Period tracking app Flo Health is approaching the end of its first week on trial in a potentially multi-billion dollar data privacy lawsuit, alleging the healthtech unlawfully shared users’ personal data with Meta for targeted advertising.
Flo is one of the most popular period tracking apps in the world and became Europe’s first femtech unicorn when it raised $200m last year, in a round led by US investor General Atlantic.
The case, which began in San Francisco on Monday and is expected to last at least eight days, involves five named claimants who argue they never gave permission for their data — including the dates and lengths of their periods — to be shared with the social media giant, which is also on trial.
Flo denies all of the claims. Meta denies that it received any sensitive menstrual data from Flo.
The healthtech told Sifted: “Flo is committed to protecting the privacy of its users, and any allegation otherwise has no merit. Flo has never sold user data and never will.”
Damages
Founded in 2015, Flo’s platform allows users to track period cycles and monitor symptoms, as well as providing them with tailored health insights and educational content around pregnancy and perimenopause.
Claimants are seeking $1,000 in statutory damages under California’s medical privacy law for 13m Flo users who downloaded and registered on the app between late 2016 and early 2019, legal publication Law360 reported, citing a trial brief filed by Meta last month. If this is the case, Flo could face $13bn in damages.
The claimants say that Flo integrated tracking tools like Meta’s software development kits (SDKs), which automatically transmitted sensitive personal data as users engaged with the app.
Claims were also brought against Google as part of the same case, but were settled earlier this month for an undisclosed sum.
The dispute started in 2021 when several of Flo’s users filed a suit against the healthtech, Google and Meta, following a settlement between Flo and the Federal Trade Commission after allegations the company shared health information with third-party advertising companies without permission.
Flo denies that this was the case, and says it agreed to settle the matter to “avoid the time and cost associated with litigation”.
Meta has been approached for comment.
The case could have implications for European healthtechs, says Rob Cobley, commercial partner at law firm Harper James.
"If the court finds that Flo or Meta unlawfully collected or shared sensitive data without proper consent, it may reinforce calls for tighter controls on SDK use and greater scrutiny of what data is being transmitted behind the scenes,” he tells Sifted. “For startups, that could mean revisiting how they design their apps, draft their privacy notices, and vet third-party tools.”
