Flo Health $59.5 Million Settlement Over Unauthorized Sharing of Sensitive Health Data

Flo Health’s “Flo” period-and-pregnancy tracking app became the center of a privacy dispute after plaintiffs alleged that, between late 2016 and early 2019, the app included third‑party software (SDKs) from companies like Flurry, Google, and Meta that transmitted users’ sensitive health details—such as menstruation and pregnancy information—without proper consent. The plaintiffs argued this violated California’s Confidentiality of Medical Information Act and other privacy protections, including restrictions tied to how private health data can be shared and how personal information is handled under state privacy laws and related contracts. Flo, Google, and Flurry denied wrongdoing but agreed to settle $59.5 million to avoid the expense and uncertainty of continued litigation, while the court has not ruled that any defendant actually committed the alleged misconduct. The class action was filed to represent many affected users and to seek money damages where consent and transparency may have failed around health data sharing. Its significance is twofold: first, it provides a concrete pathway for eligible app users to submit a claim and potentially receive pro‑rated compensation (with California residents receiving a larger share), and second, it signals that regulators and courts are increasingly willing to treat health and reproductive information as especially protected. The settlement also sits alongside a separate development involving Meta: a federal jury later found Meta liable under California’s Invasion of Privacy Act for intercepting health data, though Meta is appealing and that potential recovery is independent from this $59.5 million fund. Broader implications extend beyond one app. Because mobile analytics and advertising SDKs are common across the industry, the case highlights how app developers and ad-tech vendors must align with privacy expectations and regulations such as the California Consumer Privacy Act (CCPA) and California’s stricter medical privacy rules, as well as federal privacy principles applied through consent, notice, and data security practices. Similar lawsuits have targeted the “hidden sharing” problem—where sensitive information flows to third parties through embedded tools rather than clearly explained user controls—making the Flo settlement a notable benchmark for how courts may evaluate disclosures, consent, and the handling of intimate health data, while users are encouraged to file legitimate claims before the deadline to participate in the payout process.