Lawsuit claiming Flo Health app shared intimate data with Facebook greenlit as Canadian class action

A Canadian class-action lawsuit accusing a popular fertility tracking app of sending users' intimate health information - includ‐ ing details about their peri‐ ods, sex lives and pregnan‐ cies - to companies like Facebook without their knowledge has been al‐ lowed to go ahead.

The claim, certified in B.C.

Supreme Court on Thursday, said Flo Health collected their highly sensitive personal in‐ formation, promised to keep that information private and then knowingly shared the data with third parties.

"There's been a significant disclosure of the private in‐ formation of Canadian women, and we're excited to be proceeding to the next step with the case," said Richard Parsons, who is cocounsel on the case.

The ruling is a pivotal step forward for the case. It will test lagging Canadian privacy laws in a time when millions of people regularly pour their personal information into their phones. If the claim suc‐ ceeds, more than one million people who used Flo in Cana‐ da over a three-year period will be eligible to claim dam‐ ages.

None of the lawsuit's claims have been proven in court. In a statement to CBC News on Friday, Flo said it "has never sold user informa‐ tion or shared user informa‐ tion with third parties for the purposes of advertising."

"Flo will vigorously defend against allegations stipulated in the case."

Lead plaintiff used app while trying to get preg‐ nant

Flo is an app that tracks users' fertility and periods. Users enter personal infor‐ mation about their height, weight, sex lives and repro‐ ductive cycles - including de‐ tails about their periods, vaginal discharge, pregnan‐ cies, miscarriages, births and postpartum symptoms.

Jamie Kah Cate Lam, the lead plaintiff in the class ac‐ tion, said she used the Flo app for 18 months while she and her husband were trying to conceive. The B.C. woman gave the app information about the different stages of her menstrual cycle and how often she and her husband were having intercourse, ac‐ cording to an affidavit.

After her son was con‐ ceived in 2017, Lam contin‐ ued to use the app in preg‐ nancy mode. Her son was born in April 2018, and she later deleted the app.

WATCH | Lawyer warns app data could be used to prosecute U.S. women for having illegal abortions:

In 2019, The Wall Street Journal published an article saying Flo gave users' sensi‐ tive personal information to Facebook and other com‐ panies without their knowl‐ edge. Testing commissioned by the newspaper showed Flo told Facebook when an app user was on their period or trying to get pregnant.

Lam declined an interview request. In her affadavit, she said she was "shocked to learn that Flo Health had dis‐ closed my personal informa‐ tion to Facebook and others, despite my clear understand‐ ing when I downloaded the Flo App that my information would be kept private."

The U.S. Federal Trade Commission (FTC) launched an investigation following the Journal's story, and alleged the company had broken its promise to keep users' data private by sharing it.

As part of a settlement with the U.S. agency in 2021, Flo was required to obtain users' consent before shar‐ ing their health information. The company did not admit guilt in the settlement, and has said it does not share da‐ ta without people's permis‐ sion.

"Flo did not at any time share users' names, ad‐ dresses or birthdays with anyone. We do not currently, and will not, share any infor‐ mation about our users' health with any company un‐ less we get their permission," the company said in a state‐ ment at the time.

It said it settled with the FTC "to avoid the time and expense of litigation."

In greenlighting the Cana‐ dian class action on Thurs‐ day, B.C. Supreme Court Jus‐ tice Lauren Blake said the class would include all Cana‐ dian residents, excluding those in Quebec, who used the Flo app between June 1, 2016 and Feb. 23, 2019.

"There are over a million Canadian users of the app in the proposed class. I am sat‐ isfied that ... a class-action proceeding will still provide significant advantages in ju‐ dicial economy and effi‐ ciency," Blake wrote.

A class-action certification does not mean the allega‐ tions have been proven, but that lawyers showed there is a group that might benefit from the case going before a judge.

At the heart of the issue is an analytics tool that both Facebook and Google offer app developers called soft‐ ware-development kits, or SDKs. Developers use SDKs to better understand users' behaviour or to collect data they can use to increase their user base.

In return, apps share user data with Facebook or Google so the tech giants can then personalize ads and other content - a mutually beneficial arrangement, in which a person's personal in‐ formation becomes the com‐ modity, Parsons said.

"They're bartering, and what they're bartering with is the data of the users."

LISTEN | Tech expert ex‐ plains how to protect your data:

Generally speaking, Par‐ sons said, any information shared with an app using an SDK can also be shared with the company that owns the SDK - so users' personal data that was shared with Flo could also be shared with Facebook, because Flo was using Facebook's SDK.

Parsons said the problem is Flo wasn't upfront with its users about how far their in‐ formation might be shared.

"If an app developer wan‐ ts to use SDKs of those datacollecting agent companies, then their privacy policy needs to clearly tell users that the data is going to be going to these third parties," he said.