When Facebook parent Meta had agreed to a $17 billion settlement in August, you couldn’t blame consumers for shrugging. Facebook has faced big fines before, with little impact. But last year’s Flo Health period tracking app case is different. It went to trial. Victims testified. Experts exposed Meta’s misbehaviors. A jury weighed the evidence and found Meta guilty. And most of all, consumers are probably going to get something for their trouble. California residents who used the app during the time covered in the case are entitled to $5,000 compensation, as long as the class action judgment holds.
“I think this is the first time that consumers have been given an opportunity to tell Big Tech how they feel,” Carol Villegas, plaintiffs attorney, told LawDragon.com at the time
Users in the rest of the country are entitled to a much smaller amount as part of a settlement reached with other defendants in the case, Google and Flo Health — class members must register for that by Oct. 15.
The case hinged on a California state wiretap statute, and the jury found that Facebook illegally eavesdropped on very sensitive “conversations” that women had with their smartphones. To discuss the verdict, and the settlements, I recently interviewed Viegas and co-counsel Danielle Izzo Mazzeo for the Duke University Debugger podcast, which I host. You can listen to it anywhere you get podcasts, or by clicking this link. A transcript of our conversation is below.
—————TRANSCRIPT————
[00:00:00] Carol Viegas: It’s really, I can’t express to you being in that courtroom how emotional it was to watch these women get up in front of close to 100 people and talk about their most private health, reproductive health information. It was an emotional trial, and when the verdict came down The courtroom was silent but the moment we all stepped out into the hallway everyone started [00:00:30] crying, lawyers and clients alike, and just hugging each other because I think we all knew what had just happened
Bob:: In privacy law, they don’t probably talk much about the court cases that will have you crying in the hallways.
Carol Viegas Yeah. It was very special. It was a real David and Goliath moment in the best way
[00:00:53] Bob: Welcome back to Debugger. I’m your host, Bob Sullivan.
Here’s the computer code. You can see [00:01:00] the word pregnancy. You can see the word fertility. You can see the word ovulation. It was a big surprise to hear words like that in open court as this real-life courtroom drama unfolded last year in full view of the public.
The vast majority of privacy cases are settled out of court with details kept private, so the public gains precious little insight into how tech companies really handle the most sensitive privacy issues. The Flow Health period tracking [00:01:30] app class action lawsuit, and specifically the case against Facebook’s parent company, Meta, stands as a stark exception.
There is so much to learn from the public record and from the verdict. Today on Debugger, we have two of the lawyers who represented the plaintiffs, Carol Viegas and Danielle Izzo Mazzeo from the law firm Labaton Keller Sucharow. They are here to discuss the case and the claims process for victims, which is now open.
Before we go on, I wanna make sure you know [00:02:00] that Duke University Professor David Hoffman, executive producer of Debugger, was an expert witness in this case
Okay, so let’s begin at the very beginning, Danielle. What was the Flo trial? What was the issue?
[00:01:57] Danielle Izzo Mazzeo: So the Flo case is Fresco v. Flo Health et al. So this is a case by consumers who were users of the Flo Health period tracking app.
This was an app that was developed and marketed as a way for [00:02:30] women to track their menstrual cycles and potentially their pregnancy, or help them, assist them in tracking to get pregnant. It collected a whole host of information related to women’s health, particularly menstrual information and fertility information.
And the Flo Health privacy policy, which was long and convoluted as many privacy policies are, specifically made representations to women who were signing up for the app that their information would be kept private and [00:03:00] that their health information would not be shared. But as it turned out, the Flo Health app designed its computer code or mobile application code with SDKs from some of the largest tech and data broker companies in the world, specifically here the named defendants Meta Platforms, Inc., Google LLC, and Flurry Inc. These were the defendants that were named in the complaint. And by, as a result of incorporating the SDK of Meta and Google and [00:03:30] Flurry into the Flo Health app, those third parties were receiving recordings or strings of the responses that users were entering into the app. So if a user was logging one of the first questions in the, that the Flo Health a- app asks, “What is your goal for using the app?”
