# Meta Was Eavesdropping on 13 Million Women's Period Apps — A Jury Just Said That's Worth $190 Billion **URL:** \ **Category:** News & Articles\ **Tags:** hacking, privacy, tips-tricks, news, eye-opening\ **Created:** [May 18, 2026, 1:37pm UTC](https://onehack.st/t/meta-was-eavesdropping-on-13-million-womens-period-apps-a-jury-just-said-thats-worth-190-billion/322126 "2026-05-18T13:37:53Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [May 18, 2026, 1:37pm UTC](https://onehack.st/t/meta-was-eavesdropping-on-13-million-womens-period-apps-a-jury-just-said-thats-worth-190-billion/322126/1 "2026-05-18T13:37:53Z")
# 🔴 Meta Was Eavesdropping on 13 Million Women’s Period Apps — A Jury Just Said That’s Worth $190 Billion _A hidden tracking tool inside the Flo period app was quietly sending your ovulation dates, pregnancy status, and sexual activity straight to Meta’s ad servers — for three years. A jury just called it illegal._ **The numbers: 13 million users compromised. $5,000 per violation under California law. Potential liability: $190 billion. Google and Flurry already settled. Meta is fighting the verdict.** So here’s what happened. Between 2016 and 2019, the Flo period-tracking app — used by 75 million women worldwide — had [Meta’s tracking code](https://www.lawdragon.com/news-features/2025-08-25-big-tech-on-trial-jury-finds-meta-liable-for-misusing-women-health-data) secretly baked into its code. Every time a user logged their cycle, their pregnancy plans, their sexual activity, even details about contraception and yeast infections — all of that data was shipped directly to Meta for advertising. This wasn’t a hack. It was a feature. ![surveillance](https://media3.giphy.com/media/v1.Y2lkPTc5MGI3NjExaDViYW1tdzV3cDFpZ3o5MjNvdm1vcWw4NHY0amozenoxMjFpanZ3eiZlcD12MV9naWZzX3NlYXJjaCZjdD1n/VO95Z8adwZPlBqN3Xp/giphy.gif) * * * > **🧩 Dumb Mode Dictionary** > > | Term | What It Actually Means | > | --- | --- | > | **SDK** | A chunk of code a company (like Meta) gives app makers to drop into their app. It sends data back to the company silently. Think of it as a hidden microphone disguised as a feature. | > | **Class Action** | When a bunch of people (in this case 13 million) sue together instead of one by one. Strength in numbers. | > | **HIPAA** | A US law that protects your medical records at hospitals and doctors. But period apps? They don’t count as “medical” — so HIPAA doesn’t cover them at all. | > | **FTC** | The Federal Trade Commission — basically the US government’s consumer protection cops. They already fined Flo once in 2021 for this same thing. | > | **Data Broker** | A company that buys and sells personal info about you. Your pregnancy data is worth [200x more](https://www.context.news/digital-rights/how-period-tracking-apps-threaten-digital-privacy-rights) to advertisers than your age or location. | > **📱 How the Eavesdropping Actually Worked** > > The setup was diabolical in its simplicity: > > - Flo embedded Meta’s SDK (tracking code) inside the app > - Every time you filled out a health survey inside Flo, Meta **automatically received** every answer > - The court literally called it an “eavesdropping tool” — not a data breach, not a hack, but a wiretap built into the product > - This included: menstruation timing, ovulation dates, pregnancy attempts, sexual health details, chronic disease info, reproductive conditions > - Flo changed its privacy policy **13 times** during this period — but none of those changes actually told users what was happening > - The whole time, Flo’s marketing slogan was “Your Body, Your Data” — which, yeah > > The data went to Meta, Google, and a company called Flurry (an analytics firm). All three were caught. > **📊 The Receipts** > > | What | Number | > | --- | --- | > | Flo total users worldwide | ~75 million | > | Users in the class action | 13 million | > | Data collection period | Nov 2016 – Feb 2019 | > | Max fine per violation (California law) | $5,000 | > | Theoretical max liability for Meta | ~$190 billion | > | Flurry’s settlement | [$3.5 million](https://www.hipaajournal.com/jury-trial-meta-flo-health-consumer-privacy/) | > | Google’s settlement | Undisclosed | > | Flo’s earlier FTC fine | 2021 (amount undisclosed) | > | Privacy policy revisions during collection | 13 times | > | Value of pregnancy data vs. age data | 200x more valuable | > **⚖️ What the Jury Actually Said** > > A federal jury in San Francisco found Meta liable for violating California’s privacy laws. Key points: > > - The jury agreed that Meta’s SDK was essentially a **recording device** that “eavesdropped on consumers as they communicated with the app” > - They were NOT asked to set a dollar amount yet — that part comes later, and it could be catastrophic for Meta > - One of the original plaintiffs, Autumn Meigs, was a **teenager** when her data was being collected > - Meta is already trying to overturn the verdict > - Google and Flo settled before it went to trial — Meta was the only one that fought it and lost > > But here’s the thing nobody mentions: period apps are classified as “lifestyle” apps, not medical apps. That means [HIPAA doesn’t protect your data](https://kffhealthnews.org/news/article/period-tracking-apps-data-privacy/) at all. Your step counter and your ovulation tracker have the **exact same legal protection** — which is basically none. > **🔥 Why This Got Way Scarier After Roe v. Wade** > > When the US Supreme Court overturned Roe v. Wade in 2022, period tracking data suddenly became potential evidence in criminal cases. > > - If abortion is illegal in your state, your period tracker data could theoretically be **subpoenaed** (forced out by a court order) > - [Privacy International found](https://www.consumerreports.org/health/health-privacy/period-tracker-apps-privacy-a2278134145/) that **61% of period tracking apps** were automatically sharing data with Facebook — six years ago > - Law enforcement can buy this data from data brokers without a warrant > - Insurance companies can use it to adjust your premiums or deny coverage > - Many users deleted their apps entirely after Roe — but the data that was already collected? Still sitting on Meta’s servers. > > This isn’t hypothetical paranoia. The legal infrastructure for this is already built. > **🗣️ What People Are Saying** > > **George Furber, Privacy International legal officer:** > > > “Hopefully we’ll see this happening more and more with class actions, as people are being affected more and more.” > > **The Bureau of Investigative Journalism:** > > > “Meta automatically received information from each survey question” — calling it a hidden tracking tool, not a bug. > > **Flo’s original marketing:** > > > “Your Body, Your Data” — which aged like milk in the sun. > > **Researcher Stefanie Felsberger:** > > > The solution isn’t to ditch these apps — it’s to switch to non-commercial alternatives run by nonprofits. Don’t use any app that treats your data as its revenue source. > **🛡️ Apps That Don't Sell You Out** > > [Consumer Reports tested](https://www.consumerreports.org/health/health-privacy/period-tracker-apps-privacy-a2278134145/) eight period trackers. Only three passed both tests (local data storage + no third-party tracking): > > | App | Stores Data Locally | No Third-Party Tracking | > | --- | --- | --- | > | **Drip** | ✅ | ✅ | > | **Euki** | ✅ | ✅ | > | **Periodical** | ✅ | ✅ | > > These are open-source or nonprofit-run. Your data stays on your phone, period. No pun intended. * * * #### Cool. So Your Most Intimate Health Data Has Been Feeding Ad Algorithms for Years. