Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 1 of 65
`
`James M. Wagstaffe (95535)
`Frank Busch (258288)
`WAGSTAFFE, VON LOEWENFELDT,
`BUSCH & RADWICK LLP
`100 Pine Street, Suite 725
`San Francisco, CA 94111
`Tel: (415) 357-8900
`Fax: (415) 357-8910
`wagstaffe@wvbrlaw.com
`busch@wvbrlaw.com
`
`
`Carol C. Villegas (pro hac vice forthcoming)
`Michael P. Canty (pro hac vice forthcoming)
`LABATON SUCHAROW LLP
`140 Broadway
`New York, NY 10005
`Tel: (212) 907-0700
`Fax: (212) 818-0477
`cvillegas@labaton.com
`mcanty@labaton.com
`
`Attorneys for Plaintiff and the Proposed Class
`
`
`
` Christian Levis (pro hac vice forthcoming)
`Amanda Fiorilla (pro hac vice forthcoming)
`LOWEY DANNENBERG, P.C.
`44 South Broadway, Suite 1100
`White Plains, NY 10601
`Tel: (914) 997-0500
`Fax: (914) 997-0035
`clevis@lowey.com
`afiorilla@lowey.com
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`
`
`
`Case No.: ______________
`MADELINE KISS, individually and on behalf
`
`
`of all others similarly situated,
`
`
`
` CLASS ACTION COMPLAINT
`
`
`
`JURY TRIAL DEMANDED
`v.
`
`
`FLO HEALTH, INC., GOOGLE, LLC,
`FACEBOOK, INC., APPSFLYER, INC., and
`FLURRY, INC.,
`
`
`
`
`
`
`
`Plaintiff,
`
`
`
`
`
`Defendants.
`
`
`
`
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 2 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Plaintiff Madeline Kiss (“Plaintiff”), on behalf herself and all others similarly situated,
`asserts the following against Defendants Flo Health, Inc. (“Flo Health”), Google, LLC (“Google”),
`Facebook, Inc. (“Facebook”), AppsFlyer, Inc. (“AppsFlyer”), and Flurry, Inc. (“Flurry”)1 based
`upon personal knowledge, where applicable, information and belief, and the investigation of
`counsel, which included, among other things, consultation with experts in the field of data privacy.
`SUMMARY OF ALLEGATIONS
`Defendant Flo Health owns and developed the Flo Period & Ovulation Tracker (“Flo
`1.
`App” or “App”), one of the most popular health and fitness mobile applications.
`The Flo App purports to use artificial intelligence to provide advice and assistance
`2.
`related to women’s health, such as by serving as an ovulation calendar, period tracker, pregnancy
`guide, and wellness and lifestyle tracker.
`Flo Health touts that its app is the “#1 mobile product for women’s health.” The Flo
`3.
`App has been installed more than 180 million times and has more than 38 million monthly active
`users. The App has also been rated the #1 period tracker in the United States based on active
`audience and as the #1 most downloaded health app in the Apple App Store.2
`The Flo App presents itself as a leader in women’s health care with at least “60
`4.
`doctors and experts from Europe and North America” on its Medical Board.3
`In order to use the Flo App, millions of users—including Plaintiff—provide Flo
`5.
`Health with personally identifying information (e.g., their names, email addresses, dates of birth,
`and places of residence), along with intimate details about their sexual health, menstruation cycles,
`gynecological health, and physical well-being through a series of “survey questions.” These
`questions cover extremely personal topics and include, for example: (1) “do you experience any
`
`
`1 Defendants Flo Health, Google, Facebook, Appsflyer, and Flurry are hereafter referred to
`collectively, at times, as “Defendants.” Defendants Google, Facebook, Appsflyer, and Flurry are
`hereafter referred to, at times, as “Advertiser Defendants.”
`2 The Flo App was also featured as the “App of the Day” in the Apple App Store in over 30
`countries.
`3 Our Medical Expertise, FLO HEALTH, INC., https://flo.health/medical-expertise.