With the multiple choice responses of, “To get pregnant,” “To track my cycle,” “To not get pregnant,” answers like that were being transmitted and recorded by Meta and Google and Flurry. [00:04:00] So this was a privacy violation that we assisted the clients in pursuing. We filed a complaint for a variety of claims, but the main claims and the claims that ended up being at issue at trial were the California Invasion of Privacy Act, which is a California state wiretapping claim.
[00:04:19] There were also other more traditional privacy and health-related claims, but ultimately at trial, the one claim that went to verdict was the California Information Privacy Act. [00:04:30]
Bob: So Carol, people talk about privacy violations and people talk about sensitive data collection all the time, but in, in this case, to me, we’re talking about information that’s really sensitive to the people involved, right?
Carol Viegas: Yeah, this was an extremely important case, and it was actually, I would consider it to be a landmark data privacy case. It’s one of the few, and really the only case that’s actually gone to trial on this wiretapping claim and against Meta, and it was really [00:05:00] groundbreaking that the case actually went to trial, and I would say groundbreaking that the case was actually tried to verdict.
I always tell people, you watch TV, you watch law shows, and you think every single case that you watch goes to trial. That’s not the case. In civil matters, only 1% of all of the tens of thousands of cases that are filed every year actually go to trial. Most either settle or get dismissed at some way along the line.
But our [00:05:30] case went to trial and actually went to a jury verdict. And as you said, Bob, the type of information that was being collected from these women is some of the most private and sensitive reproductive health information that you can imagine. It came out during the trial and through the evidence that we presented that the type of information Meta was recording and getting through this software development kit that Flow was using was information relating to their periods, their pregnancy, and when they [00:06:00] were ovulating.
And so this type of information, and as our plaintiffs testified, they felt extremely violated that this information was being recorded by Meta, was being matched by Meta to actual women, to their profiles that it had, and was being used by Meta to make money. So it was an extreme violation of their privacy, and we were really proud that we were able to try this to verdict and get a verdict for our plaintiffs and the class.[00:06:30]
[00:06:30] Bob: Danielle, at the risk of delving too deep into the legal technicalities here, but why was this a wiretap case?
Danielle Izzo Mazzeo: So it’s interesting that we are in the United States, and we do not currently have a robust privacy framework like the European… You might compare it to the European Union with the GDPR. That just doesn’t exist here yet.
So it leaves people in the positions of our clients in this case, and the class members in this case, of having to look to more creative and unique [00:07:00] options to cover the claims. The state wiretapping claims that we have in the US, particularly the California state claim, are really written in a way to cover technology broadly.
They were written with the foresight to develop with ongoing technology. So while there isn’t a clear foundational privacy framework like the GDPR, there are certainly laws that can map onto the technology, and it’s just a matter of matching up the elements with the technology here. So [00:07:30] what was once used in the more, you know, traditional old-school context of a recording device like a tape recorder can now take on new meaning with the kind of virtual tape recorders or virtual technology of SDKs, which are recording the sensitive information here, recording the sensitive information in the Flow Health app as Carol described.
[00:07:52] Bob: Uh, so Carol, uh, we’ve already talked about why this is sensitive, and I think most people would just react the way that you describe. This is very personal information. But there’s even [00:08:00] more risks now with this kind of information being recorded and stored given the post-Dobbs era that we live in the US, right? Can you talk about that?
Carol Viegas: Yeah. So we filed our case actually before, before Dobbs came down, and even then i- there was a huge outcry, people recognizing that this information was very sensitive. But I think when Dobbs came out, a, a real light was shown on these practices that happen with reproductive health apps and other health apps, right?
Because [00:08:30] you could imagine a world where there’s location data and maybe one, one day you’re pregnant and maybe a, a week or two later you’re not, and what that could imply. And I think that there was a lot of concern about these apps, the information that’s stored, the information that’s shared, and how it could be potentially weaponized against women.
