ERICA FRASCO, et al. v. FLO HEALTH, INC., et al.
Case No. 21-cv-00757-JD
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA
May 19, 2025
Named plaintiffs Erica Frasco, Sarah Wellman, Justine Pietrzyk, Jennifer Chen, Tesha Gamino, Leah Ridgway, Autumn Meigs, and Madeline Kiss have alleged a variety of privacy claims against Flo Health, Inc. (Flo), Google LLC, and Meta Platforms, Inc. (Meta)1 in connection with the Flo Period and Ovulation Tracker app for women (Flo App). They say that, from 2016 to 2019, the Flo App surreptitiously transmitted users’ highly personal information about menstruation, ovulation, pregnancy goals, and the like to Google and Meta through their software-development kits (SDKs), despite assurances to the contrary by Flo. See generally
Plaintiffs filed a request to certify classes of Flo App users for damages and injunctive relief.
Overall, plaintiffs have adduced substantial evidence demonstrating that the proposed class members saw the same privacy representations by Flo, experienced the same Flo App and SDK practices, and have the same alleged claims and injuries. The questions posed in plaintiffs’ case can be answered on the basis of common evidence that applies on a classwide basis. Consequently, certification is granted in main part, with a few specific, claim-related exceptions.
BACKGROUND
I. THE ALLEGATIONS
The named plaintiffs are eight women in the states of California, New Jersey, New York, Ohio, and Pennsylvania, who downloaded and used the Flo App between 2017 and 2019.2
Plaintiffs allege that, between 2017 and 2019, Flo made representations to users that it would keep their personal information private and confidential.
In plaintiffs’ telling, these assurances were false. They say Flo integrated Meta and Google‘s SDKs into the Flo App to obtain personal information shared by users.
II. THE LITIGATION
Plaintiff Frasco filed the original complaint in this case on behalf of herself and others similarly situated.
After substantial discovery and motion practice, plaintiffs moved to certify four classes of Flo App users.
Plaintiffs have renewed their motion for class certification.3
Nationwide Class: All Flo App users who entered menstruation and/or pregnancy information into the Flo Health App between November 1, 2016, and February 28, 2019, inclusive.
California Subclass: All Flo App users in California who entered menstruation and/or pregnancy information into the Flo Health App while residing in California between November 1, 2016, and February 28, 2019, inclusive.
The nationwide class is proposed for certification under
In addition to the damages classes, plaintiffs propose certification of the nationwide class and California subclass under
The three California plaintiffs (Wellman, Chen, and Gamino) are proposed to be the representatives for the California subclasses. The same three plaintiffs, plus plaintiffs Frasco and Meigs, are proposed as the representatives for the nationwide classes.4
Plaintiffs and defendant Flurry have settled.
LEGAL STANDARDS
The goal of
“To come within the exception, plaintiffs bear the burden of proving by a preponderance of the evidence that the proposed classes satisfy all four requirements of
“If the defendant provides evidence that a valid defense -- affirmative or otherwise -- will bar recovery on some claims,” the Court must “determine, based on the particular facts of the case, whether individualized questions will overwhelm common ones.” Van v. LLR, Inc., 61 F.4th 1053, 1067 (9th Cir. 2023) (cleaned up) (citations omitted). “Each element of a claim need not be susceptible to classwide proof,” Schneider, 674 F. Supp. 3d at 716 (citing Amgen Inc. v. Conn. Ret. Plans and Trust Funds, 568 U.S. 455, 468-69 (2013)), and the “important questions apt to drive the resolution of the litigation are given more weight in the predominance analysis over individualized questions which are of considerably less significance to the claims of the class.” Ruiz Torres v. Mercer Canyons Inc., 835 F.3d 1125, 1134 (9th Cir. 2016). Certification is permissible under
The Supreme Court of the United States has repeatedly admonished that the certification analysis “must be rigorous and may entail some overlap with the merits of the plaintiff‘s underlying claim,” but the merits should be considered only insofar as they are “relevant to determining whether the Rule 23 prerequisites for class certification are satisfied.” Amgen, 568 U.S. at 465-66 (cleaned up). Even with a rigorous inquiry, ”
DISCUSSION
I. THE EVIDENCE
The salient inquiry under
Plaintiffs start with the representations in the Flo App‘s privacy disclosures, namely that (1) Flo “will never share your exact age or any data related to your health with any third parties,”
