Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
Privacy Facebook Slashdot.org

Meta Eavesdropped On Period-Tracker App's Users, Jury Rules (sfgate.com) 99

Posted by BeauHD from the data-leakage dept.
A San Francisco jury ruled that Meta violated the California Invasion of Privacy Act by collecting sensitive data from users of the Flo period-tracking app without consent. "The plaintiff's lawyers who sued Meta are calling this a 'landmark' victory -- the tech company contends that the jury got it all wrong," reports SFGATE. From the report: The case goes back to 2021, when eight women sued Flo and a group of other tech companies, including Google and Facebook, now known as Meta. The stakes were extremely personal. Flo asked users about their sex lives, mental health and diets, and guided them through menstruation and pregnancy. Then, the women alleged, Flo shared pieces of that data with other companies. The claims were largely based on a 2019 Wall Street Journal story and a 2021 Federal Trade Commission investigation. Google, Flo and the analytics company Flurry, which was also part of the lawsuit, reached settlements with the plaintiffs, as is common in class action lawsuits about tech privacy. But Meta stuck it out through the entire trial and lost.

The case against Meta focused on its Facebook software development kit, which Flo added to its app and which is generally used for analytics and advertising services. The women alleged that between June 2016 and February 2019, Flo sent Facebook, through that kit, various records of "Custom App Events" -- such as a user clicking a particular button in the "wanting to get pregnant" section of the app. Their complaint also pointed to Facebook's terms for its business tools, which said the company used so-called "event data" to personalize ads and content.

In a 2022 filing (PDF), the tech giant admitted that Flo used Facebook's kit during this period and that the app sent data connected to "App Events." But Meta denied receiving intimate information about users' health. Nonetheless, the jury ruled (PDF) against Meta. Along with the eavesdropping decision, the group determined that Flo's users had a reasonable expectation they weren't being overheard or recorded, as well as ruling that Meta didn't have consent to eavesdrop or record. The unanimous verdict was that the massive company violated the California Invasion of Privacy Act. The jury's ruling could impact over 3.7 million U.S. users who registered between November 2016 and February 2019, with updates to be shared via email and a case website. The exact compensation from the trial or potential settlements remains uncertain.

Meta Eavesdropped On Period-Tracker App's Users, Jury Rules More | Reply

Meta Eavesdropped On Period-Tracker App's Users, Jury Rules

Comments Filter:
  • Why do people feed all this info into these âappsâ(TM)?

    is it really because what zucker famously said, /is/ actually true?

    Remember the old days when people were told not to share personal information online, even your name, . Now people are seemingly sharing some of their most intimate details and wondering, no, finding out why actually thatâ(TM)s a bad idea?

    • Why do people feed all this info into these âappsâ(TM)?

      is it really because what zucker famously said, /is/ actually true?

      Remember the old days when people were told not to share personal information online, even your name, . Now people are seemingly sharing some of their most intimate details and wondering, no, finding out why actually thatâ(TM)s a bad idea?

      And some groups appear to be more affected. Just like Tea - ostensibly an online "dating safety" app - became an attempted reboot of #metoo then was hacked and exposed way too much personal information about its users. Names, addresses, and dishing on men who they maybe just broke up with them, and need to be punished.

      Ladies, please pump the brakes on the oversharing. Go outside, make some actual friends if you want to commiserate. And not at a club, where "The View" is where they get their news. And t

      • Ladies, please pump the brakes on the oversharing

        So... you want them to become men? "How was your day honey?" / "(grunt)".

        • Ladies, please pump the brakes on the oversharing

          So... you want them to become men? "How was your day honey?" / "(grunt)".

          Reminds me of the stay at home dads on my street. Happiest guys you'd ever meet, taking care of the children, just living their best life.

          The breadwinner moms always looked like they were chewing on lemons all day.

    • Why not?

      I use Google Fit to track my daily bike rides. It keeps detailed track of my route and time spent and calories burned, etc. I know that the data goes to Google and that advertisers might use it to target me with marketing. Why should I be concerned about that? Let them try!

