Meta Found Guilty of Collecting Women’s Menstrual Health Data via Flo App

In a powerful judgment that underscores the urgency of digital privacy reform, a federal jury in San Francisco has found Meta Platforms Inc. (formerly Facebook) liable for unlawfully collecting and recording intimate menstrual health data of millions of women through the widely used period tracking app, Flo. Delivered on August 1, 2025, the verdict is a turning point in privacy law, directly challenging the way tech giants handle sensitive personal data.

Behind the Verdict: How Private Health Became Public Property

The controversy dates back to a damning discovery: Flo Health, creator of the Flo menstrual tracking app, had embedded a software development kit (SDK) in its platform that allowed third parties, including Meta and Google to access users’ private data. This included period start and end dates, pregnancy intentions, fertility windows, and even sexual activity logs.

The most troubling part? Users were largely unaware their reproductive health data was being transmitted, let alone leveraged for targeted advertising. The court heard evidence that this data collection happened without clear user consent, violating the California Invasion of Privacy Act (CIPA).

What the Jury Found

The jury unanimously ruled that Meta had covertly recorded users’ health information in violation of state privacy laws. The defense’s argument that anonymization or removal of names justified the data sharing was firmly rejected. According to the court, the very act of collecting sensitive health information without proper, informed consent was a violation, regardless of whether names were attached.

The ruling emphasized that users had a reasonable expectation of privacy, especially regarding intimate reproductive health data, and Meta's data harvesting breached that trust.

Flo Health’s Role and Its Quiet Exit

While Meta fought the lawsuit in court, Flo Health reached a settlement earlier this year. Though the company did not admit wrongdoing, it agreed to improve its user consent systems and submit to independent privacy audits. This was not Flo’s first privacy scandal, back in 2021, it settled with the U.S. Federal Trade Commission (FTC) after misleading users about its data practices.

Google, initially named in the lawsuit, also settled and exited before the trial began, leaving Meta as the sole tech company to face the jury's verdict.

Why This Matters Beyond the Courtroom

This ruling serves as a loud warning shot to the tech industry:

1. Transparent, affirmative consent is non-negotiable when handling health-related user data.
2. Claims of anonymization or fine print in privacy policies will not hold up if users are not fully aware and in control of their data.
3. The moment data is collected not just how it’s used later, is now under legal scrutiny.
4. Courts are taking user feelings of “violation” and betrayal seriously, especially around health and reproductive data.

A Consumer Reckoning

The public reaction has been visceral. Many users reported feeling "manipulated" and "violated" upon learning that their reproductive health data had been monetized for ad targeting. These were deeply personal, sensitive insights that users assumed were staying on their phones, not flowing into ad networks.

This ruling represents not only legal accountability but also a cultural shift. Users are now demanding more than checkbox consents, they want clarity, dignity, and ownership of their private data.

The Regulatory Landscape Is Changing

In response to growing concerns over the misuse of health data, regulatory bodies like the FTC have increased their scrutiny of digital wellness and health apps. The Flo-Meta case could inspire new laws or amendments to existing data protection frameworks, especially in the U.S. where privacy legislation still lags behind Europe’s GDPR.

Other health-focused apps may soon find themselves under similar scrutiny if they haven’t reviewed their data-sharing practices. This case has effectively placed every wellness app on notice.

The Bigger Picture

What happened in this courtroom isn’t just about one app or one company, it’s about the ethics of the digital age. In a world where health data is increasingly digitized, monetized, and stored in the cloud, this ruling puts the power back at least partially into the hands of users.

Meta’s legal defeat is a defining moment in the battle for digital autonomy. It sets a precedent that sensitive health information is not a commodity and exploiting it comes at a cost.

Conclusion

The Meta-Flo case is more than just a privacy lawsuit, it is a wake-up call for the tech industry and a milestone for users everywhere. It reminds us that the information we share about our bodies often during vulnerable moments must be protected with the utmost respect and transparency. For tech giants, the message is now unmistakable: violate that trust, and you will be held accountable.