Cybersecurity Policy Report, N.D. Cal.: Class certified in fertility app privacy case against Flo Health, Meta, Google, (May 29, 2025)

By Justin Marcus Smith, J.D.

The court said the tech companies “did not bother to mention, let alone discuss, most of the requirements for certification required under Rule 23(a), namely numerosity, typicality, and adequacy.”

In a class action about highly personal data allegedly collected from consumer use of the Flo Period and Ovulation Tracker app, the federal district court in San Francisco certified a nationwide class for California Confidentiality of Medical Information Act (CMIA), breach of contract, and intrusion upon seclusion claims against the app provider, Flo Health, Inc. (Flo). The court also certified a California subclass for the invasion of privacy claim against Flo under Art. 1, Sec. 1 of the California Constitution and a California Invasion of Privacy Act (CIPA) § 632 claim against Meta Platforms, Inc. (Meta) and Google LLC (Google). However, the court declined to certify a class with respect to California’s Comprehensive Data Access and Fraud Act (CDAFA) and injunctive relief (Frasco v. Flo Health, Inc., No. 21-cv-00757-JD (N.D. Cal. May. 19, 2025)).

Background. Eight consumers hailing from California, New Jersey, New York, Ohio, and Pennsylvania brought actions consolidated into a putative class action asserting a variety of privacy claims against Flo, Google, and Meta. The consumers alleged that, from 2016 to 2019, the Flo Period and Ovulation Tracker app for women (Flo App) surreptitiously transmitted highly personal information about their menstruation, ovulation, pregnancy goals, sexual activity details, and medical details to Google and Meta, through the two tech companies’ software development kits (SDKs), despite Flo assurances to the contrary. Standard event information consisted of routine app functions, like launch and closure. Custom event information consisted of user-app interaction records, like “R_PREGNANCY-WEEK-CHOSEN,” unique to the Flo App. The complaint alleged that Google and Meta commercially exploited the users sensitive health information for marketing and advertising purposes. The consumers voluntarily dismissed their claims against AppsFlyer, Inc. and settled with Flurry, Inc.

The court terminated the consumers’ initial motion to certify four classes due to the unusually large number of expert witnesses and resulting Daubert motions. The court then granted Google’s motion for summary judgment only on the California Unfair Competition Law (UCL) and aiding and abetting claims.

More recently, the consumers renewed their motion for class certification. They proposed a nationwide class for certification under Rule 23(b)(3) for damages against Flo for: (1) violation of the California Confidentiality of Medical Information Act (CMIA); (2) breach of contract (or in the alternative breach of an implied contract); (3) common law invasion of privacy (intrusion upon seclusion); and (4) violation of the Comprehensive Computer Data Access and Fraud Act (CDAFA). They proposed the same class for damages against Meta and Google for violations of CDAFA. They also proposed certification of a California subclass under Rule 23(b)(3) for damages against Flo for invasion of privacy in violation of Art. 1, Sec. 1 of the California Constitution, and against Meta and Google for violations of the California Invasion of Privacy Act (CIPA).

In addition to the damages classes, the consumers proposed certification of the nationwide class and California subclass under Rule 23(b)(2) for injunctive relief in connection with the CDAFA and common law invasion of privacy claims, and the California subclass would seek injunctive relief on CIPA claims.

Google and Meta opposed certification. Despite submissions by both sides totaling nearly 1,000 pages, the court said the tech companies did not address Fed. R. Civ. P. 23(a) elements and often “did not support their arguments with useful analysis.”

R. 23(a). The court concluded the consumers satisfied the Fed. R. Civ. P. 23(a) factors, albeit the court said it had to conduct an independent analysis because Google and Meta “did not bother to mention, let alone discuss, most of the requirements for certification required under Rule 23(a), namely numerosity, typicality, and adequacy.”

To start, the national and California classes were likely to have millions of possible members. The record showed all named consumers and class members who used the Flo App would be subject to the same app and SDK practices. The proposed class representatives’ claims were typical, and there was no evidence that the named consumers were inadequate or subject to any conflict.

