09 Aug 2025 Search

previously: common sense one, bullshit documents zero

Lots of coverage of the Frasco v. Flo case (more links at the end). Lead trial attorney Michael Canty claims a Landmark win. Our clients entrusted their most sensitive information to a health app, only to have it exploited by one of the world’s most powerful tech companies. This verdict is a wake-up call to companies that view consent as a formality and transparency as optional. But it could have gone the other way, as other cases have. The Heiting v. HP Inc. case was ended by a motion to dismiss. A lot of lawyer time goes into these motions because they often work. The next case like this will be harder, and much work remains to be done.

Most of Meta’s arguments were, like the statement they sent to Suzanne Smalley at The Record, bullshit. The claim that User privacy is important to Meta, which is why we do not want health or other sensitive information and why our terms prohibit developers from sending any won’t work on anyone who actually has to deal with the duopoly. Meta has two sets of rules: the written rules they show to regulators and the media, and the rules enforced in practice. But Meta lawyers did make two strong arguments. Time to check the files from the case and find the key parts from the Meta side.

You can’t prove concrete injury, so you have no standing. Yes, people get ripped off on Facebook constantly, because the way that the ads work on there is designed to facilitate fraud. And yes, a bunch of companies feed information to Meta, without which Meta’s whole system for matching scammers to victims wouldn’t work. But it’s hard to connect a specific input to a specific output.

Plaintiffs’ speculative theories come nowhere near pleading that Analytics Defendants caused them the sort of concrete, particularized injury necessary to establish Article III standing….At most, Plaintiffs posit that they or others could have been targeted with ads they may find overwhelming or disturbing based on data Flo supposedly sent to Analytics Defendants. Even if that was a cognizable harm, no Plaintiff alleges that actually happened to them—nor could they. The mere risk of future harm is insufficient.

Plaintiffs are short on data for a reason. Meta has a Hydra of data stores and machine learning (ML) systems. Even for internal experts, querying the system to try to figure out which incoming data resulted in which ad targeting decisions is difficult. From the outside, it is hard for a plaintiff’s expert to come up with enough info about which data collection resulted in which harms. The concrete injury argument didn’t work for Meta this time, but it has worked in other situations and with other judges.

We’re just the recipient of data. This is different from the bullshit we’re shocked to discover Flo doing what we incentivized them to do defense. There is a legit argument here. If you leave your diary at my house and I call up some company and read it into their voicemail, then there is no way that company should be responsible for the privacy violation.

Plaintiffs’ claims against Analytics Defendants fail for independent, claim-specific reasons. Many of the deficiencies flow from the basic fact that the law does not impose liability on a party receiving data intentionally sent to them—to do so would create a strict liability framework with due process concerns because a receiving party cannot control what a transmitting party sends. For instance, Plaintiffs’ UCL and aiding and abetting claims (Counts 9, 10, & 11) reflect an impermissible attempt to impose vicarious liability on Analytics Defendants for practices not under Analytics Defendants’ unbridled control. Similarly, Plaintiffs’ wiretapping and eavesdropping claims (Claims 12 & 13) fail because Plaintiffs do not allege any Analytics Defendant intercepted their data, but allege that Flo first created and subsequently transmitted and sent Flo App data to them that may have revealed Plaintiffs’ personally identifiable health information. Nor can it possibly be computer hacking (Claim 14) to receive information purposefully sent by a third party.

Following the New York State Department of Financial Services report, Meta is making an effort to filter out sensitive data. Next time, even if the plaintiff’s expert can come up with a detailed log of information passed to Meta, no individual log entry will show a sensitive data point. And the argument that Meta is just receiving ToS-compliant data from the app will stand a better chance of working. But let’s consider what is already probably happening behind the scenes, now that Meta has started to do the work to show that they are rejecting obvious sensitive data.

  1. Meta actually starts filtering out some or all sensitive personal data. (They won’t mind because they get it back in step 3.)

  2. Companies still get rewarded in some way for making Meta aware of sensitive personal data, but they have to figure out a back-channel way to send it. For example, what ordinary-looking personal activities change depending on the user’s menstrual cycle? Instead of sending the menstrual cycle directly, send enough other activities that an ML system will be able to infer where the user is on the cycle.

  3. An ML system at Meta reconstructs the sensitive personal data from the data sent in step 2, as an inference.

The end result is roughly the same as sending the sensitive personal information directly, but now it’s buried in an internal ML system at Meta, and is never sent in a way that Wall Street Journal reporters can peek at using a proxy. Instead of incentivizing the sending of sensitive data (which means trouble) Meta can reconstruct sensitive data with ML (still trouble, but try proving it) and incentivize the sending of the needed volumes of less sensitive data.

State privacy laws can help

Both the standing argument and the recipient argument are bad news for journalists and lawyers, but exactly the kind of thing that can and should be addressed in state privacy laws, and made a priority by regulators. Thinking big picture for a minute, people have three teams to protect them from privacy harms: Legislators and regulators, lawyers in private practice, and journalists and researchers. Each of the three is vulnerable to spinning off into a failure spiral without the other two.

Regulators: Without the common sense provided by jurors and news site audiences, regulators can get snarled up with compliance paperwork without motivating meaningful changes in business practices or reducing harms to people.