`2
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 3 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`pain during sex?” (2) “how often do you have sex?” (3) “how often do you masturbate?” (4) “have
`you noticed a decrease in sexual desire?” (5) “are you sexually active during your period?” and
`(6) “what type of relationship do you have at present?”
`Users also provided intimate, personal health details in response to probing survey
`6.
`questions about health and wellness, such as: (1) “do you smoke” (2) “how often do you experience
`stress? (3) “do you want to change your weight?” (4) “do you follow a particular diet?” (5) “how
`often do you exercise?” (6) “do you get yeast infections?” (6) “do you have any chronic diseases?”
`and (7) “do you have any reproductive system diseases?”
`Within the first few minutes of using the Flo App, users answer over thirty survey
`7.
`questions like these. As users continue to use the app, they are encouraged by Flo Health to provide
`more and more intimate health data, including daily information about whether they have their
`period, their weight, how long they slept, whether they had sex (as well as their sex drive, if sex was
`unprotected, or if they masturbated), their mood (ranging from “calm” to “very self-critical”) and if
`they have any health symptoms (such as headaches, breast tenderness, acne, or fatigue).
`With access to this highly sensitive information, Flo Health claims to predict
`8.
`ovulation, aid in pregnancy and childbirth, and provide lifestyle and wellness suggestions, allowing
`users to “take full control of [their] health.”
`Plaintiff and Class members provided this information to Flo Health based on the
`9.
`company’s repeated assurances that their intimate health data would remain protected and
`confidential and would not be disclosed to third parties.
`This is because the surreptitious sharing of this intimate data (and improper
`10.
`collection of this data) has significant real-world consequences. Indeed, in today’s world, data is an
`extremely valuable commodity. The companies that deal in this data—such as Defendants Google
`and Facebook—are some of the largest and most valuable companies on earth. When these
`companies gain access to the intimate data users shared here, they are able to capitalize on an
`especially sensitive class of information, targeting women with ads in ways that are acutely invasive.
`Flo Health’s privacy policies and public assurances have claimed—time and time
`11.
`
`3
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 4 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`again—that Flo Health would not share users’ intimate health data with anyone. Flo Health’s
`website touts that “[p]rivacy in the digital age is of utmost importance. Flo provides a secure
`platform for millions of women globally.”4
`Similarly, Flo Health’s privacy policy states, in all capital letters, that it “WILL NOT
`12.
`TRANSMIT ANY OF YOUR PERSONAL DATA TO THIRD PARTIES, EXCEPT IF IT IS
`REQUIRED TO PROVIDE THE SERVICE TO YOU (E.G. TECHNICAL SERVICE
`PROVIDERS), UNLESS WE HAVE ASKED FOR YOUR EXPLICIT CONSENT.” Flo Health
`assured users that these third parties, including the Advertiser Defendants, would not receive
`“survey results,” i.e., the answers to Flo Health’s probing health questions, “information regarding
`your marked cycles, pregnancy, symptoms, notes,” or information about “which articles [users]
`view,” i.e., users’ intimate health data. Flo Health further assured users that third parties, including
`Advertiser Defendants, with whom it shared data “w[ould] never use such information for any other
`purpose except to provide services in connection with the App.”5
`Contrary to these assurances, Flo Health knowingly collected, transmitted, and
`13.
`disclosed Plaintiff’s and Class’ members intimate health data to third parties, including Advertiser
`Defendants.
`Flo Health disclosed its users’ highly sensitive health information to the Advertiser
`14.
`Defendants and other third parties through “software development kits” (“SDKs”) that it
`incorporated into the Flo App. SDKs are a collection of tools and programs that allow app
`developers, like Flo Health, to add functionality or features to their app that are developed by third
`parties.
`For instance, Facebook’s SDK can be incorporated into an app to share user data
`15.
`between an app and Facebook. By using the Facebook SDK, developers can gain access to
`Facebook’s data analytics and use Facebook tools to assist with mobile ads, among other things.
`
`
`4 About Us, FLO HEALTH, INC., https://flo.health/our-mission (last visited Jan. 27, 2021).