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ) ![privacy phone](https://media0.giphy.com/media/v1.Y2lkPTc5MGI3NjExcGFpa2owMGhtcTRvd21vNjdzM2hyZmdwZ3hjdjkzemt4cjFrcHdleiZlcD12MV9naWZzX3NlYXJjaCZjdD1n/47lXcPnboH14PNUW6u/giphy.gif) > **🕳️ The SDK Bounty Hunter** > > Every app on your phone has 3-15 hidden SDKs (tracking codes) baked in. Most app developers don’t even know what data those SDKs are sending. Here’s the play: use free tools like [Exodus Privacy](https://exodus-privacy.eu.org/) to scan any Android app and list every tracker embedded inside it. Then contact the app developer directly, show them what their app is leaking, and offer to write a “privacy audit report” they can use for marketing. Small app studios (under 500K downloads) will pay $200-800 for this because they genuinely didn’t know — and “privacy-first” is now a selling point that moves downloads. > > 🧠 _Example:_ A 24-year-old infosec student in Berlin scans 50 health apps on Exodus Privacy, finds 12 that have Meta’s SDK silently installed. Emails each developer a one-page report. Three respond. Two pay €350 each for a full write-up. One hires her for ongoing privacy consulting at €800/month. > > > 📈 **Timeline:** First paid report in 5-7 days. Steady side income in 3-4 weeks. Saturates when bigger firms start offering the same service — but first movers own the niche testimonials. > **🎣 The Lawsuit Signal Scraper** > > Class action lawsuits against tech companies are public record. When a verdict like Meta/Flo drops, there’s a 2-4 week window where millions of affected users have NO idea they might be owed money. The play: monitor [ClassAction.org](https://www.classaction.org/) and court filing databases, then build simple one-page explainer sites targeting the specific app’s user base. “Were you a Flo user between 2016-2019? Here’s what just happened.” Monetize through legal referral partnerships (law firms pay $50-150 per qualified lead) or affiliate links to the safe alternative apps listed in the verdict coverage. > > 🧠 _Example:_ A 21-year-old in Manila builds a one-page site called “FloSettlement.info” within 48 hours of the verdict using a free Carrd template. Posts it on Reddit r/TwoXChromosomes and TikTok. Gets 40K visits in the first week. Earns $2,800 from legal referral clicks before bigger players catch up. > > > 📈 **Timeline:** First referral payment in 7-10 days. Each major tech verdict creates a new window. Burns out per-case in 3-4 weeks as law firms run their own ads, but the skill transfers to every new verdict. > **📡 The Privacy Swap Shop** > > Here’s the arbitrage: 61% of period apps leak data to Facebook. Only 3 apps passed Consumer Reports’ tests. Most women don’t know either fact. The play: create short-form video content (TikTok, Reels, Shorts) that does “app swap” reviews — “I scanned [popular app] and found 7 trackers. Here’s the free alternative with zero.” You’re not selling anything. You’re building an audience of privacy-conscious women — a demographic that health brands, VPN companies, and secure messaging apps will pay premium CPM rates to reach. [NordVPN’s blog](https://nordvpn.com/blog/period-tracker-apps-privacy/) already covers this topic, meaning VPN sponsors are already interested in this audience. > > 🧠 _Example:_ A 26-year-old nurse in Lagos records 15-second screen recordings of Exodus Privacy scans on popular apps, posts them as TikTok “exposés” with dramatic music. Hits 500K views in 2 weeks. Gets a $1,200 NordVPN sponsorship by week 4 with only 8K followers, because the niche is hyper-targeted. > > > 📈 **Timeline:** First viral video in 3-5 days if timing aligns with a news cycle. Sponsorship offers at 5K-10K followers in this niche. Plateaus when the news cycle moves on — but the audience stays for the next privacy scandal (and there’s always a next one). > **🪟 The HIPAA Gap Exploit** > > Period apps aren’t covered by HIPAA because they’re classified as “lifestyle” apps, not medical apps. But here’s the crack in the wall: if a doctor RECOMMENDS a specific period app for treatment purposes (endometriosis tracking, fertility treatment monitoring), the data arguably BECOMES medical data under some state laws. Nobody has built a bridge between gynecologists and privacy-safe period apps. The play: create a simple directory (Google Sheet or Notion page) of HIPAA-adjacent period tracking options, marketed specifically to OB/GYN offices. Doctors WANT to recommend apps but are terrified of liability. Give them a vetted list and charge clinics $15-30/month for the maintained directory with update alerts when an app’s privacy status changes. > > 🧠 _Example:_ A 28-year-old pre-med student in Bogotá creates a Notion database of 20 period apps ranked by privacy, tracker count, and data storage location. Emails 100 OB/GYN clinics in Florida (post-Roe anxiety is highest there). 