devices such as fitness trackers, making the earlier policy statement redundant.
The move aligns with an executive order from President Donald J. Trump directing agencies to remove not only unnecessary rules but also obsolete guidance documents and policy statements that add complexity without benefiting consumers. The FTC’s withdrawal effectively ends reliance on the 2021 stance in light of the 2024 rule expansion. The decision is presented as removing an outdated layer of regulation rather than altering current breach notification obligations.
It is not described as altering the Health Breach Notification Rule itself, but rather excising an obsolete policy statement tied to that rule. This serves as a practical step towards streamlining compliance guidance related to health data in connected devices and apps.