Sex Toys: Data Tracking 😱 & Privacy 💔

Tech & Science

You download a new app, eager to bypass the sign-in page and the persistent pop-ups urging you to subscribe to the premium version. Just as you’re nearing completion, the app requires agreement to a lengthy privacy policy – a decision many users, including myself, make hastily by clicking “yes.” This increasingly common scenario is particularly relevant in the rapidly expanding electronics sector, as evidenced by research projecting the global sex toy market to reach $80 billion by 2030. App-connected sex toys now represent a significant area of concern, according to Ray Walsh, a digital privacy expert at Comparitech. Walsh’s research indicates that these devices could collect highly sensitive data, including detailed information about sexual behavior – such as which toy is used, the specific functions employed, and usage frequency – as well as data regarding intensity settings, partner connections, location data, and IP addresses. For example, an app facilitating long-distance play between partners would also collect information related to that interaction. Companies collecting this data often claim it’s necessary for product improvement, frequently citing the analysis of usage patterns and preferences.

When used on the highest setting, sex toys can generate stronger vibrations, and companies may leverage this data to develop future products and market new features directly to consumers. “Data collection is used to help the company better tailor any marketing or advertisements it might target you with,” a spokesperson for the sex toy brand Lelo explained. However, this collected data can be sold to data brokers, as Chris Hauk, consumer privacy champion at Pixel Privacy, notes. These brokers can then sell the information to a wide range of parties, including the government, private investigators, advertisers, and other interested parties. Paul Bischoff, a consumer privacy advocate at Comparitech, adds that companies often sell data to brokers to create a secondary revenue stream, allowing brokers to match and package the information with data from other sources for targeted advertising. Each app user’s data is linked to identifiers like an email address, device ID, IP address, or tracking cookie, facilitating its passage through numerous entities. Furthermore, Bischoff emphasizes that opt-out options and notification procedures vary significantly depending on the region, reflecting differing legal requirements across states and other countries.

The California Consumer Privacy Act mandates that businesses disclose whether they sell consumers’ personal information and provides those individuals with the right to opt out. Recognizing concerns about data privacy, I investigated various sex toy apps, noting that you don’t need to purchase a product to download an app. I examined the information these apps requested and whether they sought permission before accessing personal data or components of my phone. Despite laws preventing automatic permission activation, many apps still enable Siri access through the “Learn from this app” feature, as Siri is integrated within Apple’s operating system. While Siri itself doesn’t directly access app content, Bischoff explains that Apple could still be aware of personal usage patterns, such as the frequency and timing of app use. It’s important to note that the California Consumer Privacy Act protects consumers, and there are steps you can take to safeguard your privacy.

The app’s functionality mirrors offerings from other brands, including We-Vibe’s option for guest users. Satisfyer also prioritized transparency with its privacy policy, providing users with the ability to opt out of data collection before proceeding within the app. Furthermore, Satisfyer’s policy was structured for ease of understanding, divided into clear sections and employing straightforward language. When researching sex toys, it’s wise to treat each app with the same scrutiny as a physical product – consult Apple’s App Store, Google Play Store, YouTube reviews, Reddit forums, and the company’s product page for detailed reviews. Users frequently discuss a brand’s honesty regarding data usage intentions. After purchasing a toy or downloading the app, users should carefully toggle off any permissions they are not comfortable granting. To review existing permissions, navigate to your phone’s settings, select “Apps,” choose the app, and examine its access privileges – including camera, Siri, contacts, and GPS access. While disabling these permissions can limit the app’s functionality, it significantly reduces the amount of data it can collect. “Even with permissions toggled off to prevent an app-connected sex toy from accessing device-level features like your camera, microphone, GPS, and contacts,” Walsh explains, “it doesn’t definitively prevent the app from collecting behavioral data.”

Just because an app requests specific permissions doesn’t guarantee that information will be utilized; the privacy policies associated with apps can be lengthy and complex, filled with technical jargon. Cybersecurity expert Katrina Rosseini, of Ascendant Group, advises users to carefully scan these policies for key phrases and words before tapping “OK” to dismiss them. She recommends being cautious of vague language, such as “we may share your data with trusted partners.” Additionally, Walsh suggests looking for specific keywords and phrases, including “no third-party sharing,” “end-to-end encryption,” and “data anonymization.” “End-to-end encryption” indicates that a company employs measures to safeguard user data by ensuring that only the sender and recipient can access the information, while “data anonymization” signifies efforts to remove identifying details that link a user to their data. Rosseini also emphasizes the importance of understanding how long a company retains user data. For example, after downloading the app from sex toy company Lelo and accessing its internal sex advice articles, the app retained a comprehensive history of every click, with no option to clear that history – a record that has persisted since August 2024. When questioned about its data storage practices, Lelo…

The company responded to inquiries about data retention by stating that personal data is retained only for as long as necessary to fulfill the purposes for which it was collected; the specific retention period depends on the type of data and its context. Furthermore, the company clarified that deleting the Satisfyer Connect app does not automatically delete data from its servers. Users seeking to have their data removed from these servers must contact Lelo using the phone number detailed in its privacy policy. Some apps, such as Satisfyer Connect, outline this process – in this case, deleting logs every 60 days. To ensure complete data removal, users should delete their user account, alongside any data stored on the company’s servers. Ultimately, clear and comprehensive policies regarding data intentions are crucial, empowering users to make informed decisions about their app usage.