guides
Published by Floriva · Updated 2026-04-02 · How Floriva checks its guides
Does Flo Sell Your Data FTC Settlement and What Changed
Flo shared period data with Facebook and Google. The FTC acted in 2021. A $59.5M settlement followed in 2025. What changed and what didn't.
Flo shared users' reproductive health data, including period dates, pregnancy status, and symptoms, with Facebook and Google despite promising not to. The FTC took enforcement action in 2021. A $59.5M class action settlement followed in September 2025. Flo still stores data on its servers, which can be subpoenaed.
What the FTC Found
In January 2021, the Federal Trade Commission announced an enforcement action against Flo Health, Inc. The FTC found that between 2016 and 2019, Flo shared users' reproductive health information (period dates, pregnancy status, and health symptoms) with Facebook and Google via embedded third-party SDKs.
The SDKs, integrated to provide analytics and performance data, automatically transmitted health events to Facebook's analytics platform and Google's Firebase Analytics. Users had no way to prevent this transmission, and Flo's privacy policy at the time stated that user data would not be shared with third parties except as required to operate the service.
The FTC concluded this constituted an unfair and deceptive practice under Section 5 of the FTC Act. The consent order required Flo to notify affected users and direct Facebook, Google, and Flurry to delete the improperly shared data. Read the FTC case at ftc.gov/cases-proceedings/192-3133-flo-health-inc.
How the SDK Data Sharing Worked
Beginning in June 2016, Flo embedded SDKs from Facebook, Flurry, Google (Fabric and Analytics), and AppsFlyer. These SDKs transmitted "Custom App Events" with descriptive titles that left nothing to the imagination:
R_PREGNANCY_WEEK_CHOSENP_ACCEPT_PUSHES_PERIOD
Each event was paired with a unique advertising identifier linkable to the individual device. The data transmitted included pregnancy status, menstrual period dates, intention to become pregnant, and reproductive health symptoms.
Facebook, Google, AppsFlyer, and Flurry were not contractually restricted from using the data for their own purposes. Facebook used Flo's event data for internal R&D.
| SDK Provider | Data Received | Use Restrictions |
|---|---|---|
| Pregnancy status, period dates, symptoms | None, used for internal R&D | |
| Google (Fabric/Analytics) | Health events with advertising IDs | Not contractually restricted |
| Flurry (Yahoo) | Custom health events | Not contractually restricted |
| AppsFlyer | Device IDs + health event data | Not contractually restricted |
The scheme was exposed by a Wall Street Journal investigation published February 22, 2019. Flo cut off Facebook data sharing the next day. Flo received over 300 user complaints after the story broke.
The Class Action
The same conduct prompted a class action lawsuit. In September 2025, Reuters reported that a combined $59.5M settlement resolved claims against Google, Flo Health, and Flurry. A jury on August 1, 2025 separately found Meta liable in the Frasco v. Flo Health case related to Facebook SDK data access.
The settlement covers affected US users. Eligibility and payment amounts were defined in the settlement terms. Per-person payouts in class actions of this scale are typically modest, but the enforcement action set a precedent for how regulators treat health data sharing by consumer apps.
Timeline of the Flo data sharing case:
2016-2019: Flo shares user health data with Facebook, Google, and Flurry via embedded SDKs.
January 2021: FTC announces enforcement action against Flo Health.
June 2021: FTC finalizes consent order.
March 2025: Flurry (Yahoo) settles for $3.5M.
July 2025: Google and Flo Health settle for $56M during trial.
August 2025: Jury finds Meta liable in the Frasco v. Flo Health case.
September 2025: Reuters reports combined $59.5M settlement.
What Flo Changed After the FTC Action
After the FTC action, Flo introduced Anonymous Mode, which claims to remove identifying information from cycle data. It requires a paid premium subscription. Basic privacy costs extra.
The underlying architecture did not change. Flo still stores cycle data on its servers. The consent order addresses what Flo does with that data, not whether the data reaches a server at all. Any data stored on a company's server can be accessed via a court order or government subpoena.
The Architectural Alternative
Apps that store data only on your device, never transmitting it to company servers, have less company-held data to hand over. The difference is architectural, not just a matter of policy. Law enforcement can only receive data a company possesses.
Floriva stores all cycle data on your device using encrypted local storage. No Floriva servers hold your reproductive health data. Core tracking is local-first. Optional sync is encrypted and not readable by Floriva to opt into.
