On May 22, 2025 (three days after ruling on class certification), the Judge Donato in the Northern District of California issued a summary judgment order in the ongoing privacy litigation involving Flo Health, Inc., Meta (Facebook), Google, and other technology companies. The case centers on allegations of improper data collection and sharing by a popular reproductive health app, raising questions about user consent, privacy laws, and the treatment of sensitive medical information.
The court’s order granted and denied summary judgment on various claims, clarifying which issues will proceed to trial and which have been resolved in favor of the defendants.
Meta (Facebook):
- Wiretap Act Claim Dismissed: The court granted summary judgment for Meta on the federal Wiretap Act claim, finding that Flo Health had consented to Meta’s data collection practices, which is a statutory defense.
- California Privacy Claims Proceed: Claims under the California Invasion of Privacy Act (CIPA) will move forward. Notably, the § 632 claim will proceed on a classwide basis for California users, while the § 631 claim is limited to certain named plaintiffs.
Disputes of fact abound with respect to the scope of consent, the timing of Meta’s “interception” or “eavesdropping,” whether Meta “intended” to intercept communications, whether Meta’s interception occurred while the communications were “in transit,” and the like.
- Computer Data Access and Fraud Act (CDAFA) Claim Dismissed: The court dismissed this claim due to the exclusion of plaintiffs’ expert and lack of evidence of financial loss.
- Aiding and Abetting Intrusion Upon Seclusion Claim Dismissed: The court found insufficient evidence that Meta aided and abetted Flo’s alleged privacy violations.
- Unfair Competition Law (UCL) Claim Dismissed: Plaintiffs agreed to dismiss this claim.
Flo Health:
- Statute of Limitations Defense Denied: The court rejected Flo’s argument that all claims were time-barred, finding that factual disputes exist regarding when users learned of the alleged misconduct and whether Flo’s disclosures were adequate.
- Class Waiver in Terms of Use Not Enforced: For the reasons set forth in its ruling on class certification, the court declined to enforce Flo’s class action waiver, allowing class claims to proceed.
- Contract and Unjust Enrichment Claims Narrowed: Summary judgment was granted for Flo on implied contract and UCL claims, as well as on unjust enrichment to the extent it was asserted as a standalone cause of action.
- Medical Information Privacy Claims Proceed: The court denied summary judgment on claims under California’s Confidentiality of Medical Information Act (CMIA), finding that factual disputes remain about whether Flo qualifies as a “provider of health care” and whether the data at issue constitutes “medical information.” The court also rejected Flo’s argument that the data was de-identified and thus not protected.
- Claims by Certain Plaintiffs Dismissed: All claims by one plaintiff who used the app after the class period were dismissed.
Frasco v. Flo Health, Inc., No. 21-cv-00757-JD, 2025 U.S. Dist. LEXIS 98179 (N.D. Cal. May 22, 2025).