`5 Privacy Policy, FLO HEALTH, INC., https://flo.health/privacy-policy-archived/may-25-2018
`(effective May 25, 2018).
`
`4
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 5 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`Flo Health incorporated Facebook’s SDK so that it could use Facebook’s analytics
`16.
`tools to identify which of its users would be prime targets for advertisements keyed off the data they
`entered into the App. Flo Health incorporated similar SDKs from all Advertising Defendants, who
`are all marketing and analytics firms or advertisers.
`In exchange for using Advertiser Defendants’ SDKs, Flo Health transmitted intimate
`17.
`health data entered into the Flo App to Advertiser Defendants—in direct contravention of Flo
`Health’s assurances to users that this information would not be disclosed—including when a user
`indicated that they were on their period or intended to get pregnant.
`Advertiser Defendants, including two of the largest digital advertisers in the world,
`18.
`incorporated this information into their existing data analytics and research segments to compile
`profiles and target users for advertisements.
`The Advertiser Defendants’ access and use of this information can have profound
`19.
`consequences that users of the Flo App would never anticipate. For instance, armed with knowledge
`that a Flo App user is pregnant or attempting to get pregnant, the Advertiser Defendant can
`specifically target that user with ads for prenatal vitamins, breast pumps, or fertility treatments,
`among other things. In some instances, Flo Health may know a user is pregnant—based on the user’s
`data—before the user herself. Because this information was shared with the Advertiser Defendants,
`users could be targeted for ads that the users may find overwhelming or disturbing, depending on
`whether they did or did not intend to get pregnant. As another example, if a user indicated that she
`experienced oily skin during her menstruation cycle, Advertiser Defendants could use this
`information to target that user (i.e., Plaintiff and Class members) with advertisements for certain
`skin care products around this time period. The intimate health data entered into the Flo Health App
`is some of the most private information about a user and was provided under the guise that this
`information would stay private—not to develop profiles about users or target them for
`advertisements.
`Advertiser Defendants knew that the data collected and received from Flo Health
`20.
`included intimate health data—but they did nothing to stop Flo Health from sharing this information
`
`5
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 6 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`because it is vital to their business. By continuing to contract with Flo Health to receive this data—
`and using this data for their own purposes—Advertiser Defendants (as well as Flo Health)
`intentionally intruded upon Plaintiff’s and Class members’ privacy.
`The truth about Flo Health’s and the Advertiser Defendants’ conduct was discussed
`21.
`in a report published by the Wall Street Journal in February 2019, revealing that despite Flo Health’s
`promises that it would not share intimate health data, Flo Health had spent years disclosing the
`intimate health data that users entered into the Flo App to dozens of third parties, including the
`Advertiser Defendants who were free to use this data for their own purposes, without limitation.
`In response to the revelation that Flo Health was sharing users’ intimate health data
`22.
`with the Advertiser Defendants, the Federal Trade Commission (“FTC”) launched its own
`investigation into Flo Health’s data privacy and disclosure practices and ultimately filed a
`complaint, charging Flo Health with making a variety of fraudulent misrepresentations to Flo App
`users in violation of their privacy rights.
`Likewise, the New York State Department of Financial Services (“NYSDFS”), at the
`23.
`direction of New York Governor Andrew M. Cuomo, opened an investigation into Facebook
`concerning its collection of sensitive data for its own advertising and marketing purposes—
`including intimate health data from Flo Health users. Governor Cuomo characterized the practice
`as an “outrageous abuse of privacy.”6
`24. Members of Congress expressed outrage as well, with Senator Ed Markey of
`Massachusetts calling the behavior a “new low in privacy malpractice.”
`On January 13, 2021, Flo Health entered into a settlement with the FTC that
`25.
`prohibited Flo Health from further misrepresenting the purposes for which or entities to whom it
`discloses users’ intimate health data, as well as obtain an independent review of its privacy policy,
`obtain user consent before sharing their data, and notify third parties that previously received users’
`
`
`6 Report on Investigation of Facebook Inc. Data Privacy Concerns, N.Y. STATE DEP’T OF FIN.
