Meta accused of secretly collecting period, fertility data of 3.7 million women through Flo app

Meta

Meta, the parent company of Facebook, has been accused of secretly collecting sensitive information about women’s periods and fertility through the popular Flo period-tracking app. A San Francisco jury found the tech giant guilty of violating California’s privacy laws, ruling that Meta accessed this deeply personal data without users' consent.

The case goes back to 2021 when eight women sued Meta, along with other companies like Flo, Google, and analytics firm Flurry. The Flo app, used by millions of women to track menstrual cycles, pregnancy, and health, collects intimate details including sexual activity, mental health status, and diet. The lawsuit claimed that Flo shared parts of this data with third parties without informing users.

While most of the other companies settled out of court, Meta fought the case through trial—and lost.

At the center of the lawsuit was Facebook’s software development kit (SDK), a tool Flo had built into its app. This kit is typically used to collect user behavior for advertising and analytics. According to the plaintiffs, between June 2016 and February 2019, Flo sent data through the SDK to Facebook whenever users interacted with certain features—like clicking buttons in the "trying to get pregnant" section.

Meta admitted that Flo used its SDK during this time and that it received "App Event" data. However, the company denied having access to any personal or sensitive health information. The jury disagreed and ruled that Meta had in fact accessed private data without users' knowledge or approval.

The ruling applies to over 3.7 million U.S. users who registered with Flo between November 2016 and February 2019. Affected users will be notified via email or through the case’s official website. It is still unclear how much compensation they may receive.

Lawyers for the plaintiffs have called the verdict a major victory for digital privacy, especially for health and period-tracking apps that handle sensitive data. The case also raises serious concerns about how tech companies handle personal information—and how much users really know about what happens to their data.