Period-tracking software applications or ‘menstruapps’ have witnessed a surge in popularity in recent years. At the same time, many of them are a part of the adtech industry, using business models that create revenue by selling users’ personal and intimate data. This exploratory article brings menstruapps into a feminist legal debate. It investigates the supranational European legal standards on intimate and sensitive data processing, particularly the General Data Protection Regulation (GDPR). Scrutinising explicit consent according to GDPR Article 9, this paper, through empirical examples, claims that current legal standards are not enforced. The standards are, furthermore, theoretically insufficient to fully safeguard data subjects’ integrity and autonomy. Instead of abandoning the concept, the article reimagines consent, using a contextual and communicative model where power relations are taken into consideration, building on the feminist concept of freedom to negotiate.