Plaintiffs also proffered evidence showing that the Flo App asked users to share highly personal reproductive and sexual information within the app. To illustrate, users were asked to
Plaintiffs gave specific attention to the data all new Flo App users were required to share during the app‘s onboarding process. They proffered evidence establishing that a new user was required to disclose: (1) the user‘s age; (2) a “goal” from one of three options: (i) “Track my cycle,” (ii) “Get pregnant,” (iii) “Track pregnancy“; (3) the date of the last several menstrual periods and the average length of the periods; and (4) if pregnant, by how many weeks. See generally
The user entries for the Custom Events were sent to Meta and Google by means of their respective SDKs. See, e.g., Egelman Rep. ¶¶ 60, 62, 65, 81-84, 87, 103, 105;
Plaintiffs presented evidence showing that the Custom Events featured words like “pregnancy” and “period,” which communicated information about the dates on which a user menstruated or became pregnant. This type of information is widely understood to be health
Plaintiffs presented evidence indicating that defendants commercially exploited the user data. For example, there is evidence that “Flo sold access to the Custom App Event data to third parties, including Procter & Gamble . . . and Bayer” pursuant to, inter alia, “a $3 million contract in October 2018 [and] a $7 million contract in October 2019” with Procter & Gamble, and “10 contracts extending through January 2019 and October 2021, totaling $6.04 million” with Bayer.
Plaintiffs also proffered evidence that the user data entered during onboarding and transmitted to Google and Meta was capable of being tied to or identified with a particular person. The evidence shows that alongside the Custom Events, Google and Meta‘s SDKs collected “unique” or “persistent” identifiers. See, e.g.,
II. RULE 23(a): NUMEROSITY, TYPICALITY, & ADEQUACY
Turning to the
The record demonstrates that they have been met. To start, the proposed nationwide and California classes will likely consist of millions of individuals, rendering “joinder of all members . . . impracticable.”
III. RULE 23(a)(2) COMMONALITY AND RULE 23(b)(3) PREDOMINANCE
It is “appropriate to assess
Defendants flagged four “global” concerns that they believe are grounds for denying certification. These are implied consent, a contractual limitations term, a class action waiver, and standing, each of which is said to bar certification independently of the others. The Court will
The ensuing discussion uses the substantive law of California. Plaintiffs proposed the use of California law because Flo‘s terms of use state that California law governs and Google and Meta‘s principal places of business are in California, such that decisions about SDK design and advertising may reasonably be understood to have occurred there.
A. Implied Consent
Defendants’ first objection to (b)(3) certification concerns user consent. Defendants say users impliedly consented to sharing their personal information “through their conduct when they continued to use the application[] despite exposure to materials that disclosed the challenged practices.”
Not so. Consent may be express or implied, but as the Court concluded earlier in this case, it must be “actual.” Frasco v. Flo Health, Inc., No. 21-cv-00757-JD, 2024 WL 4280933, at *2 (N.D. Cal. Sept. 23, 2024). “For consent to be actual, the disclosures must ‘explicitly notify’ users of the conduct at issue.” Calhoun v. Google, LLC, 113 F.4th 1141, 1147 (9th Cir. 2024) (quoting In re Google Inc., No. 13-md-02430-LHK, 2013 WL 5423918, at *13 (N.D. Cal. Sept. 26, 2013)). The evidence of notice that must be established before an individual may be deemed to have consented is greater than that required to show she had inquiry notice. Consent “is only effective if the person alleging harm consented ‘to the particular conduct, or to substantially the same
Because defendants raise implied consent as an affirmative defense, they bear the burden of “invok[ing] individualized issues and provid[ing] sufficient evidence that the individualized issues bar recovery on at least some claims, thus raising the spectre of class-member-by-class-member adjudication of the issue.” Van, 61 F.4th at 1067. To be sure, plaintiffs “retain the burden of showing that the proposed class satisfies the requirements of Rule 23,” but the Court‘s predominance analysis is limited to the “defenses [a defendant] has actually advanced and for which it has presented evidence.” True Health Chiro., Inc. v. McKesson Corp., 896 F.3d 923, 931 (9th Cir. 2018). Speculation about events or issues for which a defendant has not offered evidence will not do. See, e.g., Miles v. Kirkland‘s Stores Inc., 89 F.4th 1217, 1222 (9th Cir. 2024).
