On October 29, 2026, U.S. District Judge James Donato (N.D. Cal.) said at a hearing in San Francisco that he will grant final approval to the $59.5 million class settlement resolving claims that the Flo period- and ovulation-tracking app shared users' sensitive reproductive data with Google and analytics firm Flurry without consent, according to Law360. Under the settlement as previously reported, Google pays $48M, Flo $8M and Flurry $3.5M. Donato was openly unhappy with class counsel's $19 million fee request, saying the lawyers were "taking money out of consumers' pockets," and cut the request by 5%. Courthouse News headlined the fees as "astronomical."

Why It Matters

Every femtech app with an embedded third-party SDK should be watching this case. The jury and judge treated in-app **event names**, labels like `SELECT_LAST_PERIOD_DATE` that the app passed to Meta's analytics code, as the content of a confidential communication. That makes routine analytics instrumentation in a cycle tracker, fertility app or connected-toy companion app a potential **CIPA wiretap claim** with fixed per-user damages. The Flo/Google/Flurry settlement is significant on its own. The Meta damages count, now pushed to Thanksgiving week, will set the price. Builders in sexual health should audit what their SDKs record. This adds to the pressure from the [Netherlands complaint against Flo](/stories/flo-privacy-campaign-netherlands-complaint), the [BMJ critique of tracking apps](/stories/bmj-menstrual-tracking-apps-harm) and the broader [CIPA tracking-suit wave](/stories/california-sb690-cipa-tracking-suits).

Meta did not settle, and its exposure is far larger. In August 2025 a jury found that Meta's SDK inside the Flo app "intentionally eavesdropped on and/or recorded" onboarding answers that new users typed in, including the dates of recent periods and whether they were trying to get pregnant or tracking a pregnancy. The case is Frasco v. Flo Health, No. 3:21-cv-00757-JD. The court has since denied Meta's post-trial motions and held that the California Invasion of Privacy Act's $5,000 per violation is fixed by statute. According to MLex, the same hearing turned to the size of the California class still unresolved two months after plaintiffs moved for partial final judgment. Donato said he was out of patience with Meta's delays, warned that its resistance was "rotting on the vine" a historic verdict, and ordered Meta and the plaintiffs into his jury room during Thanksgiving week to agree on the number of class members. MLex reports Meta's exposure could reach as much as $6 billion. Plaintiffs' pending motion seeks about $1.11 billion, and no damages judgment has been entered.

Sources

Update — 2026-10-30

Initial entry — story first created.