`SERVS. (Feb. 18, 2021),
`https://www.dfs.ny.gov/system/files/documents/2021/02/facebook_report_20210218.pdf.
`6
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 7 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`intimate health data to destroy that information.7
`NYSDFS released a report on February 18, 2021, detailing the significant privacy
`26.
`concerns associated with Facebook’s data collection practices, including the collection of intimate
`health data from Flo Health users. The report noted that while Facebook maintained a policy that
`instructed developers not to transmit sensitive health data, Facebook received, stored, and analyzed
`this data anyway, including intimate health data from Flo App users. Facebook was unwilling to
`review the data it previously collected and analyzed and so the NYSDFS called on federal regulators
`to compel Facebook to undergo such a process.
`If Plaintiff and Class members had known that Flo Health would share their intimate
`27.
`health data with Advertiser Defendants, they would not have used the Flo App.
`Defendants’ actions constitute an extreme invasion of Plaintiff’s and Class members’
`28.
`right to privacy and violate federal and state statutory and common law.
`JURISDICTION AND VENUE
`This Court has jurisdiction over the subject matter of this action pursuant to 28 U.S.C
`29.
`§ 1332(d), because the amount in controversy for the Class exceeds $5,000,000 exclusive of interest
`and costs, there are more than 100 putative class members defined below, and minimal diversity
`exists because a significant portion of putative class members are citizens of a state different from
`the citizenship of at least one Defendant.
`This Court also has jurisdiction over the subject matter of this action pursuant to 28
`30.
`U.S.C. § 1331 since this suit is brought under the laws of the United States, i.e., the Stored
`Communications Act, 18 U.S.C. §§ 2701, et seq., and supplemental jurisdiction pursuant to 28
`U.S.C. § 1367 over the remaining state common law and statutory claims as these state law claims
`are part of the same case or controversy as the federal statutory claim over which the Court has
`original jurisdiction.
`
`
`7 Developer of Popular Women’s Fertility-Tracking App Settles FTC Allegations that It Mislead
`Consumers About the Disclosure of their Health Data, FTC (Jan. 13, 2021),
`https://www.ftc.gov/news-events/press-releases/2021/01/developer-popular-womens-fertility-
`tracking-app-settles-ftc.
`
`7
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 8 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`This Court has specific personal jurisdiction over Flo Health because it consented to
`31.
`jurisdiction in this District in its Terms of Use, which states:
`
`Any dispute arising from this Agreement shall be governed by the laws of the State
`of California without regard to its conflict of law provisions. SOLE AND
`EXCLUSIVE JURISDICTION FOR ANY ACTION OR PROCEEDING
`ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL BE IN
`AN APPROPRIATE STATE OR FEDERAL COURT LOCATED IN SAN
`FRANCISCO COUNTY, STATE OF CALIFORNIA . . . .8
`This Court has general personal jurisdiction over Advertiser Defendants because they
`32.
`each maintain their principal place of business in California. Additionally, Advertiser Defendants
`are subject to specific personal jurisdiction in this State because a substantial part of the events and
`conduct giving rise to Plaintiff’s claims occurred in this State.
`Venue is proper in this District pursuant to 28 U.S.C. §1391(b), (c), and (d) because
`33.
`Flo Health transacts business in this District and a substantial portion of the events giving rise to the
`claims occurred in this District.
`Intra-district Assignment: A substantial part of the events and omissions giving rise
`34.
`to the violations of law alleged herein occurred in the County of San Francisco, and as such, this
`action may properly be assigned to the San Francisco or Oakland divisions of this Court pursuant to
`Civil Local Rule 3-2(c).
`
`PARTIES
`
`Plaintiff
`A.
`Plaintiff Madeline Kiss (“Plaintiff”) is a natural person and citizen of New York and
`35.
`a resident of Kings County. From approximately February 2017 until June 2018, Plaintiff was a
`citizen of California and a resident of Orange County.
