Privacy

Jury Rules Meta Violated Privacy Law Over Period App Data

Published AUG 6 2025

Story

Above: The Meta Platforms Inc. pavilion at the World Economic Forum (WEF) in Davos, Switzerland in 2025. Image credit: Hollie Adams/Bloomberg/Getty Images

The Facts

A California federal jury found that Meta violated the California Invasion of Privacy Act by collecting sensitive reproductive health data from the Flo period tracking app without user consent between November 2016 and February 2019.
Court House News
Hipaajournal
In addition, the jury last Friday unanimously ruled that Meta intentionally eavesdropped on users' private communications through software development kits embedded in the app.
Hipaajournal
Court House News
The Flo Health app had over 38 million active monthly users at the time the lawsuit was filed. Users provided intimate details, including menstrual cycles, sexual activity, health symptoms and fertility goals, which Flo promised would remain private and confidential.
Law.com
Hipaajournal
The class action lawsuit, Frasco v. Flo Health, was filed in 2021 and originally named Meta, Google, Flo Health, AppsFlyer and Flurry as defendants. Google and Flurry settled before trial, AppsFlyer was dismissed in 2022 and Flo Health reached a settlement last Thursday before the jury verdict against Meta.
Law.com
Hipaajournal
Plaintiffs argued that Meta used software development kits as recording devices to capture user data through 12 custom app events. The collected data was allegedly used for targeted advertising purposes and fed into Meta's machine learning algorithms that power its advertising networks.
Ars Technica
Court House News
The jury answered three key questions, finding that Meta intentionally eavesdropped on conversations, that users had reasonable expectation of privacy and that Meta did not have consent from all parties to record the conversations. The California Invasion of Privacy Act imposes penalties of up to $5,000 per violation.
Law.com
Court House News

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

This verdict sends a crucial message to Big Tech companies that they can't secretly profit from women's most intimate health data. The jury saw through Meta's denials and recognized this as a clear violation of privacy rights. Moving forward, tech companies must know they could be held liable if they collect sensitive reproductive data without permission.

Femtech Insider

Narrative B

Meta never intentionally collected or wanted sensitive health data from Flo users, as evidenced by company policies that explicitly prohibit developers from sending such information. Meta simply provided analytics tools that Flo misused. This case should've been thrown out since the suit was filed beyond the one-year limit expressed in the app's service agreement.

Bloomberg Law