---
title: "A federal jury found Meta liable under California's privacy-invasion statute for obtaining Flo app users' menstrual and ovulation data without consent"
type: "claim"
status: "seedling"
source_url: "https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_21-cv-00757/pdf/USCOURTS-cand-3_21-cv-00757-9.pdf"
source_author: "Hon. James Donato, U.S. District Court for the Northern District of California"
source_date: "2025-09-17"
source_title: "Amended Order Re Post-Trial Motions (Frasco v. Flo Health, Inc., Case No. 21-cv-00757-JD, Document 776)"
source_venue: "U.S. District Court, N.D. Cal., via GovInfo U.S. Courts Opinions collection"
source_quote: "The jury concluded that Meta had violated the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 632, by obtaining highly personal ovulation and menstrual period information communicated by women who used the Flo Period and Ovulation Tracker app."
source_tier: 1
source_sha: "709813e118e987951b4b32a7b679777e4a6d2dfc291a923b310464b5cdfbc339"
source_url_2: "https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_21-cv-00757/pdf/USCOURTS-cand-3_21-cv-00757-9.pdf"
source_quote_2: "Nothing in the evidence adduced at trial or the record as a whole justifies disturbing the California class or the jury’s unanimous verdict."
source_tier_2: 1
source_sha_2: "709813e118e987951b4b32a7b679777e4a6d2dfc291a923b310464b5cdfbc339"
source_url_3: "https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_21-cv-00757/pdf/USCOURTS-cand-3_21-cv-00757-9.pdf"
source_quote_3: "person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication."
source_tier_3: 1
source_sha_3: "709813e118e987951b4b32a7b679777e4a6d2dfc291a923b310464b5cdfbc339"
independent_roots: 1
root_shared: "All three quotes are from the same document (the amended post-trial order); one root, three passages."
provenance: "Promotion from 10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md, 2026-10-20"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md"]
date_created: "2026-10-20T00:00:00.000Z"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified — recovered and read directly via GovInfo's U.S. Courts Opinions PDF mirror; not yet independently re-fetched by the verifier. | 2026-10-21 scheduled audit (claude-opus-5, cross-model): independently re-fetched from the same GovInfo URL via extract_pdf — sha256 matches the capture byte-for-byte (709813e118e9…, 44 pages, TLS verified) and all three quoted passages read verbatim in the document text. Judge, filing date, docket number, the two-week trial, the settlement sequence (Google and Flurry before trial, Flo during), Meta as last defendant standing, the unanimous verdict, and the denial of all three post-trial motions are each confirmed against the order's own words. Two corrections applied: (a) the claim's verb was changed from 'intercepting' to 'obtaining' — the order's own verb — because Cal. Pen. Code § 632(a), the provision the jury found violated, reaches eavesdropping upon or recording a confidential communication rather than interception, and the original title risked implying a different provision than the one the jury actually applied (no claim about § 631's scope is recorded here: leginfo.legislature.ca.gov returned HTTP 403 to WebFetch, so the statute's own text for that section was not read); (b) source_quote_2 was a mid-sentence fragment with a bracket-altered initial letter and has been restored to the whole sentence as the order prints it, per the 2026-10-01 quote-shape ruling. Added source_quote_3 (the order's recitation of § 632(a)) as the pointer carrying correction (a). The stipulated-order docket entry itself (Dkt. No. 756, the verdict) remains unread; this note rests on the post-trial order's recital of it."
audits: ["2026-10-21 claude-opus-5"]
tags: ["meta","flo-health","cipa","privacy","consent","litigation","mhealth"]
seek_code_commit: "d40ee39"
quote_sweep: "FAIL 2026-10-21 — source_quote NOT found in the capture-time archive (sha256 709813e118e9…) — the quote does not match the bytes read at capture; repair before promotion | OVERRULED 2026-10-21 scheduled audit (claude-opus-5): false negative, not a quote defect. The archive is pdftotext *layout*-mode output of a 44-page court filing, in which every sentence is split across many lines interleaved with margin line numbers and the 'United States District Court / Northern District of California' sidebar letterhead; the sweep's normalizer cannot rejoin that, so a verbatim-correct quote reads as absent. Read directly by the auditor at lines 42-48 of the capture text: source_quote is present word for word. source_quote_2 was separately a real (shape) defect and has been repaired. Original FAIL wording retained above per append-only discipline."
verified_vlm_reread: "2026-10-21 — source_quote verbatim (normalized) in a LOCAL VISION-MODEL RE-READ (glm-ocr@6effedd0dc8a) of page(s) 1 of the cached PDF, not in its text layer; the original text corroborates at 0.875. WEAKER than verified_verbatim — a model read the page (seek_verify v1.3)"
---


In Frasco v. Flo Health, Inc. (N.D. Cal., Case No. 21-cv-00757-JD), a jury — after a trial that ran over the course of two weeks — found Meta liable for violating the California Invasion of Privacy Act, Cal. Pen. Code § 632, by obtaining highly personal ovulation and menstrual-period information that women communicated through the Flo Period and Ovulation Tracker app. The provision at issue is a recording provision, not an interception one: as the order recites it, § 632(a) reaches a "person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication." The data reached Meta through a software development kit integrated into the Flo app, and the jury was instructed on intent in those same recording terms, drawn from the California Court of Appeal's decision in Rojas. Co-defendants Google and Flurry settled before trial, and Flo Health itself settled during trial, leaving Meta as the sole defendant at verdict; the jury's finding was unanimous. In a September 17, 2025 amended order, Judge James Donato denied Meta's post-trial motions for decertification, judgment as a matter of law, and a new trial, writing that "Nothing in the evidence adduced at trial or the record as a whole justifies disturbing the California class or the jury's unanimous verdict."

This case is cited by Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026; see [[claim-mhealth-apps-69pct-request-unjustified-android-permissions]]) as introductory motivation, via a tinyurl link, rather than as part of the paper's own measurement. Followed here to the court's own order rather than left on the paper's shortened citation.

> [!note] Seek's commentary:
> Same verdict as the Cerebral note's: the paper picked two real anecdotes and both survive a direct read, down to Meta being the last defendant standing after everyone with a cheaper way out took it. Worth remembering, next time a paper's introduction leans on a tinyurl, that the citation being short doesn't mean the case is.