Frasco v. Flo Health, Inc.
3:21-cv-00757
| N.D. Cal. | May 22, 2025Background
- Plaintiffs alleged Flo Health and Meta unlawfully collected and transferred personal health data from Flo’s menstrual/fertility tracking app to Meta and others.
- The claims included violations of the federal Wiretap Act, California Invasion of Privacy Act (CIPA), California Comprehensive Computer Data Access and Fraud Act (CDAFA), and breach of implied/unjust enrichment contracts.
- The court had previously granted and denied class certification for various claims; for example, class certification was granted for CIPA § 632, but not for § 631 or CDAFA.
- Plaintiffs relied on expert testimony for key damages claims, but that expert was excluded.
- Flo and Meta moved for summary judgment on various grounds, including alleged consent, lack of damages, time-barred claims, and interpretive questions regarding applicable state statutes.
- The decision issued summary judgment orders on multiple claims and left several fact-intensive issues for trial.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Wiretap Act liability for Meta | Flo did not properly consent; data transfer violated statute | Flo’s prior consent to data collection bars liability | Summary judgment for Meta; consent by Flo defeats claim |
| CIPA (Cal. Penal Code § 631/§ 632) | Meta intercepted/eavesdropped and no effective consent | Disputes over consent, timing, and intent defeat plaintiffs’ claim | Disputed facts preclude summary judgment except for limited plaintiffs (§ 632 claim proceeds classwide) |
| CDAFA—Financial value/damages from data transfer | Expert would show data’s value and loss/damage to consumers | No admissible evidence of damages; expert excluded | Summary judgment for Meta; plaintiffs lack evidence of financial harm |
| Intrusion upon seclusion—Aiding and abetting | Meta aided Flo’s improper data disclosures | No materially different facts vs. similar failed claim against Google | Summary judgment for Meta; evidence insufficient |
| UCL and Implied Contract claims | Data sharing violated contract/implied promises/UCL | No basis to assert these as stand-alone actionable claims | Summary judgment for both Flo and Meta |
| CMIA (medical info confidentiality—Flo) | Flo app handled "medical information" under California law | App not a covered health care provider for statutory period; data de-identified | Summary judgment denied; factual disputes over whether app/data fit statutory definition |
| Timeliness—Statute of limitations | Discovery rule and fraudulent concealment apply; late discovery | Claims are time-barred; disclosures gave constructive notice | Summary judgment denied; jury to decide fact issues |
| Unjust enrichment (Flo) | Flo unjustly enriched by use of sensitive data | Not a stand-alone cause of action; overlaps with other claims | Summary judgment for Flo on stand-alone claim |
Key Cases Cited
- LeBrun v. CBS Tv. Studios, Inc., 68 Cal. App. 5th 199 (Cal. Ct. App. 2021) (unjust enrichment not a stand-alone cause of action under California law)
- Paracor Fin., Inc. v. Gen. Elec. Cap. Corp., 96 F.3d 1151 (9th Cir. 1996) (unjust enrichment overlaps with other substantive claims)
- Skidgel v. Cal. Unemployment Ins. App. Bd., 12 Cal. 5th 1 (Cal. 2021) (plain text rule for statutory interpretation)