A California jury has found Meta in violation of state user privacy laws in a class-action suit brought by users of period tracking app Flo, who alleged that the tech giant collected private menstrual health data without users’ consent and used it for ad-tracking purposes.
The plaintiffs, claiming to represent millions of Flo users, had accused Flo and Meta of collecting private health data, like their period dates and fertility goals, via Flo’s app without permission, therefore violating California Invasion of Privacy Act. 
Filed in 2021 against Flo, the lawsuit also named Meta, Google, and ad analytics companies AppsFlyer and Flurry as defendants, though Google settled the case in July, and Flo did so earlier this month.
"This verdict sends a clear message about the protection of digital health data and the responsibilities of Big Tech," said Michael P. Canty and Carol C. Villegas, lead trial attorneys in the case. 
"Companies like Meta that covertly profit from users’ most intimate information must be held accountable. Today’s outcome reinforces the fundamental right to privacy — especially when it comes to sensitive health data," they added.
Meta disagreed with the verdict and said that the company never eavesdropped on Flo users.
"We vigorously disagree with this outcome and are exploring all legal options. The plaintiffs’ claims against Meta are simply false. User privacy is important to Meta, which is why we do not want health or other sensitive information, and why our terms prohibit developers from sending any," a company spokesperson said in a statement.

Jury rules Meta violated California privacy laws by quietly collecting Flo users' menstrual health data

A California jury ruled Meta violated state privacy laws by collecting private menstrual health data from Flo app users without consent. The class-action lawsuit, filed in 2021, named Meta, Google, and ad analytics firms AppsFlyer and Flurry as defendants. Google settled the case in July 2025, while Flo reached a settlement earlier that year. Meta disputed the verdict, claiming it never accessed Flo user data.