Frasco v. Flo Health, Inc.

Background

The named plaintiffs brought a proposed class action against Flo Health, Inc., Google LLC, and other defendants. They alleged that Flo used Google analytics services with the Flo Period & Ovulation Tracker app and that Google obtained and stored sensitive personal information from the app without their knowledge or consent. The complaint asserted federal and state privacy claims and California unfair-competition claims against Google. After fact discovery ended, Google moved for summary judgment, which asks the court to rule that no legally sufficient dispute of important fact requires a trial.

Standing and alleged privacy injury

Google argued that plaintiffs had no evidence that it received sensitive health information from Flo or used the information for research, development, marketing, or advertising. The court rejected that argument as too broad. It said that privacy rights can protect a person’s control over information about themselves and that plaintiffs did not need to prove that Google used or further disclosed the information to show a concrete injury.

The court identified genuine disputes of important fact about whether the information Google obtained through its software development kit contained private health information and whether the alleged injury was traceable to Google. The parties also disputed whether Google sought Flo’s business to obtain sensitive health data and whether it followed its own privacy policies. The court further found a factual dispute about whether the collected information was or could be connected to identifying information. Google’s assertion that the information was not tied to plaintiffs’ identifying information did not resolve those disputes.

Consent

Google relied on plaintiffs’ acceptance of Flo’s privacy policies as a consent defense. The court explained that consent is effective only if a person agreed to the particular conduct, or substantially similar conduct, and the defendant did not exceed the consent’s scope. Because the parties disputed what information Google obtained, how it used the data, and what a reasonable user would have understood from Flo’s different privacy policies over time, the court denied summary judgment on this basis.

California statutory claims

The complaint alleged claims under California’s Unfair Competition Law, including a claim that Google aided and abetted Flo’s alleged violation, and under the California Comprehensive Computer Data Access and Fraud Act. The court granted summary judgment for Google on the Unfair Competition Law and related aiding-and-abetting claims because plaintiffs had abandoned their defense of those claims.

The court denied summary judgment on the California computer-data claim. Google argued that a privacy invasion without lost income or another tangible injury did not qualify as the required “damage or loss.” The court said the statute’s language was not as definitive as Google asserted and found evidence from which a reasonable jury could conclude that the information Google obtained had financial value amounting to damage or loss.

Aiding and abetting intrusion upon seclusion

The court granted summary judgment for Google on the claim that it aided and abetted Flo’s intrusion upon plaintiffs’ seclusion. Under California law, this theory required evidence that Google knowingly and purposefully participated in Flo’s wrongful conduct. The court found no non-speculative evidence that Google had actual knowledge of Flo’s allegedly deceptive disclosure practices. Business meetings, advertising assistance, and evidence concerning possible data use did not establish the required knowledge.

Wiretap Act and California privacy claims

The court denied summary judgment on plaintiffs’ claims under the federal Wiretap Act and California’s Invasion of Privacy Act. Google argued that any interception was not deliberate, that it acted only as a vendor, and that Flo—not Google—performed any recording. The court found factual disputes concerning those issues. It also accepted, for purposes of the motion, Google’s position that the analysis under the California law tracked the federal Wiretap Act analysis. The disputes about transmission of data through Google’s software and any later use of that data therefore also prevented summary judgment on these claims.

Disposition

The court’s conclusion states: “Summary judgment is granted in favor of Google on plaintiffs’ UCL and aiding-and-abetting claims. It is denied in all other respects.” The order therefore resolved those specified claims for Google but did not resolve the remaining claims through summary judgment.