04 Aug 2025 Search

(Update 5 Aug 2025: a scanned copy of the jury verdict form is up. Also please remember that this is a personal blog, not a corporate blog, which should be obvious because I can say damn and bullshit on here.)

Some recent privacy news: Meta violated privacy law, jury says in menstrual data fight by Margaret Attridge on Courthouse News Service. This was a big class action case over the Flo app, which was covered in the 2019 Wall Street Journal story You Give Apps Sensitive Personal Information. Then They Tell Facebook by Sam Schechner and Mark Secada. Flo and the other defendants settled, and Meta stuck with the case until the end. (Or is it? No news on whether they will appeal.) I used RECAP to get some of the public files from the case, and it looks like Meta’s failed defense relied on two long bullshit documents.

  • Meta claims that Flo users agreed to surveillance when they accepted the Meta (then Facebook) terms of service. And the Terms of Service are only 14 pages printed out! Yes, there are 15 other documents linked to in the Other terms and policies that may apply to you section, but really, people could, in theory, have read all this stuff and figured out the creepy parts in advance, right?

  • Meta claims that they prohibited Flo from sending them data about user health. Suzanne Smalley, in a story for The Record, quotes a Meta statement. User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any.

But the jury applied some common sense to the situation. First of all, nobody reads all the lengthy contracts they agree to, which is why we have an economy and a society at all. If the only way to protect yourself from arbitrary unfair or harmful actions was to try to spot them in long legal documents, nobody would get a damn thing done.

A key question from the jury’s verdict form: Did Meta have the consent of all parties to the conversation to eavesdrop on and/or record it?

And second, anyone who has dealt with large platform companies knows that they have one set of written rules, to show to media and regulators, and then the real rules that you have to follow in order to make any money. The New York State Department of Financial Services did a Report on Investigation of Facebook Inc. Data Privacy Concerns and found,

Essentially, notwithstanding Facebook’s policy that app developers should not transmit sensitive data to Facebook, there were many examples where the developers violated that policy and Facebook did indeed—unwittingly, it contends—receive, store, and analyze sensitive data. The information provided by Facebook has made it clear that Facebook’s internal controls on this issue have been very limited and were not effective at enforcing Facebook’s policy or preventing the receipt of sensitive data.

The written policy requires that an app developer must categorize data in advance before sending it, but the policy as implemented in actual code mandates sending Meta as much data as possible. An app developer with two Jira tickets, one likely revenue-positive and the other for implementing some Meta policy as written, is going to do the first one.

This case will help inform future state privacy laws. Right now a lot of legislative and regulatory attention is being paid to data brokers and web cookies, which looks more and more obsolete as the advertising duopoly counts for more and more of the tracking that people are subjected to. (Here’s a document from the case that shows why we need better RtKs in state laws—large platforms generally put layers of ML-based obfuscation in between the surveillance and the downstream uses of the data, to make cases like Frasco v. Flo harder for the plaintiff.) And this case is a good argument for keeping a jury in the loop. Some kind of private right of action is needed in order to deter companies from pursuing compliance through complex documents that are ultimately bullshit but tweaked to the point where regulators can’t find faults in them. More: inquiring minds (have a right to) know