Defendants rely on three buckets of evidence as the ostensible proof of consent. The first bucket is press coverage involving a Wall Street Journal article from February 22, 2019, and other subsequent news articles reporting on Flo‘s alleged misconduct. App‘x 688-705.8 Defendants made no effort to demonstrate that a meaningful portion of the proposed classes might have seen or read these three specific articles with, for example, evidence about the readership of the newspapers or articles. This shortfall is in distinct contrast to the presentation of such evidence in the cases defendants cite. See Brown v. Google, LLC, No. 20-cv-3664-YGR, 2022 WL 17961497, at *18-19 (N.D. Cal. Dec. 12, 2022) (evidence about how frequently the sources of the asserted disclosures were viewed and by whom); In re Google Inc. Gmail Litig., No. 13-md-02430-LHK, 2014 WL 1102660, at *17 (N.D. Cal. Mar. 18, 2014) (same). Moreover, the earliest of the three articles was published less than a week before the end of the class period. App‘x 688. Consequently, only class members who completed the onboarding process in that narrow timeframe might be covered. Such a tiny fraction of the class can be readily handled by the Court later in the case, as circumstances warrant. See Ruiz Torres, 835 F.3d at 1137. Defendants have
The second bucket of evidence consists of privacy disclosures by each of the defendants. In making this argument, defendants came unacceptably close to misrepresentation. They say that “Flo‘s June 2016 privacy policy explained Flo ‘may share information, including [users‘] personally identifying information’ with third parties, ‘including . . . Facebook,‘”
It also bears mention that the evidence of Flo‘s privacy disclosures is common to the class. The common disclosures will permit a jury to conclude in one fell swoop whether a reasonable person would have been on notice of, and so could impliedly consent to, “the particular conduct, or to substantially the same conduct.” Calhoun, 113 F.4th at 1147 (citation omitted). The relevance of Google and Meta‘s privacy disclosures is not obvious in light of plaintiffs’ evidence of secret data sharing, but those disclosures, too, are subject to common proof.
Defendants’ third bucket of evidence consists of publications and studies from outside the United States or before the class period -- in some cases even before Flo was in business. App‘x 708-11, 730-32, 737-43. Defendants did not say how foreign materials might reasonably have put a Flo App user in the United States on notice of the challenged conduct, or establish their consent
B. Contractual Limitations Period
Defendants’ second overarching objection to (b)(3) certification concerns a contractual limitations term. Plaintiffs mark February 28, 2019, as the end of the class period, and the original complaint was filed in January 2021.
The point is not well taken. To start, defendants were unduly vague about which party among them might permissibly assert the contractual defense. The provision is in Flo‘s terms of service, but defendants suggest that Google and Meta might somehow benefit from it as well. See
With respect to Flo, the one-year period in the terms of service is not a bar to certification. As a general rule, “the presence of individual issues of compliance with the statute of limitations” does not necessarily “defeat the predominance of the common questions.” Cameron v. E.M. Adams & Co., 547 F.2d 473, 478 (9th Cir. 1976). That is particularly true when, as here, Flo‘s representations to each class member were the same, which permits the question of fraudulent concealment to be answered on a classwide basis. See, e.g.,
The question of whether and when putative class members might have had inquiry notice, see
C. Class Action Waiver
The third overarching objection to certification concerns a waiver of class actions. The Flo App‘s terms of service state that “[a]ll claims between the parties related to this Agreement will be litigated individually and the parties will not consolidate or seek class treatment for any claim, unless previously agreed to in writing by the parties.”11 App‘x 1531, 1538.
Plaintiffs’ challenge to the waiver on grounds of unconscionability,
Flo says that Discover Bank does not apply here and that the waiver should be enforced because the claims do not involve small sums of money.