Google and Meta flagged four independent but “global” concerns for denying certification: (1) implied consent; (2) a contractual limitations term; (3) a class action waiver; and (4) standing. The court applied California law here because Flo’s terms of use stated California law would govern and Google and Meta were principally based there.

Implied consent. The court said consent must be actual, whereas Google and Meta made no effort to show that a meaningful portion of the proposed classes might have seen or read reporting about Flo’s alleged misconduct. In any event, the earliest of these articles was published less than a week before the end of the class period, so the court said it could readily handle the tiny fraction of the class that might have seen them.

As for privacy disclosures, the court said the tech companies came “unacceptably close to misrepresentation” to the extent they “omitted, presumably purposefully, adjacent statements” that Flo would not sell or rent consumers’ personal information to third parties, including specifically, information about “marked cycles, pregnancy, symptoms, notes and other information that is entered by you and that you do not elect to share, with third party vendors who supply software applications, web hosting and other technologies for the App[.]” The court said the omissions raised a troubling question of candor with the court. In any event, the evidence of the privacy disclosures was common to the class. A jury could decide “in one fell swoop” whether reasonable consumers would have been on notice of, and therefore could impliedly consent to, the tech companies’ alleged conduct. Any secret data sharing that occurred would also be subject to common proof.

The tech companies did not explain their assertion that foreign publications and studies would have placed Flo App U.S. users on notice of the alleged conduct, how publications that pre-dating their representations could form the basis of subsequent notice or consent, or how a meaningful portion of the class would have seen such things.

Limitations period. As for the contractual limitations period, the tech companies said the consumers’ claims were “presumptively untimely” under a one-year filing deadline indicated in the Flo App terms of service, and there would be no way of knowing who knew what without a mini-trial for each user. The court said that point was “not well taken” because the tech companies were vague about how it could apply to Google and Meta. In any event, the one-year period was not a bar to certification with respect to Flo under the general rule that limitations period compliance does not necessarily defeat the predominance of common questions and the fact that Flo’s representations were the same. The question of inquiry notice, which is objective under California law, was also amenable to a classwide answer of “yes” or “no” based on common proof. The court said it could not conclude that the questions raised by the contractual limitations defense were more important than any issue in common.

Waiver. The court sustained the consumers’ unconscionability challenge to the tech companies’ waiver defense. Class action waivers are not categorically unconscionable in California. They are highly dependent on context, and here, the specific context of Flo’s alleged conduct revealed a high degree of procedural unconscionability because the purported waiver was buried in a contract of adhesion. Overall, and contrary to Flo’s argument, the waiver was unconscionable on procedural and substantive grounds for many of the same reasons given in the Discover Bank line of California cases. See Discover Bank v. Superior Court, 36 Cal. 4th 148, 160 (2005) (cleaned up).

Standing. The court found the tech companies’ standing arguments were “inextricably intertwined with the merits for determination later in the case.” Anonymization of data warranted attention now, and the court reasoned that blending anonymized data with other data did not cure or wash away the original common law privacy violation. Case law underscored the principle that privacy injury occurs at the point of interception without consent. Laundering of that data to hide the owner’s identity is of “no moment to the commission of the tort” of intrusion upon seclusion. The tech companies’ standing argument posed no barrier to certification.

Privacy claims. The court held the privacy claims asserted only against Flo posed a number of questions common to all class members that could be answered through common evidence. The tech companies contended most of the challenged custom events reflected only whether a user entered certain information, with no data available to determine what custom events the Flo App sent to Google and Meta for each Flo App user. In effect, this meant the tech companies objected to the consumers’ basic premise that personal health information had been communicated.

The court said the tech companies misunderstood the R. 23 inquiry because the evidence of user onboarding and custom events was the same for the class. The consumers showed they had a classwide method of resolving the merits questions on whether health information was conveyed. The tech companies did not offer any evidence to suggest that a user’s choice of a specific custom event necessarily involved a different or lesser expectation of privacy. They merely speculated.

