US Judge Approves Flo App $56 Million Privacy Settlement

• A federal judge is set to approve a $56 million settlement in a class-action lawsuit against the Flo period-tracking app for sharing sensitive user data.
• The lawsuit alleged Flo Health improperly shared personally identifiable and private health data with third parties like Google and Meta.
• Google will pay $48 million and Flo Health $8 million, with eligible users receiving between $12.69 and $31.94.
• The judge criticized attorneys' request for over $19 million in fees, calling it "astronomical" and indicative of "duplicative work," reducing it by 5%.
• A jury previously found Meta liable for violating the California Invasion of Privacy Act by recording sensitive health information through Flo.

Judge Donato sharply criticized this request, stating that asking for 32.5% of the total settlement was "just taking money out of consumers' pockets."

A federal judge has signaled his intent to grant final approval for a substantial $56 million settlement resolving a class-action lawsuit against the period-tracking application Flo Health. The legal action, initiated in 2021 by a group of app users, alleged that Flo improperly disseminated highly sensitive personal and health information to various third parties. Among the entities implicated in the data sharing were Facebook, now known as Meta, Google, the ad analytics firm AppsFlyer, and the defunct analytics company Flurry.

The comprehensive settlement includes distinct contributions from the involved parties. Google is slated to contribute $48 million, while Flo Health will pay $8 million, bringing the total to $56 million. Earlier in the litigation, Flurry reached a separate $3.5 million settlement with the users, which received preliminary approval last May. Claims against AppsFlyer were voluntarily dismissed in 2022. Eligibility for compensation from the main settlement extends to U.S. users who input menstruation or pregnancy data into the Flo app between November 1, 2016, and February 28, 2019. Direct notification of the settlement has reached over 3 million class members, representing approximately 33% of the total class, with an additional 4.8 million expected to be informed through indirect methods. Individual class members can anticipate receiving between $12.69 and $31.94, depending on the volume of claims submitted.

The lawsuit centered on allegations that Flo Health shared users' personally identifiable information and private health data without consent, a practice that has drawn significant scrutiny under privacy regulations. This case highlights the increasing legal risks for health-related applications that handle sensitive user data. In a related development, a jury in August found Meta liable for violating the California Invasion of Privacy Act (CIPA) after a two-week trial. The verdict determined that Meta intentionally recorded the sensitive health information of millions of women via the Flo app. Flo Health, for its part, settled with Meta mid-trial, explicitly stating it admitted no wrongdoing in that specific context.

The CIPA violation by Meta carries significant implications for affected individuals. Following the jury's verdict, U.S. District Judge James Donato ordered representatives from the plaintiffs, Meta, and Covalynt—the company responsible for identifying potential class members—to convene and resolve outstanding issues related to the Meta judgment. Class members impacted by Meta's CIPA violation could be eligible for statutory damages of up to $5,000 per violation, underscoring the severe financial penalties associated with breaches of privacy laws concerning sensitive health data.

During the proceedings, Judge James Donato, a Barack Obama appointee, expressed considerable skepticism regarding the attorney fees requested by the plaintiffs' legal teams. The attorneys sought more than $19 million, which constituted nearly one-third of the Google settlement and 20% of the separate Flurry and Flo settlements. Judge Donato sharply criticized this request, stating that asking for 32.5% of the total settlement was "just taking money out of consumers' pockets." He voiced deep suspicion about potential duplicative work among the numerous law firms involved, noting, "I have no idea what these people were doing. I can't do anything with this."

Despite his strong reservations and acknowledging the "epic ball of yarn in terms of billing issues," the judge indicated he would reduce the attorneys' fee request by 5% due to time constraints preventing a more thorough review. He also approved the attorneys' request for $3 million to cover litigation expenses, despite labeling this amount "astronomical" and suggesting it was "probably even more than you should get." Judge Donato's comments underscore a growing judicial trend of closely examining and challenging what are perceived as excessive attorney fee requests in class action settlements, particularly when they appear to diminish class member recovery.

This settlement serves as a critical reminder of the significant legal and reputational risks faced by health and wellness applications that collect and process highly personal user data. The substantial $56 million payout, coupled with Meta's separate CIPA violation verdict, highlights the stringent requirements for data privacy and the severe consequences of non-compliance, particularly under laws like the California Invasion of Privacy Act. For consumers, the resolution offers a measure of redress for alleged privacy breaches, demonstrating that legal avenues exist to hold companies accountable for the handling of sensitive information.

Moreover, Judge Donato's pointed remarks regarding attorney fees signal a heightened judicial scrutiny of compensation in class action litigation. His concerns about "astronomical" expenses and "duplicative work" reflect a desire to ensure that settlements primarily benefit the class members they are intended to serve, rather than disproportionately enriching legal counsel. This judicial stance could influence future class action fee requests, compelling attorneys to provide more robust justifications for their billing practices and potentially leading to more favorable outcomes for affected consumers in similar privacy cases.

This development highlights increased judicial scrutiny of attorney fees in class action settlements, particularly concerning 'astronomical' requests and duplicative work, which lawyers should anticipate and be prepared to justify. For compliance officers, it reinforces the significant liability and reputational risks associated with sharing sensitive user data from health apps with third parties, underscoring the need for stringent data privacy protocols to avoid similar class action litigation and statutory damages under laws like the California Invasion of Privacy Act.

Source: Original reporting via Courthouse News Service