8 clinics subscribe at $20/month. Revenue: $160/month from a Google Sheet that takes 2 hours/week to maintain. > > > 📈 **Timeline:** First subscriber in 10-14 days. Scales slowly — this is a $500-2,000/month ceiling, not a get-rich play. But it’s recurring, defensible, and gets better as more verdicts drop. > **🎰 The Data Deletion Middleman** > > Under GDPR (Europe) and CCPA (California), users have the legal right to demand companies delete their data. But nobody actually does it because the process is confusing — you have to email specific addresses, use specific legal language, and follow up when they ignore you (which they will). The play: offer a “data deletion service” for women who used Flo, Clue, or other leaky period apps. Charge $5-15 per app per deletion request. You’re not doing anything illegal — you’re filing official data deletion requests on behalf of the user using templates from [Privacy International’s guides](https://www.context.news/digital-rights/how-period-tracking-apps-threaten-digital-privacy-rights). Automate with form letters and email templates. Volume is the game. > > 🧠 _Example:_ A 22-year-old law student in Warsaw sets up a Typeform + Zapier flow. User fills out name + which apps they used. She sends templated GDPR deletion requests to each company. Charges €8 per request. Runs a Reddit ad in r/privacy for €30. Gets 60 orders in the first week = €480 minus ad spend. Net: €450 from copy-pasting legal templates. > > > 📈 **Timeline:** First orders within 3 days of posting. Peaks around major news cycles (like this verdict). Burns out in 6-8 weeks as copycat services appear and companies streamline self-service deletion — but that gap is wide open RIGHT NOW. > **🛠️ Follow-Up Actions** > > | Step | Action | > | --- | --- | > | 1 | Scan your own apps with [Exodus Privacy](https://exodus-privacy.eu.org/) right now — takes 30 seconds per app | > | 2 | Switch to Drip, Euki, or Periodical if you use a period tracker | > | 3 | File a [CCPA data deletion request](https://www.consumerreports.org/health/health-privacy/period-tracker-apps-privacy-a2278134145/) with any health app you’ve ever used | > | 4 | Check [ClassAction.org](https://www.classaction.org/) to see if you qualify for the Flo settlement | > | 5 | Revoke app permissions: Settings → Apps → [any health app] → Permissions → turn off everything except what it absolutely needs | * * * **⚡ Quick Hits** | Want | Do | | --- | --- | | 🔍 Check which trackers are in your apps | Run them through [Exodus Privacy](https://exodus-privacy.eu.org/) (free, instant) | | 📱 Switch to a safe period tracker | [Drip](https://bloodyhealth.gitlab.io/) — open source, data stays on your phone | | 💰 See if you’re owed money from Flo | Check [ClassAction.org Flo case](https://www.classaction.org/) for eligibility | | 🛡 Delete your data from Meta | [Facebook Off-Activity tool](https://www.facebook.com/off_facebook_activity/) — disconnect + delete | | 📖 Read the full investigation | [Bureau of Investigative Journalism report](https://www.thebureauinvestigates.com/stories/2025-09-03/meta-was-caught-eavesdropping-on-a-period-app-could-this-be-the-start-of-a-pushback-against-big-tech) | * * * _Your period tracker’s marketing said “Your Body, Your Data.” Turns out they meant Meta’s body of evidence, built from your data. The slogan was accurate — just not in the way you thought._