Cybersecurity Policy Report, Health App Data Breach Guidance Withdrawn by FTC, (Sep 10, 2026)

By Tony Foley

The Federal Trade Commission has rescinded guidance regarding the application of its Health Breach Notification Rule (HBNR) to health and fitness apps that the agency said was obsolete.

The original policy statement, from September 2021, affirmed the FTC’s position that health apps and connected devices that collected or used consumers’ health information must comply with the HBNR (CPR, Sept. 16, 2021).

In its announcement of the recission yesterday, the FTC noted that, in 2024, it updated the Health Breach Notification Rule to cover these devices, rendering the policy statement unnecessary. The rescission of policy statement from the agency adds that the action advances the Trump administration’s deregulatory agenda and its own policy of avoiding unnecessary use of sub-regulatory guidance.

News: FederalLegislation DataSecurity DataBreach