Frasco v. Flo Health, Inc.

Background

The plaintiffs filed a consolidated complaint against Flo Health, Inc., Facebook, Inc., Google LLC, Flurry, Inc., and AppsFlyer, Inc. They alleged that Flo disclosed sensitive health information through software development kits, or SDKs, when certain events occurred in the Flo app. The complaint alleged that Facebook, Google, and Flurry used the information for research, development, marketing, and advertising. It did not specifically allege that AppsFlyer used the information for advertising or marketing.

Standing

The court held that the named plaintiffs had standing under Article III of the Constitution. The complaint plausibly alleged that private information was disclosed and that the plaintiffs experienced an intrusion upon seclusion. The court relied on allegations that Flo knowingly disclosed sensitive health information, that the SDKs transmitted information when certain app events occurred, and that the non-Flo defendants used the information for various purposes.

The court reached a different conclusion for AppsFlyer. The complaint said only that AppsFlyer used data obtained through its SDK for “AppsFlyer’s own purposes,” without describing those purposes. The court held that the plaintiffs had not adequately alleged a concrete and particularized injury caused by AppsFlyer. The claims against AppsFlyer were dismissed in toto, with leave to amend.

Statute of Limitations

Flo and the non-Flo defendants argued that the claims were time-barred because the plaintiffs knew or should have known about them after a Wall Street Journal article published in February 2019. The lawsuit was filed more than two years later.

The court rejected that argument at the motion-to-dismiss stage. Under California’s discovery rule, the time for bringing a claim is generally postponed until the plaintiff discovers, or has reason to discover, the cause of action. The court said that media coverage alone does not necessarily create the required suspicion. The plaintiffs alleged that Flo did not notify users about privacy concerns until July 2021, after reaching a settlement with the Federal Trade Commission, and that they became aware of their claims at that time. The court found nothing on the face of the complaint showing that the plaintiffs knowingly waited too long. It noted that defendants could raise the statute-of-limitations defense later if discovery produced supporting facts.

Dismissed Claims

The court granted Flo’s motion to dismiss the Stored Communications Act claim. The complaint did not plausibly allege that Flo was an electronic communications service, meaning a service that gives users the ability to send or receive electronic communications. The Stored Communications Act claim was dismissed with leave to amend.

The court granted the non-Flo defendants’ motion to dismiss the unjust-enrichment claim. Under California law, unjust enrichment can apply when a plaintiff confers a benefit on a defendant, the defendant knowingly accepts it, and keeping the benefit without paying would be unfair. The court found that the complaint indicated Facebook, Google, and Flurry did not receive a benefit from the plaintiffs. It also found that the complaint did not plausibly allege a relationship between the plaintiffs and those defendants or that the plaintiffs conferred an unjust benefit on them. That claim was dismissed with leave to amend.

Other Rulings and Disposition

Flo’s motion to dismiss was denied for all claims other than the Stored Communications Act claim. The non-Flo defendants’ motion was denied for all claims other than the unjust-enrichment claim. AppsFlyer had joined the non-Flo defendants’ motion, but all claims against AppsFlyer were dismissed in toto, with leave to amend.

The court denied all defendants’ requests for judicial notice of purported facts outside the complaint. The plaintiffs could file an amended complaint addressing the dismissed claims by June 23, 2022. The court stated that no new claims or parties could be added without prior approval. If the plaintiffs did not meet the deadline, the dismissed claims would be dismissed with prejudice under Federal Rule of Civil Procedure 41(b). In all other respects, dismissal was denied.