      This isn't that unlike a period tracker app. Marketers might target a woman whose periods suddenly stop, with ads for diapers or infant formula. Maybe such women would actually appreciate such offers, or at least, they're already

    • Why does only the state government of California care enough to mandate protection from this kind of data abuse?

      It should be a federal prosecution. But our Congress doesn't give two fucks. No money in it from the MAGAs.

    • From the description this sounds like analytics. Generally these frameworks track how users use an app and anonymize it, and aggregate all the information together. You can use this to determine how users are using the app. For example let's say you have a feature you think is super useful. But you get your analytics back and almost nobody is using it. You may decide it is not worth maintaining and drop it in favor of focusing on areas of the app people are using. Or perhaps you may determine a particular c

  • Such a surprise (Score:3)

    by gweihir ( 88907 ) on Wednesday August 06, 2025 @06:35AM (#65569530)

    Obviously, these companies grab and sell any and all data they can get their hands on. Equally obviously, that should get the ones ordering this and the ones doing it sent to prison for an extended period of time. Unless and until that happens, nothing is going to change.

    • Re: (Score:3)

      by evanh ( 627108 )

      And the simple solution to achieve this is to ban user tracking.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Yep. And, you know what, just copying and enforcing the GDPR would do that. Not even a need to come up with anything new.

    • Obviously, these companies grab and sell any and all data they can get their hands on. Equally obviously, that should get the ones ordering this and the ones doing it sent to prison for an extended period of time. Unless and until that happens, nothing is going to change.

      And that is why women especially need to be constantly advised to not share personal stuff online. The Tea app and its breach is another example.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Indeed. Although some more women sent to prison for abortions should make that message very clear.

        In these dark times, women need once more stop trusting the "authorities" for anything. But so should men.

        • Indeed. Although some more women sent to prison for abortions should make that message very clear.

          In these dark times, women need once more stop trusting the "authorities" for anything. But so should men.

          I'm not anti abortion per se. But there are so many different types of birth control out there that it is probably the worst form. Obviously things like ectopic pregnancies or if the woman's life is threatened.

          I recall the time before abortions were legalized, I was just a kid, and in my little town, a lot of women seemed to need "dilation and curettage" (D and C). Go to hospital, have an overnight stay, and come home and get on with life.

          After legalization whatever it was that caused the need for D and

          • Re: (Score:2)

            by gweihir ( 88907 )

            For any sane woman, abortion is a last resort. But contraception is a problem (carrying condoms can get women arrested in the US), and information about contraception seems to totally suck in many US states. Apparently some younger US women do not even know how their cycle works and what their fertile days are. We had that in biology class (Europe).

            • For any sane woman, abortion is a last resort. But contraception is a problem (carrying condoms can get women arrested in the US), and information about contraception seems to totally suck in many US states. Apparently some younger US women do not even know how their cycle works and what their fertile days are. We had that in biology class (Europe).

              And that is a rule in 4 liberal leaning cities. New York City, Los Angeles, San Francisco, and Washington, D.C. The specific possession of condoms can be determined as evidence of prostitution, as hookers of both male and female versions carry a lot of condoms because they are having penetrative intercourse with a lot of people.

              Just because a woman is carrying a lot of condoms, that will not get her arrested. They have to be a suspected or known prostitute. Just want to clear that up for you https://www. [hivplusmag.com]

  • No doubt, it was used for harmless targeted advertising of chocolate ice cream.

    • Re: (Score:2)

      by 0xG ( 712423 )

      No doubt, it was used for harmless targeted advertising of chocolate ice cream.

      With genuine pickle chunks.

  • Here's to hoping (Score:5, Insightful)

    by Pollux ( 102520 ) <speter AT tedata DOT net DOT eg> on Wednesday August 06, 2025 @07:18AM (#65569570) Journal

    Here's to hoping that this success inspires other lawsuits to follow. I'm so sick and tired of these damned settlements; every one of them carries the line "Plaintiff alleges ... as redress for these grievances, defendant will..." meaning that no one is found guilty of wrongdoing, and it can't be used to determine guilt in any other court proceeding.

    Fuck our corporate overlords.

