Is the Flo Period App Safe in 2026? The $59.5M Settlement — and What It Means for Your Data

Flo Health, Google, and Flurry agreed to a combined $59.5 million settlement for sharing users' menstruation and pregnancy data without consent. Here is what actually happened, what your data exposure is today, and what you can switch to.

If you have ever used the Flo period tracking app, your most intimate health data — when you menstruate, your pregnancy status, your sexual activity, your symptoms — may have been shared with Google, Meta, and third-party data brokers without your knowledge or consent.

This is not speculation. It is the finding of a federal class action lawsuit, an FTC enforcement action, and a California jury verdict. The companies involved have agreed to pay $59.5 million to settle the claims.

In this article we explain exactly what happened, what the settlement means for you, whether Flo is safer in 2026, and what the genuinely private alternatives look like.

What Did Flo Actually Do?

Between November 2016 and February 2019, the Flo period tracking app shared sensitive user data with multiple third parties through embedded software development kits (SDKs). These SDKs — pieces of code built by Google, Facebook (now Meta), Flurry, and AppsFlyer — were integrated into the Flo app and quietly transmitted user health data back to those companies.

The data shared included:

• Menstrual cycle dates and period tracking information
• Pregnancy status and pregnancy-related goals
• Sexual activity logs
• Location data
• Symptom and health information entered by users

This sharing happened despite Flo's privacy policy explicitly stating that user data would not be shared with third parties without consent. The third parties were not contractually restricted on how they used this data once they received it.

The Full Legal Timeline

January 2021: FTC Settlement

The FTC charged Flo Health with making "fraudulent misrepresentations" about user privacy and reached a settlement. Flo was prohibited from misrepresenting how it collects, uses, and shares user data, and was required to notify affected users — the first time the FTC had ever imposed such a notification requirement. Flo paid no fine. It simply agreed to stop.

September 2021: Class Action Filed

Eight named plaintiffs filed a class action lawsuit in the U.S. District Court for the Northern District of California (Case No. 3:21-cv-00757-JD). The lawsuit named Flo Health, Meta, Google, Flurry, and AppsFlyer as defendants, alleging violations of the California Invasion of Privacy Act and the California Confidentiality of Medical Information Act.

August 2025: Jury Finds Meta Liable

A San Francisco jury found Meta liable for violating CIPA by collecting Flo users' sensitive health data. This was the first major jury verdict in period-tracking privacy litigation.

September 2025: Google and Flo Settle

Google agreed to pay $48 million and Flo Health agreed to pay $8 million. Combined with Flurry's earlier $3.5 million settlement, the total reached $59.5 million. All three settling defendants denied wrongdoing.

February–April 2026: Settlement Approval

A renewed motion for preliminary approval was filed on February 27, 2026. Users who qualify can file a claim at periodtrackerdataprivacylitigation.com once the claim form opens.

Is Flo Safe to Use in 2026? An Honest Assessment

Flo has made genuine improvements since the FTC action. The data-sharing described in the lawsuit has stopped. Its security certifications are real. Anonymous Mode exists.

But there are structural reasons why Flo can never offer the same guarantee as a truly local-storage app:

• Cloud-first architecture: All your data lives on Flo's servers. If those servers are hacked, your data is exposed.
• Advertising-adjacent model: Flo's free tier is supported by advertising, creating structural pressure to monetise user data.
• Privacy is a promise, not a constraint: When Flo says your data is safe, you must trust their word — with the lawsuit as recent history, some users reasonably don't.
• Anonymous Mode requires premium: It costs $49.99/year and only anonymises account identifiers, not the data itself on Flo's servers.

"Such data sharing occurred despite the company's privacy policies and public assurances that insisted users' personal data would not be transferred without explicit consent." — ICLG, summarising the class action complaint · August 2025

How to Verify Any Period App's Privacy in 3 Minutes

Before trusting any period app's privacy claims, run this test yourself:

The Safest Period Tracker Alternatives in 2026

Frequently Asked Questions

The Bottom Line

Flo has improved since 2019. But the lawsuit has settled, not been dismissed — meaning the underlying conduct was real. And the architecture that made it possible — cloud storage of intimate health data combined with an ad-supported business model — has not fundamentally changed.

If you want privacy that is technically verifiable rather than contractually promised, the local-storage alternatives in this article are the better choice. CycleVault specifically lets you confirm in DevTools within 30 seconds that nothing is uploaded — because it physically cannot be. There is no server.

Continue Reading