Trial begins in data privacy case against menstrual tracking app Flo

SAN FRANCISCO (CN) — A period tracking app shared users’ highly sensitive information to third parties, including Meta, without permission, an attorney for a class of user plaintiffs told a jury in federal court in San Francisco Monday.

Users of the app, operated by Flo Health Inc., sued the company in 2021, claiming it improperly shared personal identifying information and private health data with third parties, including fellow defendants Facebook — now known as Meta — Google, ad analytics company AppsFlyer and defunct analytics company Flurry.

Earlier this month, Google said it had reached a settlement in principle with the class. Flurry settled with the users in March, and the class voluntarily dismissed its claims against AppsFlyer in 2022.

Left to be decided in the jury trial that began Monday are the claims against Flo and Meta, which the class accuses of using their personal data for advertising and other purposes.

Carol C. Villegas of Labaton Keller Sucharow, an attorney for the plaintiffs, asked the jury in her opening statement to “decide how seriously big tech takes women’s privacy.”

“This wasn’t an accident, this wasn’t a mistake. This is how Meta makes money. This is their business,” she said.

Flo launched its app in 2016 to help users track their periods, ovulation, and pregnancy. Users interested in tracking their menstrual cycle or fertility can download the app and answer a series of questions about their cycle, including date and length of their last period.

The app also helps users document multiple factors that may influence their menstrual cycle or fertility, including their mood, symptoms and sexual activity.

Villegas laid out the plaintiffs’ claims that Flo shared sensitive health data and misled users about sharing data with third parties, and that Meta violated the California Invasion of Privacy Act.

She said that the plaintiffs will argue that Flo should be considered as a health application, and should therefore be found to have violated the California Confidentiality of Medical Information Act.

Brenda R. Sharton of Dechert, the lead attorney representing Flo Health, said evidence will show that Flo never shared plaintiffs’ health information, that plaintiffs agreed that Flo could share data to maintain and improve the app’s performance, and that Flo never sold data or allowed anybody to use health information for ads.

Sharton rebutted the plaintiffs’ claim that Flo was a health care provider, saying that the app’s terms of service include a disclaimer that Flo is “not a licensed medical care provider” and “is not intended to replace professional medical advice.”

She also emphasized the statute of limitations in the case, claiming that the plaintiffs’ claims are outside the one-year limitation period stipulated in the terms of service, which all the plaintiffs agreed to.

“Is Flo a provider of health care? No. Are Flo’s users its patients? No. Did Plaintiffs file their claims on time? No. Did Plaintiffs agree to Flo’s privacy policy? Yes,” Sharton said in her opening statement.

The lead attorney for Meta, Michele D. Johnson, of Latham & Watkins, told the court that the case should focus on one question: Did Facebook intentionally eavesdrop upon or record plaintiffs’ confidential communications without consent?

“Facebook never even received plaintiffs’ confidential communications, let alone eavesdrop or record,” she said.

She added that Facebook made Flo, like other parties using its business tools, agree to inform users about data sharing and not to send any sensitive health information.

Attorneys for the parties could not immediately be reached for comment.

U.S. District Judge James Donato is presiding over the trial at the Philip Burton Federal Courthouse. It will continue on Tuesday with witness testimony.

Follow @mhattridge_