Meta — owner of Facebook, Instagram and WhatsApp — illegally accessed the data of people who used the period-tracking app Flo, and did so without their consent, a federal jury ruled. The health app has been the focus of other privacy concerns, having settled with the Federal Trade Commission for sharing users’ information with third parties.
The California jury found Meta guilty in a class action lawsuit filed by Erica Frasco against the social media company, Flo and Google for sharing health data she entered into the women’s app, according to Frasco’s co-counsel. Lawyers at the Labaton Keller Sucharow firm celebrated the decision as a historic victory in holding tech companies accountable for securing people’s data.
Download the SAN app today to stay up-to-date with Unbiased. Straight Facts™.
Point phone camera here
Big Tech profiting from user data
Several other women joined the lawsuit with similar claims and testified about the data they entered in the app, which was later shared with other companies from June 2016 to February 2019.
Upon downloading and creating an account on Flo, users give the app personally identifiable information, their sexual health, menstruation cycles, gynecological health and physical wellbeing in surveys, according to court papers.
“Companies like Meta that covertly profit from users’ most intimate information must be held accountable,” attorneys Michael Canty and Carol Villegas said in a joint statement Monday. “Today’s outcome reinforces the fundamental right to privacy—especially when it comes to sensitive health data.”
The lawsuit evolved into a class action case after the users said Meta and Google were among the third-party accessors of their health information. Lawyers said in a June court filing that Flo had more than 3 million users from November 2016 to February 2019, according to court papers.
Google and Flo reached separate settlements in the lawsuit, Meta fought for a jury trial, Frasco’s lawyers said.
Meta spokesperson Chris Sgro told news site San Francisco Gate (SFGate) that the company disagrees with the verdict and is “exploring all legal options,” according to the website.
Flo developers settled with the Federal Trade Commission over allegations that it misled users about disclosures of their health data. Former FTC Chair Lina Khan, whom former President Joe Biden appointed in 2021, often targeted tech companies in her tenure at the commission for privacy, antitrust and other violations. Chair Andrew Ferguson, another Biden appointee, succeeded Khan in February.
Meta used data for ads
Lawyers presented evidence to the court, showing that Meta’s internal communications and technical documents indicated the company was aware it had received confidential health information from Flo. The submitted evidence included messages where employees allegedly mocked how the data was collected, Frasco’s attorneys said.
Some of the personal data included answers about whether a person feels pain during sex, sexual activity and relationship status, according to the class action complaint. Flo used the answers to predict ovulation dates and other suggestions that help a person take control of their health.
The lawsuit followed a 2019 Wall Street Journal investigation, which revealed that numerous apps illicitly shared users’ data with Facebook, the Journal learned through tests. People didn’t need to have a Facebook account for their information to be shared with the social media giant.
Facebook acquired the data through an analytics tool called App Events — the same tool named in Frasco’s lawsuit — that allowed software developers to record people’s activity and report it to Facebook. The WSJ learned Flo told Facebook when a user started their period or when they signalled intentions to get pregnant.
It wasn’t limited to Flo. Heart rate monitoring app Instant Heart Rate told Facebook a person’s heart rate immediately after it recorded. Real estate app Realtor.com shared the location and prices of listings a user viewed and which were marked as favorites. Neither of the apps gave users a way to reject or stop information from being sent to Facebook.
App developers and Facebook told the WSJ about their privacy disclosures, and in Flo’s instance, limited external analytics for a privacy audit.
The FTC filed a complaint against Flo as a result of the WSJ report, alleging that developers failed to keep people’s health data private. The two parties reached a settlement, which barred Flo from misrepresenting data-sharing practices and mandated that they obtain users’ consent before sharing their information.
As for the class action litigation against Meta, Frasco’s lawyers foresee it having a grander impact on how tech companies collect and share people’s data. Attorneys set up a website — PeriodTrackerDataPrivacyLitigation.com — for people who used the Flo app between November 2016 and February 2019 to join the class action lawsuit.
“This case was about more than just data — it was about dignity, trust, and accountability,” Villegas said. “The jury’s decision affirms that no company, no matter how large, is above the law when it comes to protecting consumers’ most intimate information.”