But the California Court of Appeal has expressly concluded that Discover Bank did not “hold that class action waivers are unconscionable only in the circumstances it described” and has found such waivers unenforceable due to unconscionability even when the plaintiffs’ recovery would not be insubstantial. See, e.g., Cohen v. DIRECTV, Inc., 142 Cal. App. 4th 1442, 1451, 1453-55 (2006) (discussing cases); Indep. Ass‘n of Mailbox Ctr. Owners, Inc. v. Superior Court, 133 Cal. App. 4th 396, 404 n.4, 409-10 (2005); see also Shroyer, 498 F.3d at 983 (“[T]here are most certainly circumstances in which a class action waiver is unconscionable under California law despite the fact that all three parts of the Discover Bank test are not satisfied.“).12
As the Supreme Court of California has determined, the unconscionability analysis is “highly dependent on context.” Sanchez, 61 Cal. 4th at 911. The specific context of Flo‘s conduct reveals a high degree of procedural unconscionability. The waiver is in a contract of adhesion which was offered to users on a “take it or leave it” basis. See, e.g., Ronderos v. USF Reddaway, Inc., 114 F.4th 1080, 1089-90 (9th Cir. 2024). It is presented under the heading “Miscellaneous” as a single sentence at the end of the terms of use. See, e.g., App‘x 1531;
In light of the marked degree of procedural unconscionability, “less evidence of [substantive] unconscionability is required.” Shroyer, 498 F.3d at 981-82 (citation omitted). That bar is met. The waiver‘s effect is “to deny a procedural benefit only [Flo‘s] customers would employ,” which suggests the term is “manifestly and shockingly one-sided,” Ingle v. Circuit City Stores, Inc., 328 F.3d 1165, 1176 (9th Cir. 2003), abrogated on other grounds by Concepcion, 563 U.S. 333, as app developers “typically do not sue their customers in class action lawsuits,” Szetela v. Discover Bank, 97 Cal. App. 4th 1094, 1101 (2002). The waiver “serves as a disincentive for [Flo] to avoid the type of conduct that might lead to class action litigation in the first place,” which compounds the term‘s “one-sided” nature. Discover Bank, 36 Cal. 4th at 159 (quoting Szetela, 97 Cal. App. 4th at 1101).
Overall, the waiver is unconscionable on procedural and substantive grounds for many of the same reasons as those given in Discover Bank and the California cases that followed. Under the context-specific analysis California law requires, see Sanchez, 61 Cal. 4th at 911, the Court concludes the class action waiver in Flo‘s terms of use cannot be enforced to bar certification.
D. Standing
Defendants liberally sprinkled comments about plaintiffs’ standing to sue in their brief. See, e.g.,
The only potential standing issue that warrants further discussion concerns anonymized data. A plaintiff suffers an injury in fact from “‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.‘” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (citation omitted). Defendants suggest that the interception of anonymized information is not a “concrete” injury within the meaning of these requirements, and so certification should be denied across the board.
The point is not well taken. Individuals have a time-honored right to control access to their private information and affairs. See Patel, 290 F. Supp. 3d at 954. “The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others.” U.S. Dep‘t of Just. v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763 n.15 (1989) (quoting Warren & Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 198 (1890-1891)). Consequently, the legal injury at the heart of plaintiffs’ case -- the capture of personal information without a user‘s consent -- occurs when the personal information is obtained in the first instance. The fact that misappropriated data may be anonymized by stripping it from its owner and blending it with other data does not cure or wash away the original violation. A stolen diamond remains stolen even if it makes its way into a bag with legal stones or the thief does not know from whom he took it. To conclude otherwise would give carte blanche to obtaining and exploiting consumers’ private and sensitive information without consent.
Our case law underscores the principle that the privacy injury occurs at the point of interception without consent, irrespective of whether the misappropriated data is anonymized. For example, the Ninth Circuit consults the Restatement (Second) of Torts to determine if harms are “concrete” because they “bear a ‘close relationship’ to [harms] that have ‘traditionally been
Consequently, the harm made actionable at common law was an individual‘s loss of control over her “private affairs or concerns” by an interloper‘s tortious “intentional interference.” Restatement 2d § 652B cmt. a; see also In re Facebook, Inc. Internet Tracking Litig. (In re Facebook), 956 F.3d 589, 599 (9th Cir. 2020) (“Facebook‘s tracking practices allow it to amass a great degree of personalized information. . . . without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives.“). Put in terms of standing, the loss of control over one‘s personal information is the “concrete” harm, whether from stealing access to a personal diary in 1916 or obtaining user information in a healthcare app in 2016. In each case, a person has lost control over her private information because of another‘s intentional actions.
Defendants’ reliance on TransUnion does not lead to a different conclusion.
