Short answer: A federal jury found Meta Platforms, Inc. civilly liable under section 632 of the California Invasion of Privacy Act (CIPA) for obtaining sensitive menstrual and ovulation information sent through the Flo period-tracking app. This was not a criminal conviction, so “found guilty” is legally imprecise. Judge James Donato denied Meta’s post-trial motions in an amended order filed September 17, 2025.
What the jury decided
The verdict came in Frasco v. Flo Health, Inc., a privacy class action in the U.S. District Court for the Northern District of California. The jury’s finding against Meta concerned the California subclass and the sole CIPA claim that remained against Meta at trial.
Flo asked users to enter highly sensitive information, including menstrual-cycle timing, birth-control preferences, sexual-activity details and pregnancy-related information. The trial record, as summarized by Judge Donato, described Flo’s representations that this health information would remain confidential. Custom event fields in the app captured menstruation and pregnancy information, while software development kits (SDKs) supplied by Meta and Google transmitted those events.
After Google and Flurry settled before trial and Flo settled during trial, Meta was the remaining defendant for the jury’s verdict. The jury found that Meta obtained highly personal ovulation and menstrual-period information communicated by Flo users in violation of CIPA section 632.
#1 Best Overall
Why “guilty” is the wrong legal term
Criminal courts return guilty or not-guilty verdicts. This was a private civil lawsuit seeking statutory damages, so the accurate descriptions are that the jury “found Meta liable” or “found Meta violated CIPA.” The verdict does not establish a criminal conviction or criminal punishment.
Meta asked the court to disturb the class certification, enter judgment as a matter of law in its favor, or order a new trial. Judge Donato rejected those requests in the amended September 17, 2025 order, writing: “Nothing in the evidence adduced at trial or the record as a whole justifies disturbing the California class or the jury’s unanimous verdict.”
Rank #2
Which users were covered by the Meta verdict?
The relevant group was not every Flo user worldwide. The California subclass covered people who:
- used the Flo app while residing in California;
- entered menstruation and/or pregnancy information; and
- did so from November 1, 2016, through February 28, 2019, inclusive.
The court also certified a nationwide class for claims involving Flo, Google and Meta, but the post-trial order concerning Meta addressed the California subclass. Flo’s settlement means that the nationwide Flo claims and the Meta verdict should not be treated as one undifferentiated class or outcome.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How much money could users receive?
No final payment amount is established by the sources available for this article. Meta’s Form 10-Q for the quarter ended June 30, 2026 says plaintiffs seek $5,000 in statutory damages per class member and have asserted that the California subclass could include approximately 1.25 million members. Those figures are plaintiffs’ requested statutory amount and asserted potential class size, not an award or a confirmed membership count.
Meta’s filing describes potential damages as uncertain. The available court order and filing do not establish whether a later damages judgment, settlement, claims deadline or appellate ruling occurred by September 28, 2026. Readers should rely on a later official court or company notice before assuming that money is available or that a claim can be filed.
What happened to the Flo data
The case focused on app events that conveyed intimate reproductive-health information. According to the trial record summarized by the court, Flo’s custom events included menstruation and pregnancy data, and Meta’s SDK received those events. The legal question for the jury was whether Meta obtained the information in circumstances covered by CIPA section 632—not whether every item a user entered was publicly displayed.
The verdict therefore concerns the transmission and acquisition of particular sensitive events during the California subclass period. It should not be expanded into a claim that all Flo records, all users, or all Meta products were covered by the finding.
Recommended Free Tools
Best Value
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
How this differs from Flo’s FTC matter
The Federal Trade Commission’s action against Flo is a separate regulatory proceeding. The FTC alleged that Flo shared users’ health information with outside analytics and marketing providers after promising privacy. The FTC finalized its order in June 2021; its release referred to data from millions of users and named Facebook and Google among the companies involved.
| Issue | FTC proceeding involving Flo | Private case involving Meta |
|---|---|---|
| Forum and defendant | Federal Trade Commission proceeding against Flo Health | Private federal jury trial against Meta in the Northern District of California |
| Legal mechanism | Regulatory allegations resolved through an FTC order | CIPA section 632 civil-liability verdict |
| Information and group | Flo users covered by the FTC allegations; the release described millions of users | California Flo users who entered menstruation and/or pregnancy information from November 1, 2016, through February 28, 2019 |
| Outcome stage | FTC order finalized in June 2021 | Jury verdict, followed by denial of Meta’s post-trial motions in September 2025; damages status not established here |
The FTC order is useful context for understanding earlier scrutiny of Flo’s privacy practices, but it is not the jury verdict against Meta and does not determine what any individual class member will receive in the civil case.
What the ruling means for privacy and app users
- SDKs can carry sensitive events: An app’s analytics or advertising code may transmit custom events, not just generic crash or usage statistics.
- Privacy promises matter in context: The jury considered Flo’s representations about confidentiality alongside the way data was transmitted and obtained.
- Class membership depends on defined facts: Residence, app use, the information entered and the exact dates all matter.
- A liability verdict is not the same as payment: Damages, class-member numbers and any distribution process require later court-approved action.
Current status and what is not yet established
The established procedural record is the September 17, 2025 denial of Meta’s post-trial motions and Meta’s June 30, 2026 filing describing uncertain potential damages. The available sources do not confirm a later damages award, settlement, claim-filing deadline or appellate result by September 28, 2026. Any announcement made after that date should be checked against the official docket or a later SEC filing before being treated as definitive.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
