The Flo Period Tracker Lawsuit, Explained

Two related proceedings, often blurred together in headlines.

First, the FTC case. In January 2021 the Federal Trade Commission alleged that from June 2016 to February 2019, Flo Health shared the health data of millions of users — including menstrual details and pregnancy status — with third-party analytics and marketing firms, among them Facebook's and Google's analytics divisions, AppsFlyer, and Flurry. The mechanism was embedded software development kits (SDKs): Flo passed sensitive information like "pregnancy" inside custom app-event data. Flo's privacy policy at the time promised this data would not be shared. Flo stopped sharing with Facebook the day after a February 2019 Wall Street Journal exposé intercepted the transmissions.

Second, the class action: Frasco v. Flo Health, filed in 2021 in federal court in California against Flo, Google, Meta, and Flurry, covering users who entered menstruation or pregnancy data in the app between November 1, 2016 and February 28, 2019. Its claims included violation of California's medical-confidentiality and wiretapping laws. That case produced the 2025 settlements and the Meta jury verdict described below.

Important precision: Flo settled both matters without any court finding that it broke the law, and it denies all the allegations.

Both figures are real; they count different things. Three defendants settled the class action in 2025: Google agreed to pay $48 million, Flo $8 million, and the analytics firm Flurry $3.5 million. The total settlement fund is therefore $59.5 million.

The "$56 million" widely reported in September 2025 (via Reuters and others) is the Google and Flo settlements added together — announced at the same time — excluding Flurry's earlier $3.5 million deal. So: $56M is Google + Flo; $59.5M is the full fund. Flo's own share, for clarity, was $8 million.

Two things the numbers don't say. The settling companies all deny wrongdoing — the official settlement notice states the court did not decide whether Flo, Google, or Flurry broke the law; they settled to end the litigation. And Meta is not part of either figure: it refused to settle, went to trial, and lost a jury verdict instead, with damages still unresolved.

Meta was the one defendant that didn't settle. The case went to trial in July 2025, and on August 1, 2025 a unanimous federal jury found that Meta had violated the California Invasion of Privacy Act (CIPA) — the state's wiretapping law — by collecting Flo users' menstrual data through its SDK without consent. It was the first major CIPA case to reach a jury verdict, and it applies to the California subclass of users.

What it means in dollars is still open. CIPA provides statutory damages of $5,000 per violation; plaintiffs have sought that per class member, and press reports say the judge signaled total exposure could reach several billion dollars — Meta itself told the court its exposure could be "multiples of billions." As of mid-2026, no final damages amount had been set, the judge had denied Meta's post-trial motions, and Meta had said it "vigorously disagrees" with the outcome and signaled an appeal, maintaining that its terms prohibit developers from sending it health data at all.

So the accurate one-liner is: a jury found Meta liable for wiretapping Flo users' data; how much Meta will pay, if the verdict survives appeal, hasn't been decided.

Yes, at the time this page was last updated. The official settlement website is PeriodTrackerDataPrivacyLitigation.com, administered by A.B. Data (phone 1-866-778-9626). Be wary of lookalike sites — claims are free to file and no legitimate party asks you to pay.

Who qualifies: anyone in the United States who used the Flo app between November 1, 2016 and February 28, 2019 and entered menstruation and/or pregnancy information during that window.

Key dates: claims must be submitted online by October 15, 2026 (11:59 p.m. Pacific) or postmarked by that date; the final approval hearing is scheduled for October 29, 2026 in San Francisco. Payments are pro rata — the amount per person depends on how many valid claims come in — and California class members who submit documentation receive double the base share, reflecting the state-law claims.

One more nuance worth knowing: any money from the Meta verdict is separate from this settlement fund. Eligible California users will be contacted later about that process, and filing a settlement claim now does not waive Meta-verdict rights. Check the official site for current status, since deadlines and details can change.

Less than most people assume — which is itself instructive about how thin US health-app regulation is. The consent order, finalized in June 2021, carried no monetary penalty. It required Flo to: stop misrepresenting its data practices; obtain users' affirmative express consent before sharing health information with anyone, with clear disclosure of what's shared, with whom, and why; instruct the third parties that had received user data to destroy it; notify affected users; and undergo an independent review of its privacy practices.

Two FTC commissioners dissented in part, arguing Flo should also have been charged under the Health Breach Notification Rule — the rule the agency did later use against the Premom ovulation app in 2023, extracting a $100,000 penalty there.

The structural lesson sits underneath the legal one: every mechanism in the complaint involved data flowing from the phone to servers and SDKs. Regulation punished the broken promise after the fact; it did not, and cannot, un-share the data. Architecture that never sends cycle data off the device is the only version of "private" that doesn't depend on a company keeping its word.

Fairness requires the other side. Flo has consistently denied all allegations. Its position: it has never sold user data; the SDKs at issue were standard analytics tools used for app performance, not advertising; and the litigation was about transparency of how those tools operated. Announcing the 2025 settlement, Flo said it settled "solely to eliminate the uncertainties, burden, expense, and delay" of litigation, and its public statements assert that "any allegation" it unlawfully shared data "has no merit."

Flo also points to changes made since 2019: it removed the SDKs in question, commissioned an external privacy audit in 2022, obtained ISO 27001 security certification, launched an "Anonymous Mode" that decouples usage from identity (later open-sourced), and set up a privacy advisory board. Those are real improvements, and the settlement notice's own language applies: no court has found that Flo broke the law.

Two caveats for completeness: Anonymous Mode still stores cycle data on Flo's servers — it removes the identity linkage, not the server copy — and press reports in June 2026 noted a Dutch digital-rights group had filed a complaint about Flo's data handling with the Dutch privacy regulator, so scrutiny hasn't ended. Users switching away can see our step-by-step migration guide at /leave-flo.