The other cases cited by defendants also fall short. See Dkt. No. 490-2 at 18-19. In Dinerstein v. Google LLC, the plaintiff abandoned an intrusion-upon-seclusion claim to pursue a novel medical-confidentiality theory, “the closest comparator” to which was “probably the tort of publicity given to private life.” 73 F.4th 502, 512-13 (7th Cir. 2023). There, the Seventh Circuit concluded that “the dissemination of anonymized information” would not give rise to an injury in fact because “[a]bsent an ability to identify the complainant, there can be no communication and hence, no publicity.” Id. at 513-14 (emphasis in original) (quoting Harris ex rel. Harris v. Easton Publ‘g Co., 335 Pa. Super. 141, 157 (1984)). That observation has no application to this case, which does not involve any publicity torts. Similarly, Cahen v. Toyota Motor Corp., 717 Fed. App‘x. 720, is also distinguishable. There, in the context of affirming a
Consequently, defendants’ standing arguments pose no barrier to certification. With these overarching objections resolved, the Court now turns to the certification analysis for the specific claims for which plaintiffs seek certification.
Plaintiffs seek
“The Supreme Court of California has emphasized the ‘context specific nature of the inquiry’ for these claims.” Id. (citation omitted). It has stated that “privacy interests and accompanying legal standards are best viewed flexibly and in context” and “[a] plaintiff‘s expectation of privacy in a specific context must be objectively reasonable under the circumstances, especially in light of the competing social interests involved.” Hill, 7 Cal. 4th at 26-27, 31. “For the offensiveness or seriousness of the intrusion on privacy, ‘California tort law provides no bright line,’ and ‘each case must be taken on its facts.‘” Cherkin, 2025 WL 844378, at *2 (citation omitted). The salient question is whether the invasion was “highly offensive to a reasonable person, and sufficiently serious and unwarranted so as to constitute an egregious breach of the social norms.” In re Facebook, 956 F.3d at 606 (quotations and citation omitted).
Plaintiffs’ privacy claims pose a number of questions common to all class members, such as: (1) Did the Custom Events generated during user onboarding share private health information?; (2) Was private information transmitted to Google and Meta?; (3) Did Flo assure users via the terms of service and other statements that it would not share private health information?; and (4) Was the transmission of such information and defendants’ subsequent commercial exploitation of it highly offensive to a reasonable person? These classwide questions inform the resolution of the privacy claims, and they may be answered by evidence common to the class, namely the
Defendants resist this conclusion on three main grounds: (1) determining whether the transmitted data included health information entails individualized questions; (2) plaintiffs did not consider the transmitted data to be private; and (3) there are questions of whether the transmitted data was accurate and actually about the user. None of the objections are well taken.
To start, defendants say that “most of the challenged Custom Events reflect only whether a user entered certain information” and “[t]here are no data that can be used to determine what Custom Events the Flo app sent to” Google and Meta for each Flo App user. Dkt. No. 490-2 at 12-13 (emphasis omitted). Defendants contend there will need to be individualized inquiries about each users’ onboarding responses to determine if those responses conveyed private health information. Id. at 12. In effect, defendants object that plaintiffs are wrong on the merits about the communication of personal health information.
Defendants misunderstand the
Defendants suggest that users did not share the same information during onboarding (e.g., some users chose “get pregnant” while others chose “track my cycle“), and so a variation in expectations of privacy necessarily arises. Dkt. No. 490-2 at 13-14. Defendants also make the somewhat duplicative argument that the privacy claims necessarily entail individual inquiries because they require users to have “conducted themselves in a manner consistent with an actual expectation of privacy.” Id. at 15 (cleaned up). In defendants’ view, this means certification should be denied because plaintiffs “cannot prove, on a classwide basis, that each Flo user treated the information sent to Google and Meta as private,” and evidence on this point can be obtained only “through plaintiff-specific discovery.” Id. at 15-17 (cleaned up).
These objections are in conflict with the evidence and the law. With respect to the facts, defendants did not proffer any evidence indicating that the choice of a specific Custom Event by a user necessarily entailed a different or lesser expectation of privacy. Given the evidence that the Custom Events involved information like a user‘s last menstrual period and number of weeks of pregnancy and that Flo made the same substantive representations to all users about their personal information, it is not obvious that fine degrees of privacy expectations are in play. In effect, defendants merely speculate on this point, which is not a basis to deny certification. See True Health, 896 F.3d at 932. It also bears repeating that evidence of the Custom Events and related facts are subject to classwide proof.
