Updated on
A jury found Meta illegally collected Flo users' period data in 2025; a year on, the damages fight has shrunk from billions to $1.1 billion.
In August 2025, a California federal jury found that Meta had illegally collected sensitive data from users of the Flo period-tracking app, violating the state's wiretap law, the California Invasion of Privacy Act. As The Verge reported, the jury concluded Meta had intentionally eavesdropped on in-app communications. Over a year later, the case is no longer about whether it happened. It is about how much it costs.
The 2021 lawsuit named Flo, Google, Meta and the analytics firm Flurry. It alleged that between November 2016 and February 2019 Flo let outsiders eavesdrop on what users entered, despite promising to keep reproductive health information private. Flurry settled in March 2025, Google settled weeks before trial, and Flo settled on 31 July 2025, according to the National Law Review, leaving Meta alone at trial. Plaintiffs said the data flowed through a software development kit embedded in the app, per The Record.
The money is where the story has moved. Each violation can carry a $5,000 penalty, and early commentary floated a potential exposure of $190 billion across about 38 million class members. He also called Meta's objections to the damages proposal not grounded in reality.
The latest figure is smaller still. On 29 September 2026, MLex reported a proposed $1.1 billion judgment covering about 222,000 California residents, which Meta is opposing. Its argument is a due-process one: it says it deserves a fair chance to present defences when class members actually come forward, and a ten-figure judgment entered before anyone does bypasses that. Meta has also said throughout that it vigorously disagrees with the verdict.
We would be careful with the shrinking numbers. The headline totals fell because the group of people who can claim fell, not because the conduct looked any less serious. Meanwhile the Flo case shows a pattern we keep seeing: the app promises privacy, an analytics SDK quietly does something else, and the user finds out years later through a newspaper or a courtroom.
Our take: this verdict matters less for the final dollar amount than for the precedent. A wiretap claim reached a jury and won against a Big Tech firm, as the National Law Review notes, and privacy advocates called it one of the first major verdicts on how consumer health data can be handled. Expect appeals, and expect other app developers to look hard at what third-party code they ship.
Related articles from LaRebelión
Google pauses its open-source bug bounty as AI slop floods maintainers
OpenAI Under Fire: California Subpoenas Rogue Hacking Agents
Capcom's Future: Transforming the RE Engine into an AI-Generation PlatformOriginal source: The Verge
Produced with AI support and reviewed by the newsroom