Cycle tracking app Flo Health and Meta are facing a class action trial in San Francisco federal court over allegations they violated the privacy of millions of users by sharing intimate health data, according to Reuters.
The case centers on claims that Flo integrated software development kits from Meta and Google into its app between November 2016 and February 2019, allegedly allowing these companies to access personal information about users’ menstrual cycles, sexual activity, and pregnancies. The lawsuit covers all United States users during this period, plus a California subclass.
The financial stakes are substantial. Meta faces claims under California’s Invasion of Privacy Act, which carries statutory penalties of €4,600 ($5,000) per violation. With plaintiffs suggesting up to 38 million class members, potential damages could reach €175 billion ($190 billion), though discovery documents indicate approximately 13 million people downloaded and registered for the app during the relevant period.
Flo Health faces separate claims under California’s Confidentiality of Medical Information Act, with penalties of approximately €920 ($1,000) per violation.
The litigation stems from a 2021 Federal Trade Commission settlement with Flo Health, which followed Wall Street Journal reporting in 2019 about data sharing practices. The FTC required Flo to obtain user consent before sharing health information and notify affected users about previous disclosures.
Google, which was also named in the original lawsuit, reached a settlement in principle last week on undisclosed terms.
Both companies deny wrongdoing. Meta stated the claims are “simply false” and expressed confidence in the trial evidence. Flo Health maintains it “is committed to protecting the privacy of its users” and considers the allegations without merit.
The companies argue that privacy disclosures provided adequate notice and that shared data was de-identified, consisting of device-specific alphanumeric strings rather than personally identifiable information.
The trial represents a significant test case for women’s health technology companies regarding data privacy practices. U.S. District Judge James Donato certified the class action in May, finding that “loss of control over one’s personal information” constitutes concrete harm in healthcare applications.
