Lawsuit claiming Flo Health app shared intimate data with Facebook greenlit as Canadian class action

• RCI

Claim says Flo shared users’ sensitive data, like details around periods and sex lives

A Canadian class-action lawsuit accusing a popular fertility tracking app of sending users’ intimate health information — including details about their periods, sex lives and pregnancies — to companies like Facebook without their knowledge has been allowed to go ahead.

The claim, certified in B.C. Supreme Court on Thursday, said Flo Health collected their highly sensitive personal information, promised to keep that information private and then knowingly shared the data with third parties.

There’s been a significant disclosure of the private information of Canadian women, and we’re excited to be proceeding to the next step with the case, said Richard Parsons, who is co-counsel on the case.

The ruling is a pivotal step forward for the case. It will test lagging Canadian privacy laws in a time when millions of people regularly pour their personal information into their phones. If the claim succeeds, more than one million people who used Flo in Canada over a three-year period will be eligible to claim damages.

None of the lawsuit’s claims have been proven in court. In a statement to CBC News on Friday, Flo said it has never sold user information or shared user information with third parties for the purposes of advertising.

Flo will vigorously defend against allegations stipulated in the case.

Lead plaintiff used app while trying to get pregnant

Flo is an app that tracks users’ fertility and periods. Users enter personal information about their height, weight, sex lives and reproductive cycles — including details about their periods, vaginal discharge, pregnancies, miscarriages, births and postpartum symptoms.

Jamie Kah Cate Lam, the lead plaintiff in the class action, said she used the Flo app for 18 months while she and her husband were trying to conceive. The B.C. woman gave the app information about the different stages of her menstrual cycle and how often she and her husband were having intercourse, according to an affidavit.

After her son was conceived in 2017, Lam continued to use the app in pregnancy mode. Her son was born in April 2018, and she later deleted the app.

Legal expert urges American women to delete period tracking apps

Danielle Citron, a professor of law at the University of Virginia School of Law, says health data collected by smartphone apps could be used to prosecute U.S. women for having illegal abortions.

In 2019, The Wall Street Journal published (new window) an article saying Flo gave users’ sensitive personal information to Facebook and other companies without their knowledge. Testing commissioned by the newspaper showed Flo told Facebook when an app user was on their period or trying to get pregnant.

Lam declined an interview request. In her affadavit, she said she was shocked to learn that Flo Health had disclosed my personal information to Facebook and others, despite my clear understanding when I downloaded the Flo App that my information would be kept private.

The U.S. Federal Trade Commission (FTC) launched an investigation following the Journal’s story, and alleged the company had broken its promise to keep users’ data private by sharing it.

As part of a settlement with the U.S. agency in 2021, Flo was required to obtain users’ consent before sharing their health information. The company did not admit guilt in the settlement, and has said it does not share data without people’s permission.

Flo did not at any time share users’ names, addresses or birthdays with anyone. We do not currently, and will not, share any information about our users’ health with any company unless we get their permission, the company said in a statement at the time.

It said it settled with the FTC to avoid the time and expense of litigation.

Facebook CEO Mark Zuckerberg makes the keynote speech at F8, Facebook’s developer conference in San Jose, Calif., on May 1, 2018.
Photo: Reuters / Stephen Lam

In greenlighting the Canadian class action on Thursday, B.C. Supreme Court Justice Lauren Blake said the class would include all Canadian residents, excluding those in Quebec, who used the Flo app between June 1, 2016 and Feb. 23, 2019.

There are over a million Canadian users of the app in the proposed class. I am satisfied that … a class-action proceeding will still provide significant advantages in judicial economy and efficiency, Blake wrote.

A class-action certification does not mean the allegations have been proven, but that lawyers showed there is a group that might benefit from the case going before a judge.

At the heart of the issue is an analytics tool that both Facebook and Google offer app developers called software-development kits, or SDKs. Developers use SDKs to better understand users’ behaviour or to collect data they can use to increase their user base.

In return, apps share user data with Facebook or Google so the tech giants can then personalize ads and other content — a mutually beneficial arrangement, in which a person’s personal information becomes the commodity, Parsons said.

They’re bartering, and what they’re bartering with is the data of the users.

Generally speaking, Parsons said, any information shared with an app using an SDK can also be shared with the company that owns the SDK — so users’ personal data that was shared with Flo could also be shared with Facebook, because Flo was using Facebook’s SDK.

Parsons said the problem is Flo wasn’t upfront with its users about how far their information might be shared.

If an app developer wants to use SDKs of those data-collecting agent companies, then their privacy policy needs to clearly tell users that the data is going to be going to these third parties, he said.

Rhianna Schmunk (new window) · CBC News