Flo Health lawsuit: plaintiffs seek $1.1B judgment against Meta

Last updated: 2026-10-03

On 2026-09-28 Meta Platforms filed its opposition (ECF 851) to the plaintiffs' motion for entry of a final judgment (ECF 846) of $1,110,575,000 in Frasco v. Flo Health, Inc., No. 3:21-cv-00757-JD (N.D. Cal., Judge James Donato). The Flo Health lawsuit is the class action over the Flo period and ovulation tracker app, in which a jury found in August 2025 that Meta eavesdropped on or recorded Flo users' communications with the app without their consent. The trial evidence centered on the Facebook software development kit (SDK) in the app and users' answers to the app's onboarding questions. The plaintiffs ask for $5,000 each for 222,115 California Flo users they say are identified by name and address. Meta argues no judgment can be entered before class members come forward and Meta can challenge them. The judgment motion is set for hearing on 2026-10-29 at 11:00 a.m., the same day and time as the final approval hearing for the separate $59.5 million settlements with Google, Flo Health and Flurry.

What did the jury find against Meta in the Flo Health case?

The jury answered three questions under the California Invasion of Privacy Act (CIPA) on the verdict form (ECF 756), signed on 2025-08-01 and filed on 2025-08-04. It answered "Yes" to whether plaintiffs proved "that Meta intentionally eavesdropped on and/or recorded their conversation by using an electronic device", "Yes" to a reasonable expectation that the conversation was not being overheard or recorded, and "No" to whether Meta had "the consent of all parties to the conversation". Google and Flurry settled before trial and Flo during it; Meta was "the last defendant standing for the verdict", per the court's post-trial order of 2025-09-17 (ECF 776). That order denied Meta's motions for decertification, judgment as a matter of law and a new trial. It summarized the verdict:

The jury concluded that Meta had violated the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 632, by obtaining highly personal ovulation and menstrual period information communicated by women who used the Flo Period and Ovulation Tracker app.

The same order rejected a discretionary test for damages and quoted the statute, Cal. Pen. Code § 637.2(a)(1): a plaintiff may recover "Five thousand dollars ($5,000) per violation" (page 22). The class that went to trial against Meta is "expressly defined to consist of California residents" (page 17).

What did the trial record show the Facebook SDK sent?

The post-trial order summarizes the testimony of plaintiffs' expert Dr. Serge Egelman, who tested the versions of the Flo app available during the class period and captured the network traffic the Facebook SDK sent (pages 8–11). According to that summary:

• Each onboarding answer called a Flo function, LOG_SINGLE_EVENT, with an event name for the question and a value for the answer. The first question logged R_CHOOSE_GOAL with a value such as GOAL:GET_PREGNANT or GOAL:TRACK_CYCLE.
• That function then called LOG_EVENT_FACEBOOK, which ran Meta's code from com.facebook.appevents, "the part of the Facebook SDK that records app events."
• The SDK "recorded a host of information, including the event name and value parameter corresponding to the onboarding question and the user's answer", converted it into a "format that Meta might expect" and "transmitted it to Meta's servers."
• Dr. Egelman tied the transmissions to the SDK: "we went over the user agent string, which shows that it is, in fact, the Facebook SDK that's responsible for those transmission[s]."

The plaintiffs' motion describes the onboarding survey as "consisting entirely of questions about 'menstruation and/or pregnancy information'" and mandatory throughout the class period, with "the answers ... recorded by Meta" (ECF 846, page 4). This account comes from the court's summary and the plaintiffs' brief. The traffic captures and trial exhibits are outside the public filings read for this post, so the hosts, request paths and full payloads are not established here.

How did plaintiffs arrive at $1.1 billion?

Working with Covalynt (formerly ClaimScore), the plaintiffs identified "1,210,085 unique California Flo app users" in Flo's customer records, of whom 222,115 have "precise contact information, including their full name and current physical address" (ECF 846, page 4). Plaintiffs' counsel hired Covalynt "to perform identity resolution and data enrichment on [Flo] user records", according to a Covalynt declaration quoted in Meta's opposition. The plaintiffs request 222,115 times $5,000, or $1,110,575,000, under Fed. R. Civ. P. 54(b), the rule for a final judgment on fewer than all claims or parties. The other 987,970 California users would file claims through the process proposed in a separate motion (ECF 845). A footnote states the count may rise, because Meta's July 2026 data production excluded people "associated with an IP address used by 10-or-more Meta users."

