Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A federal jury found Meta Platforms, Inc. liable on August 1, 2025, under California Penal Code §632 for intercepting or recording sensitive communications sent through the Flo period-tracking app without users’ consent. The verdict covered a certified California subclass—not every Flo user—and concerned one California Invasion of Privacy Act (CIPA) claim. On September 17, 2025, the district court denied Meta’s requests to overturn the verdict, decertify the class or hold a new trial. That surviving verdict does not yet tell users what they will be paid.
What the jury actually decided
The case, Frasco v. Flo Health, Inc., et al., was tried in the U.S. District Court for the Northern District of California. The jury found that Meta violated CIPA §632 by obtaining, through its software development kit (SDK), communications that Flo users sent in the app without the consent required under California law. The information described by the court included menstrual-period and ovulation-related data.
This was not a verdict on every privacy theory originally pleaded. It was a finding against Meta on the remaining CIPA claim for the certified California subclass. The amended post-trial order left the unanimous verdict and class intact. Read the amended post-trial order.
How information entered Flo could reach Meta
An SDK is a bundle of software tools embedded in a mobile app. Developers use SDKs for analytics, advertising, measurement and other functions. An SDK can receive structured events generated when a user performs an action in an app.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- A user entered or generated information in Flo.
- Flo used third-party SDKs, including Meta’s and Google’s.
- Flo’s “Custom Event” fields could package details about an in-app action.
- The app transmitted those events to the companies whose SDKs were installed.
- Plaintiffs argued that sending private, sensitive events this way amounted to interception or recording under CIPA.
The case involved mobile-app SDK transmissions, not simply a conventional website cookie or browser pixel. An SDK is not inherently unlawful; the dispute was about what data was transmitted, users’ expectations of privacy, consent and the companies’ roles in handling the communications. The court said the evidence could support a classwide finding that Meta and Google intercepted and recorded communications through their SDKs and that users reasonably expected those communications to remain private. See the court’s discussion of the SDK evidence.
What data was involved
The court’s post-trial order refers to Flo “Custom Event” fields containing menstruation and pregnancy information. Flo prompts described in the litigation asked users for highly personal details, which could include:
- Menstrual-cycle timing and period information;
- Ovulation or fertility-related information;
- Pregnancy-related information;
- Birth-control preferences; and
- Sexual-activity information.
The verdict does not establish that every item entered into Flo was sent to Meta, nor that Meta secretly accessed users’ phones independently of the app. The legal theory was that communications transmitted through the app’s SDK integrations were intercepted or recorded without the required consent.
Who was in the California subclass?
The certified California subclass covered Flo users who met all of these conditions:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- They were residing in California;
- They entered menstruation and/or pregnancy information into Flo; and
- They did so from November 1, 2016, through February 28, 2019, inclusive.
That definition does not automatically include current Flo users, people who used Flo outside California, or people who entered only general wellness information. Deleting an account or no longer having the associated email address does not by itself determine eligibility. The court’s class-certification order contains the formal definitions. Review the class-certification order.
What happened to Flo, Google and Flurry?
Meta was the defendant remaining for the jury’s liability decision. The procedural outcomes were different for the other companies:
| Company | Outcome | What it means |
|---|---|---|
| Meta | Jury liability verdict on August 1, 2025 | A CIPA §632 finding that survived Meta’s district-court post-trial motions |
| Flo | Settled during trial; binding memorandum dated July 30, 2025 | Settlement, not a jury finding of liability |
| Settled before trial | Settlement, not a jury finding of liability | |
| Flurry | Settled before trial | Settlement, not a jury finding of liability |
| AppsFlyer | Voluntarily dismissed early in the litigation | No trial verdict against the company |
A settlement resolves claims under negotiated terms; it is not the same as losing a jury trial or admitting wrongdoing. The litigation timeline and settlement terms are described in the filed agreement. View the settlement filing.
Does the verdict mean users get $5,000?
No individual payout from Meta has been announced. Plaintiffs sought up to $5,000 in statutory damages per class member under their CIPA theory. Meta disclosed that plaintiffs estimated the class could include approximately 1.6 million people, while also saying the potential damages amount was uncertain. See Meta’s filing.
That $5,000 figure is a damages demand or statutory-damages theory—not a jury award to each person. Any eventual amount could be affected by post-trial proceedings, appeals, statutory interpretation, class administration and a possible settlement. Multiplying the claimed class estimate by $5,000 would be only a theoretical exposure calculation, not a confirmed judgment or payment.
Proposed settlements and how to check eligibility
The class-counsel information page currently lists proposed settlements totaling $59.5 million involving Flo, Google and Flurry. It lists October 15, 2026, as the claim deadline and October 29, 2026, as the settlement hearing date. Those administrative details and the settlement’s final approval should be confirmed in the latest court-approved notices.
Use the official settlement portal at periodtrackerdataprivacylitigation.com to check the current notice, administrator instructions and claim requirements. A person may need to submit a claim even if they received notice. The listed $59.5 million is an aggregate fund, not a guaranteed payment per claimant; administrative costs, attorneys’ fees, service awards, valid-claim rates and court approval can change distributions. Opting out can affect settlement eligibility and any retained rights under the applicable notice.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Meta says
Meta disputed the allegations and the verdict. Its public response said the claims were false, that Meta did not want health or other sensitive information, and that its terms prohibited developers from sending such data. Those are Meta’s positions; the jury nevertheless found liability on the specific CIPA claim, and the district court declined to disturb that result. Read the contemporaneous report on Meta’s response.
What happens next?
The September 17, 2025 amended order denied Meta’s motions for judgment as a matter of law, a new trial and decertification or reconsideration of the California class. The verdict therefore survived the district-court challenges described in that order. It is still not the same as a completed payment to class members. Any appeal, later judgment or further challenge should be checked on the federal district-court and Ninth Circuit dockets before relying on the outcome as final.
Why the case matters beyond Flo
- Mobile SDKs are privacy infrastructure. Sensitive events can leave an app through embedded software even when a user never visits a social-media website.
- Consent depends on context. A privacy policy or app setting may not answer whether users understood that particular health-related events would be transmitted to an advertising or analytics platform.
- Responsibility is distributed. App developers, SDK vendors, analytics providers and advertising platforms may each face different questions about data minimization, configuration and notice.
- The ruling is not nationwide law. It applies California’s CIPA in this particular federal class action and does not establish liability for every Meta SDK integration or every health app.
For consumers, the practical lesson is to review an app’s data-sharing disclosures and permissions, especially for period, fertility, pregnancy or sexual-health features. For developers, the case highlights the need to inventory SDK event payloads, exclude sensitive fields unless genuinely necessary, document consent and test what leaves the device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