`Plaintiff downloaded the Flo App from the Apple app store in or around spring of
`36.
`2017 and was an active user until January 2021. Plaintiff used the app while residing in California
`and also while residing in New York.
`
`
`8 Terms of Use, FLO HEALTH, INC., https://flo.health/terms-of-service (effective Feb. 5, 2020).
`8
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 9 of 65
`
`
`
`Plaintiff provided Flo Health with her intimate health data, including information
`37.
`and/or symptoms about her health and wellness, menstruation cycle, sexual activity, and pregnancy.
`Plaintiff believed that her intimate health data would stay private and that Flo Health
`38.
`would not disclose this information to third parties, including the Advertiser Defendants. Plaintiff
`did not consent or provide permission for Flo Health to share or disclose this information.
`In direct contravention to its privacy policy and public assurances, Flo Health
`39.
`disclosed Plaintiff’s intimate health data without her knowledge or consent to third parties, including
`the Advertiser Defendants.
`By the nature of Flo Health’s concealment, Plaintiff was not provided notice and did
`40.
`not have the opportunity to provide consent to Flo Health’s disclosure of her data to the Advertiser
`Defendants and the use of her intimate health data by Flo Health and the Advertiser Defendants for
`their own benefit. Namely, Advertiser Defendants used users’ intimate health data, including
`Plaintiff’s, to generate revenue by selling targeted advertising to customers based on profiles on Flo
`Health users that were developed based their sensitive health data.
`Plaintiff would not have used the Flo App if she had known that Flo Health would
`41.
`share her intimate health data with third parties, including the Advertiser Defendants.
`B.
`Defendants
`Defendant Flo Health, Inc. is a Delaware corporation with principal executive
`42.
`offices located at 1013 Centre Road, Suite 403-B, Wilmington, Delaware 19805.
`In direct contravention of Flo Health’s assurances, Flo Health knowingly collected
`43.
`and shared Plaintiff’s and Class members’ intimate health data with Advertiser Defendants.
`Defendant Google, LLC is a Delaware limited liability company with principal
`44.
`executive offices located at 1600 Amphitheatre Parkway Mountain View, California 94043. Google
`is an advertising company that “make[s] money” from “advertising products [that] deliver relevant
`ads at just the right time,” generating “revenues primarily by delivering both performance
`
`9
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 10 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`advertising and brand advertising.”9 Indeed in 2020, Google generated $146.9 billion in advertising
`revenue, which amounted to more than 80 percent of Google’s total revenues for the year. Google
`generated an even higher percentage of its total revenues from advertising in prior years:
`
`
`Year
`2020
`2019
`2018
`2017
`
`Total Revenue
`$182.5 billion
`$161.9 billion
`$136.8 billion
`$110.9 billion
`
`Ad Revenue
`$146.9 billion
`$134.8 billion
`$116.5 billion
`$95.6 billion
`
`% Ad Revenue
`80.49%
`83.29%
`85.12%
`86.21%
`
`
`
`In 2017, Google acquired Fabric, a company that provides SDKs to developers that
`45.
`they can incorporate into their apps. Flo Health incorporated the Fabric SDK into the Flo App.
`Flo Health knew that the data it provided to Google through the Fabric SDK would
`46.
`be used for Google’s own purposes. The Fabric Software and Services Agreement, which Flo Health
`agreed to, stated: “[Flo Health] acknowledges and agrees that Google [Fabric] may use Usage Data
`for its own business purposes,” where “Usage Data” was defined to mean “all information, data and
`other content, not including any [identifying data], received by Google related to [Flo Health]’s use
`of the Fabric Technology.”
`Google offers a separate SDK through Google Analytics. Flo Health incorporated
`47.
`Google’s SDK into the Flo App.
`Flo Health knew that the data it provided to Google through the Google Analytics
`48.
`SDK would be used for Google’s own purposes. The Terms of Service of Google Analytics, which
`Flo Health agreed to, stated: “Google and its wholly owned subsidiaries may retain and use ...
