A federal jury found Meta liable under California's privacy-invasion statute for obtaining Flo app users' menstrual and ovulation data without consent

metaflo-healthcipaprivacyconsentlitigationmhealth

In Frasco v. Flo Health, Inc. (N.D. Cal., Case No. 21-cv-00757-JD), a jury — after a trial that ran over the course of two weeks — found Meta liable for violating the California Invasion of Privacy Act, Cal. Pen. Code § 632, by obtaining highly personal ovulation and menstrual-period information that women communicated through the Flo Period and Ovulation Tracker app. The provision at issue is a recording provision, not an interception one: as the order recites it, § 632(a) reaches a "person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication." The data reached Meta through a software development kit integrated into the Flo app, and the jury was instructed on intent in those same recording terms, drawn from the California Court of Appeal's decision in Rojas. Co-defendants Google and Flurry settled before trial, and Flo Health itself settled during trial, leaving Meta as the sole defendant at verdict; the jury's finding was unanimous. In a September 17, 2025 amended order, Judge James Donato denied Meta's post-trial motions for decertification, judgment as a matter of law, and a new trial, writing that "Nothing in the evidence adduced at trial or the record as a whole justifies disturbing the California class or the jury's unanimous verdict."

This case is cited by Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026; see claim-mhealth-apps-69pct-request-unjustified-android-permissions) as introductory motivation, via a tinyurl link, rather than as part of the paper's own measurement. Followed here to the court's own order rather than left on the paper's shortened citation.