The top heart-rate app for iOS, Instant Heart Rate sent users' heart rates to Facebook.
Facebook said in a statement it would assist NY officials in their probe, but noted that the WSJ's report focused on how other apps use people's data to create ads. Developers can set up "custom app events", which can be used for ad targeting. The company told the WSJ developers have to make it clear to users what data they're handing Facebook, and that some of the reported information-sharing practices seem to violate its terms.
"Sharing information across apps on your iPhone or Android device is how mobile advertising works and is industry standard practice", Facebook said in a statement to CNBC.
One of Flo's users, a woman who began using the app past year, told The Wall Street Journal she may delete the app over concerns about data privacy.
A Facebook spokesperson tells the Journal that it automatically deletes any sensitive data it receives from third-party apps, such as social security numbers, and that no "custom app event" data is ever used for Facebook's own internal purposes. Facebook's SDK includes an analytics service that helps app developers understand its users' trends.
She added, "We also take steps to detect and remove data that should not be shared with us". We require app developers to be clear with their users about the information they are sharing with us, and we prohibit app developers from sending us sensitive data.
Facebook did not immediately respond to a request for comment.
Following the report, New York Gov. Andrew Cuomo directed the New York Department of State and Department of Financial Services to investigate Facebook for what he called an "invasion of consumer privacy" in a statement.
Facebook had also considered collecting health information in the past, when it asked major USA hospitals to share anonymized data about their patients, as CNBC reported in April, though Facebook said the project had not moved past the planning stage at the time.