`information collected in [Flo Health’s] use of the Service.”
`Google Analytics’ Terms of Services prohibited companies like Flo Health from
`49.
`“pass[ing] information to Google that Google could use or recognize as personally identifiable
`information.” Google’s Privacy Policy also informs users that it does not use the information it
`collects to “show you personalized ads based on sensitive categories, such as race, religion, sexual
`
`
`9 Alphabet Inc. Form 10-K for fiscal year ended December 31, 2020.
`10
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 11 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`orientation, or health.”10
`As one of the largest advertisers and data analytics companies in the country, Google
`50.
`knew that the data it received from Flo Health through Fabric and Google Analytics contained
`intimate health data. Despite knowing this, Google continued to receive, analyze, and use this
`information for its own purposes, including marketing and data analytics.
`Defendant Facebook, Inc. is a Delaware corporation with principal executive offices
`51.
`located at 1601 Willow Road, Menlo Park, California 94025. Facebook is a social media platform
`that—as the chart below illustrates—“generate[s] substantially all of [its] revenue from selling
`advertising placements to marketers.”11
`
`
`Year
`2020
`2019
`2018
`2017
`
`Total Revenue
`$85.97 billion
`$70.70 billion
`$55.84 billion
`$40.65 billion
`
`Ad Revenue
`$84.17 billion
`$69.66 billion
`$55.01 billion
`$39.94 billion
`
`% Ad Revenue
`97.90%
`98.52%
`98.51%
`98.25%
`
`
`
`Facebook offers an SDK to developers, like Flo Health, that allows developers to see
`52.
`certain statistics about a users’ activity in the app and target users for ads on Facebook. Flo Health
`incorporated the Facebook SDK into the Flo App.
`Facebook has described how its SDKs work as follows: “Developers can receive
`53.
`analytics that allow them to understand what the audience of their app enjoys and improve their apps
`over time. Developers may also use Facebook services to monetise their apps through Facebook
`Audience Network. Subject to that Facebook user's prior consent, Facebook may also use this data
`to provide that user with more personalised ads.”12
`Flo Health knew that the data it provided to Facebook through the Facebook SDK
`54.
`
`10 Privacy Policy, GOOGLE, LLC, https://policies.google.com/privacy#footnote-sensitive-categories
`(last visited June 7, 2021).
`11 Facebook, Inc. Form 10-K for fiscal year ended December 31, 2020.
`12 No Body’s Business But Mine: How Menstruation Apps Are Sharing Your Data, Privacy
`International (Sept. 9, 2019).
`
`11
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 12 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`would be used for Facebook’s own purposes. Facebook’s Business Tools Terms, which Flo Health
`agreed to, stated: “We use [aggregated data] to personalize the features and content (including ads
`and recommendations) we show people on and off our Facebook Company Products . . . We may
`also use [data] . . . for research and development purposes, and to . . . improve the Facebook
`Company Products.” Even though Facebook claims to use the data in aggregated form, according
`to the Wall Street Journal, Facebook can match that data with actual Facebook users.
`55. While Facebook had a policy requesting that Developers not share health-related info
`with the company, Facebook received, stored, and analyzed Flo Health users’ intimate health data
`anyway.
`As one of the largest advertisers in the nation, Facebook knew that the data it received
`56.
`from Flo Health through the Facebook SDK contained intimate health data. Despite knowing this,
`Facebook continued to receive, analyze, and use this information for its own purposes, including
`marketing and data analytics.
`Defendant AppsFlyer, Inc. is a Delaware corporation with principal executive
`57.
`offices located at 100 First Plaza, 100 1st Street, San Francisco, California 94105. AppsFlyer’s core
`services include attribution, marketing analytics, and cost aggregation. According to the company’s
`website, AppsFlyer has over 1,100 employees, more than $28 billion in annual ad spend, 89,000
`active mobile apps, and more than 8,000 tech partner integrations, with customers including
`Facebook and Google.13
`AppsFlyer offers an SDK to developers, which Flo Health incorporated into the Flo
`58.
