Meta Platforms, the parent company of social apps Facebook and Instagram, violated California’s anti-wiretap law when it indiscriminately collected and used personal data from a health app for commercial purposes, a federal jury determined last week.
The decision followed a seven-day trial in California federal court and stems from a 2021 class-action lawsuit brought by users of the Flo period-tracking app. The plaintiffs alleged that Meta collected reproductive health data via software development kits (SDKs) embedded in the Flo app and used that data to fuel its ad-targeting business.
The jury concluded that Meta “intentionally eavesdropped on and/or recorded” users’ electronic communications in violation of California’s wiretap law, which requires the consent of all parties to record such exchanges. A Meta spokesperson said the company “vigorously disagrees” with the outcome and is “exploring all legal options.”
“The plaintiffs’ claims against Meta are simply false. User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any,” the Meta spokesperson said.
The broader case initially named Flo Health, Meta, Google and others as defendants. Plaintiffs argued that not only did Flo share sensitive data with analytics partners, but that Meta used the information “indiscriminately” for commercial purposes, including ad targeting and product development.
The allegations paralleled findings from a 2021 Federal Trade Commission investigation, which concluded that Flo shared pseudonymized data tied to users’ reproductive health like pregnancy status with Meta and others, despite stating otherwise in its privacy policies.
Flo settled with the FTC in 2021, agreeing to notify users about the data sharing and obtain future consent before transmitting sensitive health information. Google recently settled related claims, and Flo told the court last week it had also reached a settlement with users.
Meta, by contrast, opted to take the case to trial after failing to persuade U.S. District Judge James Donato to grant summary judgment. The company contended that it did not intend to collect health data and argued that any data received was sent in violation of Meta’s terms, which prohibit such sharing.
Judge Donato ruled that a jury should determine whether Meta’s actions violated wiretap statutes, citing unresolved questions around user consent, intent, and whether the intercepted data was in transit.