California law also undercuts defendants’ theory. The Supreme Court of California has concluded that “[a] ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly based and widely accepted community norms” and that “customs, practices, and physical settings surrounding particular activities may create or inhibit reasonable expectations of privacy.” Sheehan v. San Francisco 49ers, Ltd., 45 Cal. 4th 992, 1000 (2009) (alteration omitted) (quoting Hill, 7 Cal. 4th at 36-37). Defendants pluck a single sentence from Hill to the effect that “the
Defendants’ final challenge to predominance for these privacy claims is a hash of overlapping propositions. They say that plaintiffs cannot prove on a classwide basis that the information transmitted was: (1) about the user and not another person; (2) accurate about the user and not made up; and (3) capable of identifying a particular user. Dkt. No. 490-2 at 18-19. In effect, defendants say that the collection of an actual user‘s personal health information cannot be demonstrated by anything less than individualized inquiries. Id. at 18.
The record again rebuts defendants’ theory. To start with the first proposition -- the authenticity of user information provided during the onboarding process -- defendants rely on four sentences of deposition testimony stating: “[W]e have at least 15 percent of users who are male and they‘re using our apps. I don‘t know why. There‘s like some suggestions. I mean, like, ideas why they use it and in most of the cases it‘s like to learn about the human body.” Dkt. No. 490-2 at 19; App‘x 1501. Defendants take this testimony to mean that the proposed classes include imposters who were not subject to privacy violations, which they believe bars certification.
Not so. Taking all of defendants’ proffers at face value for present purposes, defendants did not demonstrate that a certain rate of “fakes” would so overwhelm common questions and answers that class certification would be inappropriate. See Olean, 31 F.4th at 669; Ruiz-Torres, 835 F.3d at 1136. In addition, the fact that Flo was able to measure the 15% figure indicates that it can identify “fakes” based on its own classwide data. That is all that is required for purposes of
So too for the suggestion of fictitious information. Defendants offer a mishmash of random tidbits for this objection, such as a handful of birth dates that are said to look odd. See Dkt. No. 490-2 at 19; App‘x 810-11; Dkt. No. 478-4 at 019. Some of the tidbits are simply baffling. Defendants cite testimony by Flo‘s Chief Product Officer that “we have, like, quite a lot of users who, like, just in case you‘re there and clicks like all like buttons for like event and so their decisions.” Dkt. No. 490-2 at 19 (quoting App‘x 1501). The remark is literally incomprehensible and properly disregarded for that reason. Overall, defendants again did not demonstrate that individual questions will overwhelm the common inquiries and answers.
The same goes for a comment made by one of plaintiffs’ experts to the effect that her husband uses the Flo App “to mess around with data that may be getting analyzed . . . in light of the overturning of Roe v. Wade,” and that she had heard other men do the same. App‘x 470-71, 508-09; Dkt. No. 490-2 at 19. Random anecdotes are not proof that individualized inquiries will overwhelm the proposed classes here. In addition, the Supreme Court overruled Roe v. Wade, 410 U.S. 113 (1973), over three years after the end of the class period. See Dobbs v. Jackson Women‘s Health Org., 597 U.S. 215 (2022).
Defendants’ references to a couple of consumer surveys did not strengthen their position. The first is a generic survey of consumers in the United Kingdom. App‘x 765-70. Defendants favor the survey because it says that consumers “are deliberately giving brands false data” and “60% of consumers intentionally provide incorrect information when submitting their personal details online.” App‘x 767-6. Defendants did not tie this generalized observation in any meaningful way to the behavior of Flo App users in the United States. Moreover, critical information about the survey‘s methodology, validity, and reliability was not provided. So too for a second survey, again unrelated to Flo, purporting to find that “72% of our respondents say they sometimes provide fake personal information to access website content.” App‘x 750, 753. This observation is again untethered to the behavior of plaintiffs or class members here, who
For user identifiability, defendants say “[t]here are many reasons why data associated with a device may not have been associated with a specific person, including because some people may share devices or reset their device identifiers.” Dkt. No. 490-2 at 19. This is said to require individual inquiries into whether data tied to a persistent identifier in fact identified an individual user. But defendants did not proffer any evidence to establish that a meaningful number of putative class members either changed their device‘s persistent identifier or shared with another person the device on which they used the Flo App. See True Health, 896 F.3d at 932. For their part, plaintiffs cited evidence to the contrary stating that “only 2.3% of US Android users accessed these settings to opt out of ad personalization.” Egelman Rep. ¶ 30. The Court will not “root through the record” for other evidence that defendants did not identify. CZ Servs., Inc. v. Express Scripts Hold. Co., No. 18-cv-04217-JD, 2020 WL 4368212, at *3 (N.D. Cal. July 30, 2020).
