Meta illegally collected data from Flo period and pregnancy app, jury finds

A federal jury found on Friday that Meta violated the California Invasion of Privacy Act, the state’s wiretap law, by collecting data from a period-tracker app without user consent.

Plaintiffs in a class-action case proved by a preponderance of evidence that Meta intentionally eavesdropped on and/or recorded conversations using an electronic device, said a verdict form released yesterday in US District Court for the Northern District of California. Plaintiffs also proved that they had a reasonable expectation of privacy and that Meta did not have consent from all parties to eavesdrop on and/or record the conversations, the jury found.

The lawsuit was filed in 2021 against Flo Health, maker of an app for tracking periods, ovulation, and pregnancy. Facebook owner Meta, Google, and app analytics company Flurry were added as defendants later. The plaintiffs settled with Flo Health, Google, and Flurry before the trial, leaving Meta as the only remaining defendant.

The plaintiffs’ trial brief said that “Flo allowed Google and Meta to eavesdrop on users’ private in-app communications” between November 2016 and February 2019. Flo app users had to complete an onboarding survey requiring them “to select a ‘goal’ indicating whether they are pregnant, want to be pregnant, or want to track their period, as well as input other information about their pregnancy or menstrual cycle,” the brief said.

Flo promised not to disclose this information but gave access to Google and Meta “via Custom App Events (CAEs) sent through their respective Software Development Kits (SDKs), incorporated in the Flo App,” the brief said.

“Each of the Defendants had their own purpose for collecting and using Flo user data,” the brief said. “Flo used this information to acquire new app users through advertising and marketing, including advertisements based on Flo App users’ reproductive goals (e.g., getting pregnant). Flo also sold access to the CAEs sent through SDKs to other third parties for profit. Google and Meta separately used the data they intercepted for their own commercial purposes, including to feed their machine learning algorithms that power each of their respective advertising networks.”