  • Once upon a time.... (Score:3, Insightful)

    by Ol Olsoc ( 1175323 ) on Wednesday August 06, 2025 @08:05AM (#65569636)
    People used to put all their private thoughts and activities in a diary, and became angry if any one read them.

    Today they post all of that publicly, and become angry if people don't read them.

    • This is actually incorrect as only a small number of people (percentage) post anything other than curated thoughts and activities. That's also not that different from people before, even going back to the early days of radio.

      What we need is something as tough, if not tougher, than GPDR in the US.

      • This is actually incorrect as only a small number of people (percentage) post anything other than curated thoughts and activities. That's also not that different from people before, even going back to the early days of radio.

        What we need is something as tough, if not tougher, than GPDR in the US.

        Or maybe people who take a joke for what it is, not go ackkually.

        • People labeled it insightful - so not taking it as a joke. I've known a couple YouTubers and they flat out stated they'd record for days to come up with 20 minutes of "good" footage for their channel. Now some of that is weather related (in the case of a travel channel) and some days you can't seem to get anything but word salad out (tech channel) leading to endless retakes.

          Those channels didn't hide the fact either, with the travel channel in particular noting that some days nothing seems to go well whe

    • Are you really equating a period tracking app to social media?

      • Are you really equating a period tracking app to social media?

        Are you really missing the point? What reason is there to share with the world that it is your period?

        Because there are - believe it or not - period trackers that don't share all of that, yet do the same thing. Just not on the internet. So unless your computer is hacked, it stays right on the computer.

        There are also some folks that consider the possibility this is a far right wing honeypot. While I doubt that, if you share intimate details to the Intertoobz in this day and age, you need to understand t

    • Re: (Score:2)

      by eepok ( 545733 )

      This is a vague statement about social media and has NOTHING TO DO WITH THE ARTICLE wherein people tracking their medical, health, and family planning efforts via an app, where they had a reasonable expectation of privacy, had that privacy infringed upon for profit. Moreover, given that some states have recently criminalized certain forms of family planning, these actions are seen as an extreme risk for the safety of those users.

      • This is a vague statement about social media and has NOTHING TO DO WITH THE ARTICLE wherein people tracking their medical, health, and family planning efforts via an app, where they had a reasonable expectation of privacy, had that privacy infringed upon for profit. Moreover, given that some states have recently criminalized certain forms of family planning, these actions are seen as an extreme risk for the safety of those users.

        Sit down my enraged friend And try not to use the caps lock. First thing is, learn to understand what a joke is, and try not to fly into a rage when all it does is makes you look demented.

        Second thing is - since you cannot see humor without taking a fit, I'll address this. Did you know that there are actual programs, and have been for years, that people have used to track their various cycles? Ovulation, menses, circadian rhythm. This ain't rocket science. IIRC I wrote one for the Commodore 64 way back

    • Once upon a time, people understood that free stuff was paid for by advertising.

      Now, they seem to be angry that marketers want to target them with ads when they use free apps.

  • How wasn't it Flo's fault? (Score:4, Insightful)

    by sabbede ( 2678435 ) on Wednesday August 06, 2025 @08:50AM (#65569720)
    Flo added the Facebook SDK. Flo sent the data. Isn't all this on them?

    What's wrong with this:
    "Flo sold your data to Facebook."
    "Facebook? Those bastards! I'm suing Facebook!"

    That doesn't make sense to me. Flo gave them the user data, Flo is at fault. Flo should have taken steps to make sure that data didn't go to anyone else. The recipients are not at fault for being given data they shouldn't have received.

    • Flo was named in the suit. They settled. It's right in the summary.

      • But why didn't it end there? They're the ones who disclosed information they shouldn't have and did it by integrating kits they knew would harvest data. If Flo didn't have permission to do it, that's on them. Is Facebook's due diligence to include vetting the practices of a vendor? That doesn't sound right.

    • Re: (Score:2)

      by mysidia ( 191772 )

      The recipients are not at fault for being given data they shouldn't have received.

      Facebook is not a naive recipient in the story though. Flo used Facebook's tools to develop their app.

