Google’s Exit From Flo Health Suit Puts Privacy Issues in Limbo

Google LLC and other defendants’ move to settle claims against them in the privacy case over the Flo Health app’s data sharing practices threatens to leave unanswered key questions about corporate responsibility to protect consumers’ health information.

Last week, Google filed a notice of settlement in the class action in the US District Court for the Northern District of California, evading a pending jury trial, but leaving issues such as what is considered “private” health data and whether and how California’s Invasion of Privacy Act applies to digital surveillance tools still in need of resolution.

Answers could emerge as Flo Health Inc.—the company behind the menstrual cycle tracking app—and Meta Platforms Inc. go to trial later this month over whether users’ sensitive health data such as menstrual cycles, sexual activity, and fertility goals was illegally collected and shared to advertisers without their consent.

That is, if they don’t also settle in the meantime.

The privacy issues take on greater importance with little-known loopholes in the Health Insurance Portability and Accountability Act and increasing state restrictions on abortion and related reproductive care access.

“There has been a lot of cultural commentary surrounding these issues after the Supreme Court overturned Roe v. Wade, and many more people are becoming more aware of how their personal data, their health data, and their reproductive data” now has less privacy, said Suzanne Bernstein, counsel at the Electronic Privacy information Center, a public interest group seeking to protect privacy and freedom of expression.

“There’s a long way to go for privacy protections in the US,” she said. “This lawsuit that’s been ongoing shows that there can and should be standing in courts for these kind of privacy violations.”

‘Broken Promise’

London-based Flo Health offers period and fertility tracking to over 100 million users. The app reached a $1 billion valuation last year as one of the most popular menstruation tracking apps globally.

The company markets itself as a safe space for users to log intimate reproductive health data, including menstruation cycles, ovulation, sexual activity, and pregnancy status.

But the class action, filed in 2021 by lead plaintiff Erica Frasco, claims Flo broke that trust by secretly transmitting sensitive data to third-party marketing and analytics firms in violation of the company’s privacy policy.

Flo Health initially was the sole defendant, but the court consolidated similar cases against Google, Facebook, Appsflyer Inc., and Flurry Inc.

Now-defunct Flurry also settled in March, and Flo previously reached a deal with the Federal Trade Commission in 2021 over the company’s data sharing.

“It all relies on the broken promise of notice and choice—that a consumer read and understood dozens of pages of disclosures to be able to immediately consent to it,” Bernstein said.

“Flo is committed to protecting the privacy of its users, and any allegation otherwise has no merit,” a company spokesperson said. “We are building a better future for women, and are steadfast in our commitment to protecting your privacy and data.”

A spokesperson for Meta said “the plaintiffs’ claims against Meta are simply false, and we are confident that the evidence at trial will demonstrate the realities. User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any.”

Google didn’t respond to requests for comment.

HIPAA Inapplicable

While most Americans are aware of HIPAA, Bernstein said it’s often a “surprise to many that apps like Flo Health that collect such sensitive health information” fall outside the law’s scope because it only applies to medical records and doesn’t ban sharing data that’s not tied to a particular person.

That leaves open the question of whether or not it’s a privacy violation to collect health information not tied to a particular person, said Carmel Shachar, faculty director of the Health Law and Policy Clinic at Harvard Law School.

When denying summary judgment to Google last September, Judge James Donato said it wasn’t clear that collecting information about a woman’s menstrual cycles and fertility goals without consent is allowed as long as it’s not connected to a particular person, Shachar said.

The ruling left it to the jury, including the jury that will rule in Meta’s case, to decide “what it truly means to say the data we’re collecting is so anonymous as to not impinge on anyone’s privacy rights,” she said.

CIPA ‘Eavesdropping’

Another major outstanding issue concerns the scope of the California Invasion of Privacy Act.

Enacted in 1967, the law bans recording confidential conversations without the consent of everyone involved. But it hasn’t been updated to address digital surveillance and online tracking tools like Meta’s tracking pixel.

Plaintiffs’ attorneys have leaned on CIPA to target websites with such tracking technologies.

Sara Jodka, a member at Dickinson Wright PLLC, said on any given day there’s a CIPA lawsuit against major third-party collectors on her desk due to the over-broad use of the act.

CIPA has been used so many times that a California Senate committee unanimously passed a bipartisan bill in June to limit its reach. The bill now waits for further consideration in the Assembly.

“This is not the type of eavesdropping or data sharing that this was law ever was intended to cover,” Jodka said. “The statue was never built for this.”

Meta was denied summary judgment on the CIPA claims, which allege the company illegally intercepted health data, including communications with users, from Flo Health through Facebook code integrated into the app.

Jodka said the Flo Health case could narrow CIPA’s scope, offering clarity for companies that provide third-party collection tools.

“If the court does come down and find Meta liable, you wouldn’t be able to market in California,” she said. “I don’t think that’s the society that people really intend to live in, but that effectively is the impact of the law if it were to happen.”

“What happens with Meta is going to affect Google,” she added. “It’s going to affect everything that’s going on with litigation.”

The case is Frasco v. Flo Health, Inc., N.D. Cal., No. 3:21-cv-00757.