• by Wendy Davis  @wendyndavis, September 24, 2024

Siding against Google, a federal judge has rejected the company's request to dismiss claims that it violated wiretap laws by collecting sensitive health information from people who used the fertility app Flo Health.

In a ruling issued Monday, U.S. District Court Judge James Donato said the lawsuit presented the types of unresolved questions that require a trial.

“There are genuine disputes of material fact bearing on whether plaintiffs have suffered an injury in fact from Google having collected their private health information,” he wrote in an order denying the company's request for judgment in its favor.

The ruling comes in a battle dating to 2021, when several Flo Health users brought a class-action complaint against Flo Health, Google, Meta and other companies. The users alleged that the app shared users' sensitive data with Google, Meta and others via software development kits embedded in the app.

Their complaint included claims that Google violated federal and state wiretap laws.

The suit came soon after the FTC accused Flo wrongly sharing pseudonymized data about consumers -- including their pregnancies -- with Meta, Google and other analytics companies. While the data wasn't explicitly tied to users' names or addresses, it was connected to an “ad identifier,” according to the FTC.

Flo stopped sharing that data in early 2019, and settled with the FTC in 2021. The settlement agreement required Flo to notify customers about the prior data sharing, and obtain people's permission before sharing their health information in the future.

Last year, Google urged Donato to award it summary judgment -- meaning a decision in its favor, without a trial -- in the class-action suit.

The company argued that the Flo users weren't harmed by the data-sharing because Google only used the information “to provide Flo with analytics services,” and not for advertising or other purposes.

“Plaintiffs did not suffer any privacy injury because Google did not use Flo app data for advertising, ads modeling, machine learning, marketing, or any purpose other than that which was disclosed: to provide Flo with analytics,” the company wrote in its motion.

Google added that the data it received wasn't “tied to any individual person,” or to Google Accounts and ID Administration IDs, referred to in its motion as “GAIA IDs.”

Donato rejected Google's argument for now.

“It is not at all clear that the collection of information about a woman’s menstruation cycles and fertility goals without consent is permissible just because Google says it didn’t connect the information to a particular person,” Donato wrote.

He added that there is a factual dispute over whether the data “was or could be tied to identifying information.”

Google also contended that the plaintiffs consented to the data-sharing, arguing that Flo disclosed its use of Google's analytics to consumers.

But Donato said in his ruling that questions about consent couldn't be resolved without a trial.

“Consent is typically a fact-bound inquiry, and the record before the court demonstrates a number of factual disputes that preclude summary judgment on this score,” he wrote.