Meta harvested health data to target ads, jury concludes

A jury in the US has found that tech giant Meta illegally compromised the privacy of a US woman who shared her data with a menstrual cycle and fertility tracking app.

The class action lawsuit was filed with the US District Court for the Northern District of California in 2021, claiming that private health information from the Flo app developed by Flo Health – such as data on menstrual cycles, mood, symptoms, sexual activity, and weight – had been shared with third-party advertisers.

Jurors in the civil case, which is viewed as a test of the power of tech firms in collecting and using personal data, concluded (PDF) that Meta had violated the California Invasion of Privacy Act. Flo Health settled out of court for an undisclosed sum earlier this month, following in the footsteps of Google and dissolved data analytics company Flurry, which were also named in the suit.

Claims against another defendant, advertising analytics specialist AppsFlyer, were dropped in 2022. Flo Health, meanwhile, also settled a charge by the Federal Trade Commission (FTC) in 2021 that it had made a variety of fraudulent misrepresentations to Flo users in violation of their privacy rights.

Since then, it has added additional features to give users greater control over their data, but has claimed that it only shared limited data with third parties to internally measure the performance of the app.

In 2024, the UK-based femtech company raised more than $200 million in a Series C financing from General Atlantic that propelled its valuation above $1 billion. Flo is the number one downloaded women's health app worldwide, it claims, with 76 million users.

"This verdict sends a clear message about the protection of digital health data and the responsibilities of big tech," said lead plaintiff attorneys Michael Canty and Carol Villegas of Labaton Keller Sucharow in a statement, which said that the result reflected the outrage of millions of women whose "private lives were turned into data points" without consent.

"Companies like Meta that covertly profit from users' most intimate information must be held accountable," they added. "Today's outcome reinforces the fundamental right to privacy – especially when it comes to sensitive health data."

Facebook parent Meta said it disagreed with the verdict, meanwhile, saying that it is exploring "all legal options."

It continued: "The plaintiffs' claims against Meta are simply false. User privacy is important to Meta, which is why we do not want health or other sensitive information, and why our terms prohibit developers from sending any."

Photo by Jonathan Borba on Unsplash