Definitions
- FTC Section 5
- The section of the Federal Trade Commission Act that prohibits unfair or deceptive acts or practices in commerce. The FTC used Section 5 to take enforcement action against Flo in 2021 after finding the company shared user health data with third parties contrary to its privacy promises.
- Third-party SDK
- A software development kit embedded by app developers to add analytics, advertising, or crash reporting features. SDKs operate as code within an app and can transmit user data to the SDK provider's servers. The FTC found that Flo's integration of Facebook and Google SDKs allowed those companies to receive sensitive health data.
- Data broker
- A company that aggregates personal data from multiple sources and resells it, typically to advertisers or insurers. Period tracker data reaching advertising networks often passes through data brokers who link health signals to user profiles.
Cited signals
What the experts say
The FTC's case against Flo Health should send a message to companies that handle sensitive health data.
Quick answers to the obvious questions.
Did Flo sell my period data?
The FTC found that Flo shared users' reproductive health data, including period dates, pregnancy status, and health symptoms, with Facebook and Google via embedded SDKs, without users' knowledge or meaningful consent. Whether this constitutes a 'sale' in the strict legal sense depends on the definition, but the practical effect was that advertising companies received intimate health data. A $59.5M class action resolved in September 2025 (Reuters) covered affected users.
What data did Flo share with Facebook and Google?
According to the FTC's complaint, Flo transmitted health events, such as when a user indicated they were pregnant, trying to conceive, or experiencing specific symptoms, to Facebook's analytics platform and Google's Firebase Analytics. The data was shared through standard SDK integrations, meaning the transfer was automatic and users had no way to prevent it without deleting the app.
What specific data did Flo share with Facebook?
The FTC found Flo transmitted Custom App Events to Facebook's SDK with descriptive titles like R_PREGNANCY_WEEK_CHOSEN and P_ACCEPT_PUSHES_PERIOD, paired with unique advertising identifiers. Data included pregnancy status, menstrual period dates, intention to become pregnant, and reproductive health symptoms. Facebook was not contractually restricted from using this data and used it for internal R&D. Source: FTC complaint, File No. 192 3133.
Does Flo still share user data?
Following the FTC enforcement action, Flo launched Anonymous Mode, which claims to decouple cycle data from user identity. However, Anonymous Mode requires a paid subscription, meaning basic privacy is paywalled. The underlying architecture remains cloud-based: Flo still stores your data on its servers, which are accessible to law enforcement via subpoena regardless of whether Anonymous Mode is enabled.
How much was the Flo data sharing settlement?
The combined class action settlement totaled $59.5M. Google and Flo Health settled for $56M (Reuters, September 2025), and Flurry (Yahoo) settled separately for $3.5M (HIPAA Journal, September 2025). The money came from the civil class action, not the FTC enforcement action itself. The FTC's 2021 action resulted in a consent order, not a financial penalty.
Is Flo safe to use after the settlement?
The settlement resolved the class action claims from the original FTC-investigated conduct. It did not change Flo's data architecture. Your data is still stored on Flo's servers. The FTC consent order requires Flo to notify users about prior data sharing and implement a privacy program, but these are policy controls, not architectural ones. A server that exists can be subpoenaed.
Questions people ask before they switch.
What is the FTC enforcement action against Flo?
In January 2021, the FTC announced an enforcement action against Flo Health, Inc. The FTC found that Flo had shared users' sensitive health information, including period and pregnancy data, with Facebook and Google contrary to Flo's stated privacy policy. The consent order required Flo to notify affected users and instruct those companies to delete the data.
How much was the Flo settlement?
A combined $59.5M class action settlement was reached in September 2025 covering claims against Google, Flo Health, and Flurry (Yahoo) related to the same data sharing conduct identified by the FTC. Individual settlement amounts in class actions are typically modest. The FTC enforcement action itself resulted in a consent order, not a financial penalty, the money came from the civil class action.
How do I delete my data from Flo?
To delete your data from Flo: open the app, go to Profile > Settings > Privacy > Delete Account. Deleting your account initiates a data deletion request for Flo's servers. Note that data already shared with third-party SDKs before the FTC action may have been retained by those parties, Flo's consent order required it to ask Facebook, Google, and Flurry to delete the data.