Google, Flo settle privacy suit for $56M

Google and app developer Flo Health have agreed to pay $56 million to settle a class-action lawsuit for violating the privacy of millions of Flo app users.

A class action lawsuit was filed against both companies for allegedly collecting information about the menstrual cycles of millions of Flo users and using it for targeted advertising.

Flo, a period and fertility tracking app with more than 70 million monthly users, allows people to log deeply personal information, including period dates, ovulation windows, preferred birth control methods, sexual activity, symptoms, and health concerns.

Flo app users claim that between November 2016 and February 2019, Flo shared personal information related to their menstrual periods and pregnancies with Google, despite promising to keep their sensitive health information confidential. This constitutes a violation of the California Invasion of Privacy Act (CIPA).

According to court documents, Google obtained access to the personal information via a software development kit (SDK) that the company provided to Flo for integration into the Flo app. Google then used this information to offer personalized ads and push notifications on social media sites, the Flo app, and email.

Google and Flo have agreed to a settlement to end the class-action lawsuit. Google will pay $48 million, and Flo will pay $8 million. Flurry, a now-defunct mobile analytics company, settled for $3.5 million in March.

In a statement to Reuters, Google said that no data was used for ads and that customers are prohibited from using Google Analytics to collect health information protected under the federal Health Insurance Portability and Accountability Act (HIPAA).

And the class-action lawsuit isn’t over yet. Meta, which was found liable for harvesting sexual health data from Flo in August, refused to settle. Facebook’s and Instagram’s parent company is expected to appeal the verdict.