`
`App.
`
`Flo Health knew that the data it provided to AppsFlyer through the AppsFlyer SDK
`59.
`would be used for AppsFlyer’s own purposes. AppsFlyer’s Terms of Use, which Flo Health agreed
`to, stated: “You hereby allow AppsFlyer to collect, store, use and process Customer Data,” where
`“Customer Data” was defined to include “data concerning the characteristics and activities” of app
`
`
`13 The AppsFlyer Story, APPSFLYER, INC., https://www.appsflyer.com/we-are-appsflyer/ (last
`visited June 7, 2021).
`
`12
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 13 of 65
`
`
`
`users.
`
`60. While AppsFlyer had a policy requesting that developers not share sensitive
`information, like health information, AppsFlyer continued to receive Flo Health users’ intimate
`health data anyway.
`AppsFlyer, as one of the most prominent data attribution and marketing companies,
`61.
`knew that the data it received from Flo Health through the AppsFlyer SDK contained intimate health
`data. Despite knowing this, AppsFlyer continued to receive, analyze, and use this information for
`its own purposes, including marketing and data analytics.
`Defendant Flurry, Inc. is a Delaware corporation with principal executive offices
`62.
`located at 110 5th Street, Suite 200, San Francisco, California 94103. Flurry helps app developers
`acquire, retain, and monetize audiences. Flurry touts that since 2008, “mobile app developers
`worldwide have relied on Flurry Analytics to unlock audience data, usage behavior, and
`monetization opportunities,” reaching over 2 billion devices every month.14
`Flurry offers an SDK to developers, which Flo Health incorporated into the Flo App.
`63.
`64.
`Flo Health knew that the data it provided to Flurry through the Flurry SDK would be
`used for Flurry’s own purposes. Flurry’s Terms of Service, which Flo Health agreed to, states that:
`“As a condition of your access to the Services, you agree that Flurry has the right, for any purpose,
`to collect, retain, use, and publish in an aggregate manner . . . information collected in Your use of
`the Services, including without limitation . . . characteristics and activities of end users of your
`applications.”
`As one of the most prominent mobile app data analytics firms, Flurry knew that the
`65.
`data it received from Flo Health through Flurry contained intimate health data. Despite knowing
`this, Flurry continued to receive, analyze, and use this information for its own purposes, including
`marketing and analytics.
`
`
`
`14 About Flurry, FLURRY, INC., https://www.flurry.com/about/ (last visited June 7, 2021).
`13
`CLASS ACTION COMPLAINT AND DEMAND FOR JURY TRIAL
`CASE NO. ____________
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`

`

`Case 3:21-cv-04333 Document 1 Filed 06/07/21 Page 14 of 65
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`I.
`
`FACTUAL BACKGROUND
`Founding of Flo Health, Inc.
`Flo Health began as a startup in 2015 owned by a group of mobile app developers
`66.
`based in Minsk, Belarus. That same year, the company released the Flo App, the first mobile
`application to make use of artificial intelligence to accurately predict reproductive cycles.
`67. When first launched, the Flo App operated essentially as a calendar that allowed
`users to track their period and ovulation. Over time, the App’s developers expanded the Flo App’s
`functionality to assist with all phases of the reproductive cycle, including the start of menstruation,
`cycle tracking, preparation for conception, pregnancy, early motherhood, and menopause. The Flo
`App also expanded to provide users with overall health and wellness suggestions.
`As Flo App’s features expanded, the App requested a wider and wider range of
`68.
`personal information from its users, including intimate personal details like a user’s history of
`contraceptive methods, vaginal discharge, diseases, water intake, weight, pains and other physical
`or mental symptoms, mood swings, and sexual activity (including the users’ sexual desire levels,
`whether they experience pain during sex, or did not use protection). Users can also write “personal
`notes” to log additional information in the App. As is often the case with apps that monetize user
`data, the Flo App was designed in such a way that encouraged users to share more and more intimate
`personal details about themselves. Flo Health also relied on push notifications to further encourage
`users to eng