Judge signals Meta may owe $8 billion in menstrual app privacy suit

SAN FRANCISCO (CN) — A federal judge Tuesday indicated that Meta may have to pay nearly $8 billion to users of the period tracking app Flo who had their information illegally recorded by Meta.

In August, a jury found that Meta violated the California Invasion of Privacy Act when it intentionally recorded the sensitive health information of millions of women through Flo following a two-week trial this summer.

The plaintiffs proposed damages of $5,000 per class member — the amount of statutory damages allowed per violation of the California Invasion of Privacy Act.

Michael P. Canty of New York-based Labaton Keller Sucharow, an attorney for the plaintiffs, said they don’t know the exact size of the class but estimate around 1.6 million eligible class members in California.

U.S. District Judge James Donato, a Barack Obama appointee, did not object to the proposed damages amount and stated that he was aware of, but not concerned about, the potential for fraud given the high damages amount.

“There’s no reason that gives me undue concern that there will be rampant fraud. We are not going to let people cheat the system. I want to see as many cross-checks as we can,” he said.

The plaintiffs are proposing a streamlined claims procedure that requires class members to submit their name and contact information and attest under penalty of perjury that they lived in California and downloaded the Flo Health app between Nov. 1, 2016, and Feb 28, 2019.

To ensure that only eligible class members receive damages, the plaintiffs proposed using a third-party company to validate the data and detect fraudulent claims.

Canty also revealed that Flo offered to provide the plaintiffs with additional user data to help them identify class members who qualify for damages.

Christopher Chorba of Gibson, Dunn & Crutcher, an attorney for Meta, said the news that Flo was providing data to the plaintiffs was “earth-shattering” and objected to additional cross-checks with Meta to ensure potential class members are eligible.

Donato said Meta’s objections over the plaintiffs’ proposals are “not grounded in reality.”

“Here in this courtroom, we are a reality-based experience,” he said.

He added that Meta should want plaintiffs to use their data to cross-check to ensure that only eligible class members receive damages.

“Meta’s handringing about due process is totally misplaced; you want to be chomping at the bit to do cross-checks with your data,” he said.

However, Donato was skeptical about the plaintiffs’ proposed injunctive relief, asking the court to order Meta to delete all data derived from its privacy violations and conduct routine audits and monitoring overseen by an outside third-party

“I am not seeing a pressing need for it. It’s somewhat transient data; you’re pregnant for nine months, and it then stops. Menstrual data is also somewhat dependent on time,” he said. “The data has been out for seven years. If Meta exploited it, they have already done that. I can’t imagine it’s particularly useful.”

Donato did not indicate when he would release a ruling. The plaintiffs indicated it would take Flo at least three weeks to get the additional data needed to identify potential class members.

After the hearing, Canty said damages are supposed to “have teeth” to deter behavior but declined to comment further.

A representative for Meta did not comment on the hearing but said that they “disagree with the verdict and believe the plaintiffs’ claims are false.”

“User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any,” they said.

A class of app users sued Flo Health in 2021, claiming the company was improperly sharing personal identifying information and private health data with third parties. Among them: fellow defendants Facebook (now known as Meta), Google, ad analytics company AppsFlyer and defunct analytics company Flurry.

Google said it had reached a settlement in principle with the class in July. Flurry settled with the users in March, and the class voluntarily dismissed its claims against AppsFlyer in 2022. Flo announced it had settled mid-trial and admitted no wrongdoing.

Under the nearly $60 million settlement, Google is expected to pay $48 million, Flo $8 million and Flurry $3.5 million.

The settlement is subject to court approval. In the hearing, Donato said Flo’s settlement was “a lot less interesting” after learning it was a national settlement and not just for California class members.

“We may have to go over that,” he said.

Follow @mhattridge_