A federal jury in San Francisco has found Meta Platforms, Inc. guilty of violating the California Invasion of Privacy Act (CIPA) by illegally collecting sensitive health data from users of the Flo period-tracking application. The verdict, delivered on Friday, August 5, 2025, concludes a class-action lawsuit alleging that Meta "eavesdropped" on millions of users without their consent, as initially reported by ZeroHedge. This landmark ruling underscores growing scrutiny over digital privacy practices and the responsibilities of tech companies in handling personal information.
The lawsuit, filed in 2021, represented over 3.7 million U.S. users who registered with the Flo app between November 2016 and February 2019. Plaintiffs claimed that Meta's Software Development Kit (SDK), embedded within the Flo app, covertly transmitted intimate details such as menstrual cycles, sexual activity, and pregnancy-related information to Meta. The jury determined that Flo users had a reasonable expectation of privacy and that Meta lacked the necessary consent to collect or record this data.
Other companies named in the original lawsuit, including Flo Health itself, Google, and analytics firms like Flurry and AppsFlyer, had previously settled with the plaintiffs. Meta, however, chose to proceed to trial, denying allegations of receiving intimate health information and asserting that its terms prohibited developers from sending such sensitive data. Despite Meta's defense, the jury found sufficient evidence that the company intentionally accessed this private information.
Attorneys for the plaintiffs hailed the verdict as a "wake-up call" for the technology industry, emphasizing that it sends a clear message about the protection of digital health data. The California Invasion of Privacy Act allows for penalties of $5,000 per violation, potentially exposing Meta to billions of dollars in damages given the large class size. This decision highlights the critical need for transparency and explicit user consent in data collection, particularly concerning highly personal health information.
The case's outcome is expected to have significant implications for how tech platforms integrate third-party tools and manage user data, especially within health and wellness applications. While Meta has not yet commented on the verdict, it is anticipated that the company may pursue an appeal. The ruling reinforces the principle that even large corporations are accountable for adhering to privacy laws and respecting consumers' most intimate information.