In sum, commonality and predominance are satisfied for the nationwide class‘s intrusion upon seclusion claim, and the California subclass‘s California constitutional privacy claim.
F. Confidentiality of Medical Information Act (CMIA)
Plaintiffs seek the certification of a nationwide class against Flo for the claim under California‘s Confidentiality of Medical Information Act (CMIA),
Plaintiffs have adduced evidence demonstrating commonality and predominance for this claim. The question of whether Flo was a healthcare provider can be answered on a classwide basis by common proof of Flo‘s services and practices. See, e.g., Dkt. Nos. 478-5 at 090; 478-83 at 629; 478-84 at 557. The common evidence of Flo‘s privacy representations, the surreptitious transmission of the onboarding-process Custom Events, and the subsequent commercial appropriation of that data can be offered as common proof that Flo was at least negligent in sharing medical information without users’ authorization, see Berkley v. Dowds, 152 Cal. App. 4th 518, 526 (2007), and that the information was viewed.
Flo suggests there may be individualized issues about “actual damages,” Dkt. No. 490-2 at 20, but that makes scant sense. Plaintiffs are seeking statutory damages under the CMIA, a fact
Flo also says that predominance cannot be shown because “determining whether Flo app users ‘took measures to protect against the misuse of their information’ and whether ‘third parties could have obtained this information through other means’ are inherently individualized inquiries.” Dkt. No. 490-2 at 15 (citing Vigil, 84 Cal. App. 5th at 222). Not so. Vigil held the CMIA requires showing that an unauthorized person viewed the medical information and the healthcare provider‘s negligence was the cause. 84 Cal. App. 5th at 213-15. As discussed above, plaintiffs here have offered common proof of those elements. While the Vigil court denied certification because the plaintiff there “presented no evidence indicating whose information was viewed” for the nearly 5,500 putative class members, id. at 221, the circumstances here are different. Plaintiffs have satisfied commonality and predominance for the CMIA claim.
G. Comprehensive Data Access and Fraud Act (CDAFA)
Plaintiffs seek certification of a nationwide class for claims under California‘s Comprehensive Data Access and Fraud Act (CDAFA),
Plaintiffs’ bid for certification falters here because they did not proffer classwide evidence of “damage or loss” under CDAFA. Plaintiffs’ sole contention is that their data had financial value, which they base entirely on the opinions of a putative expert, David Hoffman. See Dkt. No. 477 at 18-19. The Court has determined that Hoffman may not provide opinions or testimony at trial under FRE 702. Dkt. No. 597. Even if Hoffman‘s testimony were admissible, it would not show that Flo App users “ever attempted or intended to participate in [the women‘s health data
Contrary to plaintiffs’ suggestion, the Court did not conclude that CDAFA does not require “proof of ‘loss of income’ or other ‘actual’ injury beyond [a] privacy violation.” Dkt. No. 496-3 at 13. The summary judgment order determined that Google had not met its burden of establishing it was “entitled to judgment as a matter of law” under
H. Breach of Contract
For the breach of contract claim against Flo, which plaintiffs seek to litigate on behalf of a nationwide class, California law requires evidence of “the existence of the contract, performance by the plaintiff or excuse for nonperformance, breach by the defendant and damages.” First Comm‘l Mortg. Co. v. Reece, 89 Cal. App. 4th 731, 745 (2001). Plaintiffs’ evidence can answer the various questions posed by this claim on a classwide basis: (1) whether use of the Flo App was governed by a contract and the terms of that contract; (2) whether Flo promised users it would not share their health information; and (3) whether Flo breached that promise by sharing users’ health information with Google and Meta. The answers to the first and second questions are ascertainable by a review of Flo‘s terms of use and privacy disclosures during the class period, and