      Facebook's user interface toolkit causes certain events such as clicking a certain button within an App to be sent back to Facebook to be logged and possibly data mined; most likely to allow users to be correlated to certain Ad audiences.

      What does not make sense is why would end users think that Facebook is not recording

      • Re: (Score:2)

        by sconeu ( 64226 )

        A website works fine without RECORDING the clicks. It's the difference between

        "The user clicked X; do Y" and
        "Record the fact that the user clicked X; now do Y".

      • Yeah, Flo used tools they knew harvested data and didn't make sure they weren't handing over data they shouldn't have.

        Which is why I'm baffled by the suit against Meta. They didn't do anything they don't already do legally. It just doesn't sound like they were at all at fault.

        You should take your last thought further. Expand it. Why would end users think that any service provided without payment isn't mining their data for sale to advertisers?
        I don't know much about Flo, but if it was "free", th

    • Re: (Score:2)

      by Himmy32 ( 650060 )

      How wouldn't the makers of the spyware tool not have liability for the data that they collected?

      Pawn shops are a pretty decent physical analog. If you set up a dropbox and distribute instructions and bags to place in the dropbox, then you turn around and sell the collected goods. If someone puts illegal materials such as those stolen from someone, why wouldn't you have liability for selling stolen goods?

      • Does the pawn shop know? They get bulletins from the police about stolen items. Did anyone tell Meta, "Flo is sending you data they shouldn't be collecting"? Hell, did Flo know it?

        Was Flo a paid service or "free"? At what point should the burden be on the user to recognize that "free" = "we harvest every bit we can and sell it"?

        I was listening to the radio, and one of the guys was talking about how he used some tool to see what apps were tracking what. He had an app he had installed for a music fe

        • Re: (Score:2)

          by Himmy32 ( 650060 )

          Does the pawn shop know?

          Most states require them to do their due diligence.

          Did anyone tell Meta, "Flo is sending you data they shouldn't be collecting"? Hell, did Flo know it?

          You can see what they require now. Blog post [facebook.com] and App Privacy Policy [apple.com] Neither seems to onerous.

          burden be on the user to recognize that "free" = "we harvest every bit we can and sell it"?

          Depends do they live in a jurisdiction that has privacy protections?

    • Re: (Score:2)

      by eepok ( 545733 )

      If I paid a member of your household to film you without your permission and send me the video, that family member would be guilty of a crime as would I.

      • That isn't what happened though. To fit your analogy, it would be me filming myself and giving it to someone so they could analyze it and give me a report, but who then also went ahead and sold it.

        If I filmed myself doing some stretches and sent the video to my chiropractor so he could tell me what I was doing wrong, and then he put it on YouTube, I'd be mad at him, not YouTube. How is this different?

        • Re: (Score:2)

          by eepok ( 545733 )

          I disagree with your assessment. Let's go through my proposed analogy detail by detail because I think it works.

          * Flo = Landlord
          * App = Rental residence
          * App terms and conditions = Rental Lease
          * Flo User = Resident
          * Using App = Walking around the residence
          * Recording actions in the app = The landlord filming walking around the residence (which you agreed to as a term of your lease)
          * Recording app open/close actions = The landlord filming entering and exiting the house
          * Facebook paying Flo for details on how

  • You've got to be out of your mind to use apps like this and give anyone this kind of information. In the wrong hands, it can get you arrested or killed.

    • Re:These apps are a TERRIBLE idea (Score:4, Informative)

      by CubicleZombie ( 2590497 ) on Wednesday August 06, 2025 @10:14AM (#65569838)

      It's a very common and useful thing if you're trying to get pregnant. People used to do it on paper. An app is much easier. And the app should respect your privacy.

      I have three kids thanks to one of these apps. And then I continued to use it to know what days to avoid being at home.

      • Don't get me wrong, I get the point of these apps, but you have to assume anymore that these apps are going to share any data they think they can monetize. And in this case, that data is of great value to the authorities in jurisdictions that have asserted a compelling interest in regulating pregnancy.

