Case Information
*1 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA ERICA FRASCO, et al., Case No. 21-cv-00757-JD Plaintiffs, SUMMARY JUDGMENT ORDER RE v. META AND FLO FLO HEALTH, INC., et al.,
Defendants.
This order resolves the motions for summary judgment filed by defendants Flo and Meta. Dkt. Nos. 528, 536. The parties’ familiarity with the record is assumed. Summary judgment is granted and denied in part. I. META’S MOTION First, summary judgment is granted on the claim under the Wiretap Act, 18 U.S.C. § 2511. There is no liability under the Act if “one of the parties to the communication” gives “prior consent,” id. § 2511(2)(d), and the undisputed record shows that Flo consented to Meta’s data collection practices. The Court notes that plaintiffs did not seek class certification of this claim, see Dkt. No. 477, and that the basis of dismissal re Meta was not raised by Google in its summary judgment papers, Dkt. No. 338 at 19.
Second, summary judgment on the claims under the California Invasion of Privacy Act (CIPA), Cal. Pen. Code §§ 631-32, is denied. Disputes of fact abound with respect to the scope of consent, the timing of Meta’s “interception” or “eavesdropping,” whether Meta “intended” to intercept communications, whether Meta’s interception occurred while the communications were “in transit,” and the like. , App’x 507-10, 847-48, 718-20; Dkt. Nos. 478-6 ¶¶ 82-90; 478- 10 ¶¶ 17-18; 564-5 at 867. Class certification was granted for the § 632 claim but was denied for *2 the § 631 claim. See Frasco v. Flo Health, Inc. ( ), No. 21-cv-757-JD, 2025 WL 1433825, at *19 (N.D. Cal. May 19, 2025). Consequently, the § 632 claim will proceed on a classwide basis for the California subclass while the § 631 claim will proceed solely for plaintiffs Wellman, Chen, and Gamino.
Third, summary judgment on the California Comprehensive Computer Data Access and Fraud Act (CDAFA) claim, Cal. Pen. Code § 502, is granted. The sole ground advanced by plaintiffs relies on their putative expert, David Hoffman, to show that the Custom Event data carried “financial value” to Flo App users and that its surreptitious transmission caused them “damage or loss.” Dkt. No. 564-3 at 24. Hoffman has been excluded from testifying at trial under Federal Rule of Evidence 702, Dkt. No. 597, and plaintiffs did not present an alternative, non- speculative basis for showing “damage or loss.” Certification was denied as to this claim, Flo Health II , 2025 WL 1433825, at *17-18, so summary judgment is granted against the named plaintiffs. Fourth, summary judgment is granted on individual named plaintiffs’ claim that Meta aided and abetted Flo’s intrusion upon seclusion. Plaintiffs’ evidence for this claim is not materially different from the evidence they proffered in the unsuccessful assertion of a very similar aiding-and-abetting claim against Google. Summary judgment is warranted here for the same reasons re Google. See Frasco v. Flo Health, Inc. ( Flo Health I ), No. 21-cv-757-JD, 2024 WL 4280933, at *3 (N.D. Cal. Sept. 23, 2024).
Fifth, with the named plaintiffs’ agreement, Dkt. No. 564-3 at 25, summary judgment is granted on the UCL claim.
II. FLO’S MOTION
First, summary judgment on the ground that all claims are time barred is denied. A jury will need to decide whether Flo’s privacy disclosures sufficed to give users constructive notice of the alleged misconduct, and with respect to the discovery rule, plaintiffs set forth evidence from which a reasonable jury could find that they did not learn about the alleged misconduct until January 2021. , Dkt. Nos. 535-11 at 117:23-118:6; 535-14 at 232:10-233:14; 535-18 at 87:19-89:10. Flo’s public representations after the publication of the Wall Street Journal article *3 create fact issues about the applicability of the fraudulent concealment doctrine which will need to be resolved by the trier of fact. , Dkt. No. 496-4 at 289-90; 536-60 at ECF 5.
Second, Flo’s request to enforce the class waiver in its terms of use is not well taken for the reasons given in the Court’s certification order. , 2025 WL 1433825, at *9-11.