The court also saw that California privacy law undercut the tech companies’ theory. Privacy is an objective entitlement tied to community norms, consent would not turn on individual class members’ subjective understandings of privacy disclosures and would not be a bar to predominance. The court also found the tech companies did not demonstrate that a certain rate of “fakes” would overwhelm common questions. It also seemed Flo was able to identify “fakes.” The court disposed of the tech companies’ “hash” of overlapping propositions, including random anecdotes about how users used the Flo App. The anecdotal assertion that husbands used the Flo App to scramble the data being analyzed, in light of the overturning of Roe, made no sense because the Supreme Court issued Dobbs over three years after the end of the class period. In sum, the consumers’ claims and evidence satisfied commonality and predominance for the nationwide class intrusion on seclusion claim and the California subclass California constitutional privacy claim.

CMIA. The court also held the consumers adduced evidence showing commonality and predominance for their Confidentiality of Medical Information Act (CMIA) claim. The question of whether Flo was a healthcare provider could be answered on a classwide basis by common proof of Flo’s services and practices. Common evidence of Flo’s privacy representations, surreptitious transmission of onboarding custom events, and subsequent commercial appropriation of the data could be offered as common proof that Flo was at least negligent in sharing medical information without users’ authorization and that the information was viewed. Flo’s suggestion that there were individualized issues about actual damages made “scant sense” because the consumers sought statutory damages.

CDAFA. The consumers’ bid for certification faltered with respect to damages or loss under the California Comprehensive Data Access and Fraud Act (CDAFA) because they did not offer classwide evidence of “damage or loss” with respect to their sole contention about the financial value of their data. The consumers’ expert testimony here was inadmissible, but even if it were admissible, it would not show that Flo App users ever intended to participate in the market for women’s health data. The court denied certification for the CDAFA claims.

Breach of contract. The court noted that California does not require a showing of actual damage for a breach of contract claim. Individual questions about actual damages did not defeat predominance because no such questions were posed.

CIPA. The court found the consumers’ evidence was capable of showing, on a classwide basis, that (1) Google and Meta intercepted and recorded users’ communications with Flo via their SDKs’ transmission of the Custom Events; (2) users expected those communications to be private based on Flo’s representations; (3) the interception and recordings were without users’ consent; (4) Google and Meta used the intercepted and recorded communications for their own commercial gain; and (5) Google and Meta intended to do so per the design of their SDKs and their attempts to continue collecting the same information even after Flo sought to remove the SDKs.

Google and Meta said individual issues would predominate because the consumers would need to prove the communications were sent from or received at any place within California. The court concluded the consumers fell short of showing which consumers completed the onboarding process in California. Accordingly, the consumers showed commonality and predominance for the CIPA § 632 claim but not for the § 631 claim.

Superiority. The court found class resolution would promote efficiency given the need, otherwise, to relitigate identical questions in a huge number of individual lawsuits.

R. 23(b)(2). The court denied, without prejudice, the consumers’ “cursory” request to certify nationwide and California classes for injunctive relief. The consumers focused on monetary relief.

The case is No. 21-cv-00757-JD.

Judge: Donato, J.

Attorneys: Christine M. Fox (Labaton Keller Sucharow LLP) for Erica Frasco, Sarah Wellman and Tesha Gamino. Ashley Marie Rogers (Gibson Dunn & Crutcher LLP) and Benjamin Sadun (Dechert LLP) for Flo Health, Inc. Andrew Brian Clubok (Latham & Watkins LLP) for Facebook, Inc.

Companies: Flo Health, Inc.; Facebook, Inc.

MainStory: TopStory CaseDecisions ConfidentialityNews CyberPrivacyFeed EHRNews HITNews HIPAANews ReproductiveHealthCareNews DataPrivacy LitigationEnforcement CaliforniaNews DataSecurity