So just going a step beyond Meta being able to use this information to make money, could this information be used [00:09:00] in a way that was harmful to women and to prosecute them in some way? It… I think that a lot of people were very concerned about that. And to be clear, our case covers conduct over a certain period of time, so 2016 through 2019.
Since our lawsuit was filed, there have definitely been preventative measures that are in- now installed by Flo and by Meta to make sure that this type of personal health information is no longer shared through the [00:09:30] software development kit, the SDK. But yes, I think that up until our lawsuit being filed, it was almost like a black box, right?
People don’t realize that the apps, the hundreds of apps that everyone has on their phone today, that information that you’re putting into these apps is being recorded, collected, shared, used. And so e- even putting aside the Flo Health app, which as I mentioned now has protections against this, there are a whole host of other lawsuits that are currently [00:10:00] out there about v- very similar allegations to the Flo Health app except with hospital websites or other health apps that people use.
And so I think that this was a really great way to show the public that we really need to think about how we’re using apps to store and collect and think about our data, and in particular reproductive health data, and just health data generally. And I do think that as a reaction to our lawsuits, there [00:10:30] has been, there have been changes in the industry, so not just for apps, but even for websites that, that collect and used to share this type of health information.
[00:10:41] Bob: Uh, Danielle, we’ve al-already talked about it’s unusual that this case went to a jury trial and there was a verdict. Uh, can you talk a little bit about what happened at trial and perhaps what was persuasive about your case?
Danielle Izzo Mazzeo: I’ll set the table, and I can let Carol speak in detail about the details of the trial itself and go into the opening which she [00:11:00] gave.
But in terms of setting the table of getting to trial, as we said, it’s extremely rare that this went to trial, let alone went to verdict. By the time of the trial, several of the defendants had actually had settled prior to the initiation of the trial, so Google and Flurry had settled prior to the trial going forward, so the trial itself only involved f- the defendant, the app company Flow Health, and Meta.
And by the time of the verdict, Flow Health had settled the case as [00:11:30] well, so the, actually the verdict and the jury deliberations only concerned the California Invasion of Privacy Act claim against Meta, which was interesting in itself that went as far as it did, but also interesting that the time that the jury was considering the case, they were really only left to consider Meta’s conduct and Meta’s use of its SDK And collection of data through the SDK.
[00:11:52] But I’ll turn it over to Carol to lay out the trial itself.
Carol Viegas: Yeah, the trial lasted a little over [00:12:00] two weeks, and one of the ways that I think we were effective in conveying the story to a jury, because this is a very technical case, right? Putting aside the fact that this information was being shared, we had to convince a jury that there was an actual recording happening from Meta, right?
With the information that was being shared with the Flow Health app. And what we did, and I think did quite effectively, is we had two experts who were able to explain to the jury [00:12:30] in English and common language, show the jury the code. This is the information that’s being transmitted. Here is the code.
You can see the word pregnancy. You can see the word fertility. You can see the word ovulation. And, and then we had another expert who was a machine learning expert, who was able to explain to the jury what happens when the data gets to Meta. How is that data used in the machine learning algorithm to both serve ads [00:13:00] and also to have people continue to engage with content, right?
So it wasn’t just used to match to people and then put into the black box to serve ads relating to that. It was also used to encourage engagement on an Instagram, for example. And our expert was able to explain to the jury again in, in plain English how this happened. And then I think the third part of our strategy that was very effective is we were able to [00:13:30] use information, internal information that we received from Meta that showed that they knew they were getting personal, sensitive health information from apps, they did very little to stop it, and that they were monetizing information that they received through these software development kits.
And the jury was convinced, and ultimately decided that- Like you said earlier, Bob, this information was private. They did not have consent from the plaintiffs, and that Meta acted with [00:14:00] intent to get information and then use it to their own benefit. And I think maybe the, the last part of the strategy, and maybe the best part of the strategy, were our plaintiffs.
We had women from all walks of life, young women, older women, women who were trying to get pregnant, women who were trying to not get pregnant. We had a woman who started using the app when she was a teenager. We had a woman who was using the app as she was going into menopause. And these women got up on the stand and, as you can [00:14:30] imagine, it was very emotional for them.
