Period tracking app Flo faces legal consequences after sharing user menstrual data with Meta. A class action lawsuit found the company liable for passing sensitive health information—including cycle details and pregnancy status—to third parties despite privacy promises. Flo's 13 million plaintiffs represent a significant portion of their 75 million users affected by this data breach.

The lawsuit revealed Flo embedded a "secret" data collection tool that transmitted intimate health metrics to Meta, Google, and Flurry. This wasn't a security breach but a deliberate design choice. Flo changed its privacy policy 13 times between 2016-2019 while continuing to share sensitive reproductive data, exposing a critical gap in privacy protections for non-clinical health tracking applications.

The case highlights how HIPAA regulations fail to cover most wellness apps, leaving user data vulnerable. Without proper legal frameworks, companies can design consent mechanisms that prioritize profit over privacy. This legal precedent establishes important boundaries for data sharing practices in the rapidly expanding femtech industry, where user trust is essential.