Contrary to Flo‘s contention, see Dkt. No. 490-2 at 20 (citing Aguilera v. Pirelli Armstrong Tire Corp., 223 F.3d 1010 (9th Cir. 2000)), California law does not require a showing of “actual damage” for a breach of contract claim. Recent rulings by the California Court of Appeal expressly disagreed with Aguilera and held that “California courts have applied section 3360 to conclude that ‘[a] plaintiff is entitled to recover nominal damages for the breach of a contract, despite inability to show that actual damage was inflicted upon him.‘”15 Elation Sys., Inc. v. Fenn Bridge LLC, 71 Cal. App. 5th 958, 965-67 (2021) (quoting Sweet v. Johnson, 169 Cal. App. 2d 630, 632 (1959)); Garcia v. Bank of Stockton, No. F084375, 2023 WL 8795765, at *8 (Cal. Ct. App. Dec. 20, 2023) (unpub.); see also
I. California Invasion of Privacy Act (CIPA)
Plaintiffs seek the certification of a California subclass for claims against Google and Meta under the California Invasion of Privacy Act (CIPA),
Plaintiffs’ evidence is capable of showing on a classwide basis that (1) Google and Meta intercepted and recorded users’ communications with Flo via their SDKs’ transmission of the Custom Events; (2) users expected those communications to be private based on Flo‘s representations; (3) the interception and recordings were without users’ consent; (4) Google and Meta used the intercepted and recorded communications for their own commercial gain; and (5) Google and Meta intended to do so, as evinced by the design of their SDKs and their attempts to continue collecting the same information even after Flo sought to remove the SDKs.
Google and Meta say individual issues will predominate because plaintiffs will need to prove the communications were “being sent from, or received at any place within” California.
Plaintiffs say they have evidence demonstrating that “Flo‘s location data shows which users were in California,” Dkt. No. 496-3 at 12, but they fall short of showing which users completed the onboarding process in California. The evidence consists of a few exhibits containing hundreds of lines of incomprehensible code, and a line or two reading something like “‘time_zone‘:‘America/New_York.‘” Dkt. No. 478-44 at 004. What this evidence might mean or how it is germane to certification is unexplained. Consequently, it does not resolve the server location question in a reasonable manner for the putative class. Plaintiffs make the passing comment that they have evidence that Google and Meta are “based in California, where they designed their SDKs and use the data intercepted through that technology.” Dkt. No. 496-3 at 12. That also does not answer the salient question. The case plaintiffs cite is inapposite because the complaint there alleged the defendants “received the interception” in California and “intercepted
Commonality and predominance are demonstrated for the CIPA § 632 claim, but not for the § 631 claim.
IV. RULE 23(b)(3) SUPERIORITY
“The final certification question [for certification under
The record amply demonstrates discovery was complicated and voluminous, to say the least, and defendants are represented by law firms with deep resources, all of which demonstrate that litigating these claims entails “relatively high costs.” Just Film, 847 F.3d at 1123; see DZ Reserve, 2022 WL 912890, at *9 (noting the “cost and other resources required to litigate against a company like Meta“). Resolution of the common questions discussed in this order on a classwide basis will promote efficiency by (1) bypassing the need to relitigate identical questions and conduct nearly identical discovery in parallel litigations and (2) avoiding the strain on scarce judicial resources that suits by individual Flo App users would impose. See Just Film, 847 F.3d at 1123-24; Valentino v. Carter-Wallace, Inc., 97 F.3d 1227, 1234-35 (9th Cir. 1996). Superiority is satisfied.
V. RULE 23(b)(2)
Plaintiffs’ cursory request to certify nationwide and California classes for injunctive relief under
CONCLUSION
The following nationwide class is certified under
All Flo App users in the United States who entered menstruation and/or pregnancy information into the Flo Health App between November 1, 2016, and February 28, 2019, inclusive.
Plaintiffs Erica Frasco, Sarah Wellman, Jennifer Chen, Tasha Gamino, and Autumn Meigs are appointed as named representatives for the nationwide class.
The following California subclass is certified under
All Flo App users in California who entered menstruation and/or pregnancy information into the Flo Health App while residing in California between November 1, 2016, and February 28, 2019, inclusive.
Plaintiffs Wellman, Chen, and Gamino are appointed as named representatives for the California subclass.
Pursuant to
//
//
//
//
IT IS SO ORDERED.
Dated: May 19, 2025
JAMES DONATO
United States District Judge