      • And the app should respect your privacy

        I agree with the principle, but in 2025 in the U.S. this is insanely naive. The ToS of virtually everything claim that they own every last bit of data you provide in perpetuity and God himself can't do a damned thing about how they use it. I'm not saying it's fair but currently our options appear to be:

        1. Self-host
        2. Use paper (as you mentioned)
        3. Do without

    • Having your period history in the wrong hands, could get you arrested or killed? I don't follow.

      • That's very useful information to a state that has asserted a compelling interest in knowing when women are pregnant. Some of the inevitable outcomes of that are women being arrested for having an illegal abortion (or even having a miscarriage that the state deems "suspicious") or women being forced to carry a dangerous pregnancy to term. Both of these situations have been documented, and states' access to women's reproductive data increase that likelihood.

        Read On [npr.org]

        • So states arrest women who miss a period? I highly doubt it.

          • Arresting a woman who missed a period and 9 months later doesn't have a baby is certainly on the trend line.

          • Some day it might occur to you that the 40-year fight to overturn Roe and the ensuing laws restricting abortion are going to end up with women being prosecuted for having an abortion. But that probably won't happen until it affects you or someone close to you.

  • This ruling makes no sense (Score:3)

    by magzteel ( 5013587 ) on Wednesday August 06, 2025 @11:40AM (#65570044)

    This is just a cash grab from lawyers trying to leverage a 1967 law meant to prevent eavesdropping on conversations. https://www.americanbar.org/gr... [americanbar.org]

    The three-part test in the jury ruling specifically refers to "conversations" being overheard and/or recorded using an electronic device. How is Meta "eavesdropping" on conversations? Flo used Meta's tools to voluntarily send Meta data. They knew what these tools did and how the data was used. The FTC investigated Flo for their practices, not Meta. As per the FTC article:

    "In its complaint, the FTC alleges that Flo promised to keep users’ health data private and only use it to provide the app’s services to users. In fact, according to the complaint, Flo disclosed health data from millions of users of its Flo Period & Ovulation Tracker app to third parties that provided marketing and analytics services to the app, including Facebook’s analytics division, Google’s analytics division, Google’s Fabric service, AppsFlyer, and Flurry.

    According to the complaint, Flo disclosed sensitive health information, such as the fact of a user’s pregnancy, to third parties in the form of “app events,” which is app data transferred to third parties for various reasons. In addition, Flo did not limit how third parties could use this health data.

    Flo did not stop disclosing this sensitive data until its practices were revealed in a news article in February 2019, which prompted hundreds of complaints from the app’s users.

    The FTC also alleges that Flo violated the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks, which, among other things, require notice, choice, and protection of personal data transferred to third parties."

    • Or Facebook(and all advertisers) need to get out of hoovering up data from anywhere they can... arguing that Meta isn't really eavesdropping because they record data from too many places to notice is a weak argument.

      • Or Facebook(and all advertisers) need to get out of hoovering up data from anywhere they can... arguing that Meta isn't really eavesdropping because they record data from too many places to notice is a weak argument.

        Meta didn't secretly hack into Flo and start collecting data or acquire this through some kind of tracking tags. Flo sent it to them intentionally. Regardless it strains credulity to think the California legislators in 1967 intended to write a law that applies to this situation when the internet wasn't even commercialized until 1995 and lawyers didn't give this theory a shot for another 30 years.

  • So, someone wants to use a app to track stuff. Right now, scanning that and selling it to others by the company can lead to JAIL TIME for women under utterly unConstitutional state laws, written and rammed through by men in the party whose members a) support rape; b) support pedophila (release the Epstrain files?), and c) *are* rapists and pedophiles (see how many of them have just been arrested this year alone).

    EULA my ass. It's a take-it-or-leave-it, and take it means they own you.

  • Shouldn't it be Flo's fault for mis-using the API rather than Facebook's fault for just writing a general purpose API?

    Or was Facebook untruthful in telling Flo how the data would be used?

  • I wish them the best, but I also don't feel very sorry for people that hop the fence at the zoo and get mauled by tigers. Like you should know better, and there were signs all over the place warning you.

Slashdot Top Deals

Competence, like truth, beauty, and contact lenses, is in the eye of the beholder. -- Dr. Laurence J. Peter

Close