Third, with the named plaintiffs’ agreement, Dkt. No. 560-3 at 24 n.14, summary judgment is granted on their implied contract and UCL claims. Summary judgment is also granted on named plaintiffs’ unjust enrichment claim to the extent it is asserted as an independent cause of action, as it overlaps with plaintiffs’ other substantive claims. See LeBrun v. CBS Tv. Studios, Inc. , 68 Cal. App. 5th 199, 211 (2021); Paracor Fin., Inc. v. Gen. Elec. Cap. Corp. , 96 F.3d 1151, 1167 (9th Cir. 1996). Insofar as plaintiffs pursue equitable remedies, like disgorgement, not as independent causes of action but pursuant to other claims, like intrusion upon seclusion, Flo did not meet its burden of showing its entitlement to judgment and the absence of fact disputes concerning the adequacy of legal remedies. Fed. R. Civ. P. 56(a). Fourth, summary judgment on the Confidentiality of Medical Information Act (CMIA) claim, Cal. Civ. Code §§ 56 et seq. , is denied. Flo’s arguments are not well taken. Dkt. No. 535-3 at 18-22. Flo says that it is not a “Provider of health care” as contemplated by § 56.05(p) and that the CMIA was amended in 2023 to include express references to “[r]eproductive or sexual health application information.” Id. at 18-19. As a result, Flo says the “CMIA did not apply to pregnancy and fertility tracker apps like Flo from 2016 through 2019.” Id. at 19. This argument was not raised in connection with class certification, and it does not now sink plaintiffs’ claims.
Flo ignores the plain text of both § 56.05(j) and § 56.06(b). There are fact disputes about Flo’s services and practices, based on the evidence discussed in the certification order, Flo Health II , 2025 WL 1433825, at *17, bearing on (1) whether the Custom Event data was “individually identifiable information . . . in possession of . . . a provider of health care . . . regarding a patient’s medical history, mental or physical condition, or treatment,” Cal. Civ. Code § 56.05(j) (2019); and (2) whether Flo is a “business that offers software . . . including a mobile application . . . that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make that information available to an individual . . . for purposes of *4 allowing the individual to manage his or her information,” id. § 56.06(b) (2019). Flo did not say why the plain text of either subsection should be read more narrowly than their ordinary meaning simply because the 2023 amendments added provisions that would overlap in some instances. See Skidgel v. Cal. Unemployment Ins. App. Bd. , 12 Cal. 5th 1, 14 (2021) (“We begin by examining the statutory language, giving it a plain and commonsense meaning.” (citation omitted)). Insofar as legislative history is helpful here, it is less definitive than Flo suggests. , Cal. Bill Analysis, A.B. 254 Sen., 6/13/2023 at 6 (noting the concern that some reproductive health apps would not “necessarily be captured under the existing definition of medical information”); Cal. Bill Analysis, A.B. 254 Assem., 4/25/2023 at 5 (expressing concerns about “serious loopholes in existing protections”).
Flo’s contention that the Custom Event data was not “medical information” because the data was “de-identified” is also unavailing. Dkt. No. 535-3 at 21-22. As discussed in the certification order, there is evidence from which a reasonable jury could find that the transmitted Custom Events “include[d] or contain[ed] any element of personal identifying information sufficient to allow identification of the individual.” Cal. Civ. Code § 56.05(j); , 2025 WL 1433825, at *5. The CMIA claim will proceed on a classwide basis. Flo’s specific objections may be raised at trial as circumstances warrant. Fifth, summary judgment is granted on all claims asserted by plaintiff Pietrzyk, who did not start using the Flo App until long after the class period and whose claims plaintiffs did not defend. See Dkt. Nos. 560-3; 579-3 at 1 n.1.
Finally, Flo’s suggestion in a footnote that it “incorporated” other filings, Dkt. No. 353-3 at 8 n.4, is misdirected. Paragraph 22 of the Court’s Standing Order for Civil Cases proscribes such tactics, J. Donato, Standing Order for Civil Cases ¶ 22, and the Court declines to root through the record to make Flo’s case for it, see Flo Health II , 2025 WL 1433825, at *16.
CONCLUSION
Summary judgment is granted to Meta on named plaintiffs’ CDAFA, federal Wiretap Act, aiding-and-abetting intrusion upon seclusion, and UCL claims but is denied in all other respects. Summary judgment is granted to Flo on the UCL and implied contract claims, as well as the claim *5 of unjust enrichment insofar as that is asserted as a standalone claim. Summary judgment is also granted to Flo on all claims asserted by plaintiff Pietrzyk but is denied in all other respects. The request for judicial notice, Dkt. No. 563, is denied as moot.
IT IS SO ORDERED.
Dated: May 22, 2025
JAMES DONATO United States District Judge