What does Meta argue against the $1.1 billion judgment?

On due process, Meta's opposition argues (ECF 851, page 5):

Plaintiffs' proposal bypasses that opportunity altogether, because no class members would have to "come forward" before a ten-figure judgment is entered.

Meta states it "does not know—and has no way to find out—the identities of those 222,115 people". It cites the Ninth Circuit's decision in Nolen v. PeopleConnect, Inc., 2026 WL 2871735, for a defendant's right to challenge each claimant, and calls Covalynt "plaintiffs' own private, paid consultant." The brief quotes the court at the hearing of 2026-04-16 rejecting the plaintiffs' proposal of a judgment before claims ("we're not going to do that") and describing the judgment it would enter: "There's no cy-près. There's no undistributed corpus. Nothing. It's just going to be literally the number of people who filed a claim multiplied by 5,000" (page 8). On judicial economy, Meta writes that the proposed judgment "would resemble nothing so much as Frankenstein's monster" and would force "an immediate appeal" on the § 632 verdict, class certification, the post-trial process and damages, followed by a second appeal for the remaining claimants (page 6).

The parties also dispute class notice. On 2026-09-08 Meta filed an emergency motion (ECF 844) to "terminate and retract" class notice it calls unauthorized, alleging that plaintiffs' counsel caused the administrator, A.B. Data, to send text messages "on plaintiffs' behalf". The plaintiffs' reply of 2026-09-30 (ECF 854) on the claims program says Meta's critiques reflect "Meta's self-interest; it is adverse to the Class and motivated to suppress notice."

Source: CourtListener docket, read 2026-10-03. The docket sets the plaintiffs' reply on ECF 846 for 2026-10-05. ECF 855, filed 2026-10-02, is the plaintiffs' corrected reply in support of ECF 845, per the court's case page.

What is the Flo Health settlement payout per person, and when is the claim deadline?

The settlements cover a nationwide class: users of the Flo app in the United States "who entered menstruation and/or pregnancy information" between 2016-11-01 and 2019-02-28 (preliminary approval order of 2026-04-22, ECF 834). Google pays $48,000,000 and Flo $8,000,000 (ECF 820, page 11), on top of an earlier $3,500,000 settlement with Flurry (page 15), for $59.5 million in total.

The plaintiffs' final approval motion (ECF 842) estimates an average pro rata payment of $31.94 per class member at a 10% claims rate and $12.69 at 25%, and gives claimants who show they belong to the California Subclass ("e.g., by providing a valid California address") twice the pro rata share of claimants from other states. The settlement website sets these dates:

• Claims: online by 11:59 p.m. Pacific on 2026-10-15, or by mail postmarked by 2026-10-15.
• Objections: filed with the court by 2026-10-08.
• Final approval hearing: 2026-10-29 at 11:00 a.m. Pacific.
• Opt-out: the deadline was 2025-07-20.

What a CITT scan and capture show for a period tracker app

Flo's Android package is org.iggymedia.periodtracker. A static scan of a current build lists the SDKs present, each cited to the file and the class or manifest entry where it was found. For the Facebook SDK the rule pack checks for classes under com.facebook.appevents, the package named at trial, and for manifest settings such as com.facebook.sdk.AutoLogAppEventsEnabled, which Meta's Android App Events guide documents as the switch for automatically logged events. Presence in the binary establishes the code, and only a capture establishes what was sent.

A capture on a test device records each request's host, path and payload, and whether it was sent before or after any consent prompt. For a period tracker, the test is to complete onboarding with known answers and check whether those answers, or event names derived from them, appear in outbound requests. A capture of a 2026 build shows 2026 behavior and establishes nothing about the 2016–2019 class period.

What a scan checks and the limits of a scan are on the methodology page. Rodriguez v. Google, the $425.7M Firebase verdict, is another jury verdict over app SDK data in the Northern District of California. Section 632 keeps its private right of action under California SB 690. I run these scans and captures for lawyers and for researchers working with lawyers. Sign up for a CanITrustThat (CITT) account to run your own research, let us run an investigation for you, or browse the scanned apps.