Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
REGULATORY WATCH BRIEF Moderate 56 🧭 Regulatory Guidance repealed

FTC rescinds 2021 Policy Statement on Breaches by Health Apps and Connected Devices

The FTC's withdrawal of this guidance removes a previously stated compliance expectation for health app and IoT device developers.

ADTP Regulatory Watch · September 9, 2026 · Federal Trade Commission
ImpactModerate 56
Type🧭 Regulatory Guidance
Statusrepealed no longer in force
JurisdictionUS
Effective9 September 2026

What happened

The Federal Trade Commission announced it is rescinding the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The guidance is deemed obsolete and is being withdrawn. The rescission was published on 2026-09-09.

Why it matters for trust and compliance

  • Its status is repealed. It no longer applies.
  • The FTC's withdrawal of this guidance removes a previously stated compliance expectation for health app and IoT device developers.
  • Takes effect September 9, 2026.

Who is affected

healthcare technology controller processor developer

Recommended actions

  1. Check that privacy notices describe the practices this addresses.
  2. Map the security requirements to existing controls and close gaps.
  3. Check breach-notification procedures and timelines against the requirement.
  4. Confirm handling of sensitive data categories meets the stricter rules.