They were testifying about some of the most personal, private… This isn’t stuff that you talk to people about, when you get your period, whether you wanna have a baby. It’s very sensitive, and these women took the stand very bravely and answered questions about what they used the app for, how they used it, when they used it, and, and told the jury that they felt their privacy was violated.
And the jury really connected [00:15:00] with our plaintiffs because they were ordinary people just like them. Really, I can’t express to you being in that courtroom how emotional it was to watch these women get up in front of close to 100 people and talk about their most private health, reproductive health information.
It was an emotional trial, and when the verdict came down- The courtroom was silent, but the moment we all stepped out into the [00:15:30] hallway, everyone started crying, lawyers and clients alike, and just hugging each other because I think we all knew what had just happened was extremely significant and was a real step forward for women who wanna protect their reproductive health information.
So I just wanna thank them. They’re just incredibly brave people. What a moment.
Bob: Uh, in privacy law, they don’t probably talk much about the court cases that will have you crying in the hallways.
Carol Viegas: Yeah, it was [00:16:00] very special. I think it’s the highlight of my career as a lawyer- Mm-hmm … was being a part of this trial and working with those women and really having them feel like they stood up for something and they were successful. It was a real David and Goliath moment i- in the best way.
Bob: Now that this jury of peers has ruled that there’s this privacy violation and this is a very large tech company which has been held accountable, is there some l- larger message here to big tech in general, to companies that process sensitive information? [00:16:30] Is there something that they need to learn from this?
Carol Viegas:Absolutely. Really, I think it’s that when you are collecting and processing this type of sensitive information, there are two things you need to absolutely do. Number one, you need to give notice. You need to tell people that if they are putting this type of sensitive information into an app or into a website, that the information is gonna be collected, recorded, and shared with others.
And once you give them [00:17:00] notice, you have to give them an opportunity to con- to consent because this type of information should not just be shared without you knowing about it. And like you said earlier, Bob, given the sensitivity around jobs and other things, consent is a huge deal here. So I think that’s a really big part of it, that instead of just hiding that information may be shared or recorded with partners or others, that there needs to be really clear language about what is being collected, recorded, and shared, [00:17:30] and how it’s going to be used.
[00:17:32] Danielle Izzo Mazzeo: Danielle, what would you say about th- this, this case holding big tech accountable? So I, I echo everything Terril said about consent and that being really the end all and be all for big tech companies. And I’ll add to that, we always say the law often takes time to catch up with what’s going on in the world, and I think this case and a lot of the other cases that people are probably seeing being brought against Meta, being brought against social media companies that are [00:18:00] either going very far in reaching verdict or having widespread consequences, are indicative that we’re at a time and an inflection point where the law is catching up, and people are concerned about their privacy, and they are pursuing their rights under the law to enforce their privacy rights and make sure that they get appropriate notice and an opportunity c- to consent going forward.
I think there was, it… when tech was developed, not just the tech in this case, but tech broadly, a tendency to move fast and break things without giving people a, a real look at what [00:18:30] was truly going on with their private data and the platforms themselves. And people are starting to become privy to the fact of what’s truly going on at these companies, and they’re speaking up and enforcing their rights.
The clients in this case certainly did. The brave women who took the stand and addressed Meta directly and expressed how embarrassed and concerned they were about the fact that they had to not only testify about their most sensitive information in a courtroom, but have it disclosed and sent to Meta time and time again.
[00:19:00] So I think it’s that at this time the law is catching up and people are starting to enforce their rights under the law. Yeah. As people listen to this podcast, they, they will still be digesting the recent news of the seven $17 billion settlement with the states. Very different issues, but the same generic issue of holding big tech accountable.
Bob: So I, I agree with you that the law is catching up. But Danielle, let me just ask you this briefly. Isn’t it hard to sue a gigantic company like Meta?
Danielle Izzo Mazzeo: It is no small feat, but it’s not impossible, [00:19:30] and I think that’s what people need to remember. Our law in the United States is structured in a way where people are able to bring class actions, which is what this case was, a class action on behalf of the women.
