A Canadian class-action lawsuit accusing a popular fertility tracking app of sending users’ intimate health information — including details about their periods, sex lives and pregnancies — to companies like Facebook without their knowledge has been allowed to go ahead.
The claim, certified in B.C. Supreme Court on Thursday, said Flo Health collected their highly sensitive personal information, promised to keep that information private and then knowingly shared the data with third parties.
“There’s been a significant disclosure of the private information of Canadian women, and we’re excited to be proceeding to the next step with the case,” said Richard Parsons, who is co-counsel on the case.
The ruling is a pivotal step forward for the case. It will test lagging Canadian privacy laws in a time when millions of people regularly pour their personal information into their phones. If the claim succeeds, more than one million people who used Flo in Canada over a three-year period will be eligible to claim damages.
None of the lawsuit’s claims have been proven in court. In a statement to CBC News on Friday, Flo said it “has never sold user information or shared user information with third parties for the purposes of advertising.”
“Flo will vigorously defend against allegations stipulated in the case.”
Lead plaintiff used app while trying to get pregnant
Flo is an app that tracks users’ fertility and periods. Users enter personal information about their height, weight, sex lives and reproductive cycles — including details about their periods, vaginal discharge, pregnancies, miscarriages, births and postpartum symptoms.
Jamie Kah Cate Lam, the lead plaintiff in the class action, said she used the Flo app for 18 months while she and her husband were trying to conceive. The B.C. woman gave the app information about the different stages of her menstrual cycle and how often she and her husband were having intercourse, according to an affidavit.
After her son was conceived in 2017, Lam continued to use the app in pregnancy mode. Her son was born in April 2018, and she later deleted the app.
Danielle Citron, a professor of law at the University of Virginia School of Law, says health data collected by smartphone apps could be used to prosecute U.S. women for having illegal abortions.
In 2019, The Wall Street Journal published an article saying Flo gave users’ sensitive personal information to Facebook and other companies without their knowledge. Testing commissioned by the newspaper showed Flo told Facebook when an app user was on their period or trying to get pregnant.
Lam declined an interview request. In her affadavit, she said she was “shocked to learn that Flo Health had disclosed my personal information to Facebook and others, despite my clear understanding when I downloaded the Flo App that my information would be kept private.”
The U.S. Federal Trade Commission (FTC) launched an investigation following the Journal’s story, and alleged the company had broken its promise to keep users’ data private by sharing it.
As part of a settlement with the U.S. agency in 2021, Flo was required to obtain users’ consent before sharing their health information. The company did not admit guilt in the settlement, and has said it does not share data without people’s permission.
“Flo did not at any time share users’ names, addresses or birthdays with anyone. We do not currently, and will not, share any information about our users’ health with any company unless we get their permission,” the company said in a statement at the time.
It said it settled with the FTC “to avoid the time and expense of litigation.”
In greenlighting the Canadian class action on Thursday, B.C. Supreme Court Justice Lauren Blake said the class would include all Canadian residents, excluding those in Quebec, who used the Flo app between June 1, 2016 and Feb. 23, 2019.
“There are over a million Canadian users of the app in the proposed class. I am satisfied that … a class-action proceeding will still provide significant advantages in judicial economy and efficiency,” Blake wrote.
A class-action certification does not mean the allegations have been proven, but that lawyers showed there is a group that might benefit from the case going before a judge.
At the heart of the issue is an analytics tool that both Facebook and Google offer app developers called software-development kits, or SDKs. Developers use SDKs to better understand users’ behaviour or to collect data they can use to increase their user base.
In return, apps share user data with Facebook or Google so the tech giants can then personalize ads and other content — a mutually beneficial arrangement, in which a person’s personal information becomes the commodity, Parsons said.
“They’re bartering, and what they’re bartering with is the data of the users.”
Airplay7:29Do you know what data the apps on your devices are collecting from you? Tech columnist Mohit Rajhans explain how we can minimize some of our digital vulnerabilities.
Recently, Canada joined the United States and the European Union in banning the TikTok app from government-issued devices… With officials citing data privacy concerns. And there are growing calls in the States to ban the app altogether. But despite efforts to regulate them, experts say it’s likely that many apps collect and use data without proper disclosure. Mohit Rajhans.is a writer and tech columnist with CBC Radio. He spoke with Airplay guest host George Maratos
Generally speaking, Parsons said, any information shared with an app using an SDK can also be shared with the company that owns the SDK — so users’ personal data that was shared with Flo could also be shared with Facebook, because Flo was using Facebook’s SDK.
Parsons said the problem is Flo wasn’t upfront with its users about how far their information might be shared.
“If an app developer wants to use SDKs of those data-collecting agent companies, then their privacy policy needs to clearly tell users that the data is going to be going to these third parties,” he said.