A recent California federal jury verdict against Meta Platforms Inc. has sent a clear message to businesses: tracking technologies can pose serious legal and reputational risks if not deployed responsibly. The case, which involved Meta’s unauthorized collection of sensitive health data via the period-tracking app, Flo, resulted in a finding that Meta violated the California Invasion of Privacy Act (CIPA).
The case was brought against Flo Health, Meta, and Google, but Flo and Google settled before trial. The jury found against Meta as it related to the CIPA, finding that Meta intentionally eavesdropped on and/or recorded conversation by using an electronic device. Moreover, the jury found that Flo users had a reasonable expectation that the conversation was not being overheard and/or recorded.
This is the first ad-tracking case we have tracked that has gone to trial. Importantly, this was in California, which is a consumer-friendly jurisdiction with strict data privacy laws.
In addition to the parties taking the matter to trial, the court certified a class action, on a nationwide class and a California subclass, for certain users who entered menstruation and/or pregnancy data into the Flo app.
The Broader Impact
The Meta verdict underscores a growing risk involving ad tech. Ad tech tools like Meta Pixel, widely used for analytics and advertising, can capture sensitive personal information if implementers do not understand how it works. In this case, the jury found that Meta intentionally recorded reproductive health data without proper user consent—a violation made more serious by the heightened scrutiny on sensitive personal health information collection.
The case has sparked public debate and may influence future privacy legislation at both the state and federal levels. Businesses must now treat tracking technologies not just as marketing tools, but as potential compliance liabilities.
Takeaways When Using Tracking Technologies
Consider the following proactive steps:
- Audit your tracking tools: Inventory all tracking technologies (e.g. pixels, cookies, SDKs) across your platforms. Identify what data is collected and whether it includes sensitive categories like health or financial information.
- Elevate consent mechanisms: Move beyond generic consent banners and consider opt-in consent flows for specific data types, especially sensitive ones.
- Revise privacy policies and disclosures: Ensure privacy notices are clear, conspicuous, and accessible. Avoid vague language and disclose data practices at the point of collection.
- Implement data minimization: Collect only the data necessary for your business purpose. Avoid over-collection, especially of sensitive data, unless explicitly required and consented to.
- Monitor legal and regulatory developments: Stay informed about evolving privacy laws at the state and federal levels. Consider appointing privacy counsel or a dedicated compliance lead.
- Prepare for reputational risk: Develop a response plan for privacy incidents. Transparency and swift action can help mitigate public fallout and rebuild trust.
- Engage with vendors and partners: Review contracts with third-party tracking providers. Ensure they meet your privacy standards and offer legal protections.
- Use privacy-enhancing technologies (PETs): Explore anonymization, privacy-by-design, and secure data environments to reduce risk while maintaining analytics capabilities.
- Document your compliance efforts: Keep records of consent, data flows, and privacy assessments. These can be critical in defending against legal claims or regulatory inquiries.
Bottom Line
The digital economy may run on data—but it cannot be at the cost of privacy rights. Organizations must act now to ensure their tracking technologies are transparent, compliant, and respectful of user privacy.