And it’s not an easy thing to do, but it’s certainly an important thing. It’s a thing that the clients and the women, the lead plaintiffs in our case, led the charge on behalf of so many other women. Not only were they representing their own rights, but they were speaking out on behalf of themselves and all the other women they represent.
In a [00:20:00] forum where we have class litigation available to us, there are ways for people to have strength in numbers and work together to assert their rights and be heard, have their rights heard. And it’s not just this case where that’s an option, but it’s certainly an opportunity here, and I’m sure we’ll talk about it shortly.
But even the women who are class members now who may be listening to this podcast have an ability to continue to enforce their rights a- and get the benefit of the verdict and the settlements in this case.
Bob: Yes, Carol, that is my next [00:20:30] question. How does someone… Now that there’s a jury verdict, what is the process for compensating the people whose sensitive health data was intercepted?
[00:20:38] Carol Viegas: Yeah. So we currently have three settlements that are collectively close to $60 million against or with Google Flurry and with Flo. And those settlements were in the process of accepting claims, and what that means is you can Google the Flo data privacy litigation and go to the [00:21:00] website that we’ve set up and fill out a claim form if you were a Flo user between the years of 2016 through 2019, and the specific dates are in there.
I believe it’s November of 2016 through February of 2019, but Danielle will correct me if I’m wrong. And if you were a Flo Health user at that time, you should definitely fill out a claim form because what our case covers is anyone who started using the Flo Health app during that time [00:21:30] period. Anyone who was using the app must have filled out the onboarding questions, which ask you, “What is your goal?
When was your last period? How long did it last?” And a calculation on when you were ovulating, and those are the precise questions that are covered, these questions around pregnancy and periods, that are covered as part of the class. So if you did use the Health- the Flo Health app during that time, please fill out a claim form.
If you were in California while you were using the Flo Health app, you’re actually entitled to [00:22:00] double the recovery of people throughout the rest of the United States. So if you were living in the state of California when you used the Flo Health app between 2016 and 2019, you should definitely fill out a claim form as well.
So th- that’s for the settlements. For Meta, the verdict, that actually only covers women in California, and we’re in the process of actually rolling out a claim process for the verdict, which would entitle every single woman [00:22:30] who lived in the state of California and used the Flo Health app to $5,000, minus attorney’s fees, but $5,000, it’s a huge amount for an individual to get.
And we’ve estimated that there are over a million women in California who were using the Flo Health app at the time. So this is a real opportunity to get real money from the verdict if you, a- again, were in the state of California and lived there while you were [00:23:00] using the Flo Health app during that time.
So I would encourage, again, anyone and everyone who used the Flo Health app to fill out a claim form now for the settlement money. And if you lived in the state of California, we will know that fr- from you filing out the claim form for the settlement, and we’ll be able to get in touch with you to get you your money from the verdict when the time comes, which will be pretty soon.
When I went to the website, uh, and I guess this is reference to the nationwide class, there [00:23:30] was a deadline, a pretty, pretty soon deadline. I believe it was October 15th. Is that right? That is correct. Yes. Yes. The deadline is coming up, so again, I would encourage everyone to please go to the website, fill out a claim form.
If you have any questions, I think my contact information is on that form. I encourage people to call me personally, send me an email. I’m happy to help answer any questions about the claim form. But please do fill the claim form out. As lawyers, we can’t go out and fill out claim forms for people. People need to actually fill out the claim [00:24:00] forms, and we can’t get you your money and your recovery unless you do so.
[00:24:04] Bob: Well, that’s where I’m gonna leave it, but Danielle, I’ll ask you first, is there anything I didn’t ask you about this case that you really want people to know?
Danielle Izzo Mazzeo: No, I think this really covers the breadth and the scope of the litigation. I will just echo what Carol was saying. The website and the claim form are all available there with additional data and FAQs and all of the information that people will need to understand whether they fall within the class definition, whether they can fill out a claim, [00:24:30] and that’s the periodtrackerdataprivacylitigation.com.
Be the first to comment