A California jury has found Meta in violation of state privacy laws in a class-action suit filed by users of the period tracking app Flo.

The plaintiffs said Meta collected private health data from Flo users without their consent and used it for ad targeting, allegedly violating the California Invasion of Privacy Act.

The lawsuit, filed in 2021, also named Flo, Google, AppsFlyer, and Flurry as defendants.

Meta said it disagreed with the verdict and denied collecting sensitive health information from Flo users.

Flo, based in the UK, provides a women’s health and period tracking app and was valued at over US$1 billion after a funding round last year.

🔗 Source: TechCrunch

🧠 Food for thought

1️⃣ Meta faces recurring pattern of major privacy violations

This Flo verdict continues a well-documented history of Meta’s privacy violations that have resulted in significant regulatory penalties.

In 2019, the FTC imposed a historic $5 billion penalty on Facebook for violating a 2012 privacy order, the largest privacy fine ever imposed at that time1.

The Cambridge Analytica scandal in 2018 revealed that Facebook allowed harvesting of data from over 50 million user profiles without consent, which was then used to influence voter behavior2.

More recently, Ireland’s Data Protection Commissioner fined Meta €395 million in December 2022 for GDPR violations related to illegal data practices3.

This pattern suggests that despite repeated regulatory action and public scrutiny, Meta continues to face challenges with fundamental privacy compliance across its platforms and third-party integrations.

2️⃣ Health data represents high-stakes battleground in privacy enforcement

The Flo case highlights how health data has become a particularly sensitive area for privacy enforcement, with California leading stricter regulatory approaches.

California’s privacy laws specifically categorize health information as “sensitive personal information” subject to strict limitations on collection and use, requiring companies to obtain opt-in consent for data practices that exceed consumer expectations4.