Has Flo shared your data? The FTC case and the class action, explained

What the FTC said

In January 2021 the FTC announced a proposed settlement with Flo Health. Its complaint alleged that Flo, despite promising to keep users’ health data private, shared it with outside analytics and marketing services through “app events”: records of what users did in the app, which included things like entering a period or a pregnancy. The FTC named Facebook’s and Google’s analytics services, Google’s Fabric, AppsFlyer and Flurry. It said the sharing stopped after a news report in February 2019.

In June 2021 the FTC finalised the order. Flo “neither admits nor denies” the allegations in it, and the order included no payment. It requires Flo to:

• get users’ express consent before sharing their health information with anyone else
• tell affected users what happened
• instruct the companies that received the data to destroy it
• have an independent review of its privacy practices
• not misrepresent how it uses data

The class action

Users then sued in Frasco v. Flo Health, Inc. (No. 3:21-cv-00757) in the US District Court for the Northern District of California. The class covers people who lived in the US and entered period or pregnancy information in Flo between 1 November 2016 and 28 February 2019.

Swipe sideways to see every column

The settlements total $59.5 million. Google, Flo and Flurry deny the allegations and say they did nothing wrong. The settlement website says the jury found Meta liable under the California Invasion of Privacy Act; Meta’s own filing with the US Securities and Exchange Commission confirms the verdict and says the amount of any damages is uncertain. The deadline to claim was 15 October 2026, and the court’s hearing on final approval of the settlements was set for 29 October 2026.

What Flo says now

Flo’s privacy policy says it will never sell your data, and that health data is not shared with its advertising partners. With your consent, it shares other data with marketing services such as AppsFlyer, Firebase and TikTok Ad Manager. Its App Store privacy label lists purchases, location, identifiers and usage data as “Data Used to Track You”. Flo also offers Anonymous Mode, which uses the app without linking your name, email or technical identifiers to your data.

What to check in any period app

1. Read the App Store privacy label, especially “Data Used to Track You”.
2. Check whether the app needs an account, and where your data is stored.
3. Look at which outside companies the privacy policy names.
4. Turn off any optional sharing or tracking you don’t want.

What Seventh does

Seventh never sells your data and shows no ads. The only outside code in the app is the Supabase library that runs optional backups: there are no third-party trackers, analytics or advertising SDKs. It works without an account. If you sign in, your cycle is backed up to our servers so it can be restored. Seventh counts app usage itself, without any health values. Every detail is in Seventh’s privacy policy.

The photo shows the FTC’s headquarters in Washington, DC, by Carol M. Highsmith (Library of Congress, public domain).