Journalists and researchers: Without the prospect of regulatory or legal action, journalists and researchers are trapped on the doom loop of (1) find something heinous going on, get some clicks (2) the surveillance company uses the journalist’s or researcher’s work as free QA, changes something to make the problem less obvious (3) surveillance company continues to hog the ad revenue and work the political system so there are fewer journalists and less research funding next time (4) repeat as long as you can

Lawyers: Without the information that could be provided by the other two, lawyers risk getting stuck doing small-time cases over stupid stuff like JavaScript mistakes that can be spotted in browser dev tools, instead of pursuing the bigger, transformative cases. These cases bring in some money in the short term, but in the medium term they provide talking points for lobbyists who are advocating for anti-privacy legislation.

How the next cases will be harder

After Frasco v. Flo, the surveillance business will do what it can to make the next case harder. Expect Meta to make continued investments in ML, to:

  • Put as many layers of inscrutable processing as possible between a data transfer and the resulting harms.

  • Apply first, filters to remove sensitive data from places where it can be seen passing from company to company, and second, ML to reconstruct the sensitive data in the form of inferences.

Both of these are hella resource-intensive. But as far as I can tell, the best countermeasure that we have is not. The common tool that can help address both is the humble right to know (RtK). California Attorney General Rob Bonta wrote, in a 2022 Opinion of the Attorney General (PDF),

The plain language of the [California Consumer Privacy Act (CCPA)], as well as the legislative history, persuade us that the CCPA purposefully gives consumers a right to receive inferences, regardless of whether the inferences were generated internally by the responding business or obtained by the responding business from another source.

The Right to Know—written into legislation and (if all goes well) enforced by the Attorney General or some other public official—solves a problem that journalists and lawyers can’t solve on their own. Right now, RtKs are hard to do, have limited effectiveness, and are under-used. But an effective RtK process, backed up by regulator attention, can require the disclosure of inferences that were used to perpetrate harms. Right now, your propensities to fall for different varieties of scams are some kind of data points in some kind of data store at Meta. Those data points are actively being processed when scammers bid in an internal auction for the ad impressions you see. Technically, according to the law, Meta is required to disclose those inferences. Stronger, more informative RtKs won’t give lawyers a case already gift-wrapped, but they give researchers and data journalists some strings to pull on. Sign up the recipients of scam ads as research volunteers, look at the inferences stored about them, look at who passed data about them, do some stats. The resulting news stories and research reports will help privacy lawyers focus on higher-impact cases.

For regulators, one lesson of Frasco v. Flo will be: don’t let anybody give an RtK sender any grief. If a company is obviously using inferences but not disclosing, they need a lot more attention because that’s a good indicator that concrete harms are happening. Privacy lawyers aren’t full-stack crime fighters—they will get a lot further starting from reports based on RtK data. RtK processes need to be not so maze-like that they make research and data journalism harder. Enforce the regulations on dark patterns and deceptive UI—companies that are using them are probably doing other crimes, too. maybe there should be something like an Al Capone theory for sneaky UIs. A regulator can’t expect a company to make some kind of breakthrough in ML in response to an RtK. However, money is already being made from important but undisclosed inferences such as propensity to become a big-time sports bettor. In the event that an inference is actually used to perpetrate some harm to a user, it needs to be disclosed (even if the maintainer of the ML system has to do some coding) and the AG or regulator needs to be on the case if it’s not.

From the legislative point of view, a powerful RtK section in a state law, and funding for a regulator to enforce it, will have a lot more impact than other material that only comes into play when a company loses the privacy compliance reverse lottery where the prize is AG attention. Fighing for private right of action is important, but possibly more important is fighting for RtKs so good that they disclose enough concrete harms that the private right of action is a nice-to-have, an extra section in a case that’s already strong.

More news from the case

Meta violated privacy law, jury says in menstrual data fight by Margaret Attridge on Courthouse News Service. Jurors were given three questions—and on each one, they ruled against Meta. They said that yes, Meta had intentionally eavesdropped and that yes, users could have reasonably expected that their sensitive menstrual information was not being shared. Finally, the jurors ruled that no, Meta did not have consent for its actions.

Meta used Flo menstruation app data to sell ads, jury finds by Iain Thomson on The Register. [I]n 2019, the Wall Street Journal reported Flo was sharing health events with Meta. The discovery prompted the Federal Trade Commission to investigate the matter in 2020, and it issued a formal complaint [PDF] in 2021. The complaint shows Meta, Fabric (formerly Twitter’s SDK but later folded into Google’s Firebase), and analytics biz Flurry had been using Flo data since 2016, and Google and marketing concern AppsFlyer since 2018. (All the other companies settled.)

Meta Violated California Wiretap Law, Jury Finds by Wendy Davis at MediaPost. The verdict—which appears to mark the first time a jury found Meta violated users’ privacy—stems from allegations that the company gathered ad-targeting data from an app via a software development kit. The jury specifically found that Flo users proved Meta intentionally eavesdropped on and/or recorded their conversations, in violation of a California wiretap law prohibiting anyone from recording electronic communications without all parties’ consent.

Meta eavesdropped on period-tracker app’s users, SF jury rules Along with the eavesdropping decision, the group determined that Flo’s users had a reasonable expectation they weren’t being overheard or recorded, as well as ruling that Meta didn’t have consent to eavesdrop or record. The unanimous verdict was that the massive company violated the California Invasion of Privacy Act.

Jury finds Meta broke wiretap law by collecting data from period-tracker app by Jon Brodkin at Ars Technica. Details on the plaintiffs’ settlements with Flo Health and Google haven’t been released yet. Those two settlements were announced shortly before the trial. Flurry settled late last year, agreeing to pay $3.5 million to pay claims from Flo app users and other costs, but the settlement is still pending court approval.