Frasco v. Flo Health, Inc.

1                                                                         
2                                                                         
3                                                                         
4                      UNITED STATES DISTRICT COURT                       
5                     NORTHERN DISTRICT OF CALIFORNIA                     
6                                                                         
7    ERICA FRASCO, et al.,            Case No.  21-cv-00757-JD            

8              Plaintiffs,                                                
                                      SUMMARY JUDGMENT ORDER RE           
9          v.                         META AND FLO                        

10    FLO HEALTH, INC., et al.,                                            
               Defendants.                                                
11                                                                         

12                                                                         
13        This order resolves the motions for summary judgment filed by defendants Flo and Meta.  
14   Dkt. Nos. 528, 536.  The parties’ familiarity with the record is assumed.  Summary judgment is 
15   granted and denied in part.                                           
16   I.   META’S MOTION                                                    
17        First, summary judgment is granted on the claim under the Wiretap Act, 

18 U.S.C. § 2511

.  
18   There is no liability under the Act if “one of the parties to the communication” gives “prior 
19   consent,” 

id.

 § 2511(2)(d), and the undisputed record shows that Flo consented to Meta’s data 
20   collection practices.  The Court notes that plaintiffs did not seek class certification of this claim, 
21   see Dkt. No. 477, and that the basis of dismissal re Meta was not raised by Google in its summary 
22   judgment papers, see Dkt. No. 338 at 19.                              
23        Second, summary judgment on the claims under the California Invasion of Privacy Act 
24   (CIPA), 

Cal. Pen. Code §§ 631-32

, is denied.  Disputes of fact abound with respect to the scope of 
25   consent, the timing of Meta’s “interception” or “eavesdropping,” whether Meta “intended” to 
26   intercept communications, whether Meta’s interception occurred while the communications were 
27   “in transit,” and the like.  See, e.g., App’x 507-10, 847-48, 718-20; Dkt. Nos. 478-6 ¶¶ 82-90; 478-
1   the § 631 claim.  See Frasco v. Flo Health, Inc. (Flo Health II), No. 21-cv-757-JD, 

2025 WL 2

   1433825, at *19 (N.D. Cal. May 19, 2025).  Consequently, the § 632 claim will proceed on a 
3   classwide basis for the California subclass while the § 631 claim will proceed solely for plaintiffs 
4   Wellman, Chen, and Gamino.                                            
5        Third, summary judgment on the California Comprehensive Computer Data Access and 
6   Fraud Act (CDAFA) claim, 

Cal. Pen. Code § 502

, is granted.  The sole ground advanced by 
7   plaintiffs relies on their putative expert, David Hoffman, to show that the Custom Event data 
8   carried “financial value” to Flo App users and that its surreptitious transmission caused them 
9   “damage or loss.”  Dkt. No. 564-3 at 24.  Hoffman has been excluded from testifying at trial under 
10   Federal Rule of Evidence 702, see Dkt. No. 597, and plaintiffs did not present an alternative, non-
11   speculative basis for showing “damage or loss.”  Certification was denied as to this claim, Flo 
12   Health II, 

2025 WL 1433825

, at *17-18, so summary judgment is granted against the named 
13   plaintiffs.                                                           
14        Fourth, summary judgment is granted on individual named plaintiffs’ claim that Meta 
15   aided and abetted Flo’s intrusion upon seclusion.  Plaintiffs’ evidence for this claim is not 
16   materially different from the evidence they proffered in the unsuccessful assertion of a very 
17   similar aiding-and-abetting claim against Google.  Summary judgment is warranted here for the 
18   same reasons re Google.  See Frasco v. Flo Health, Inc. (Flo Health I), No. 21-cv-757-JD, 2024 

19 WL 4280933

, at *3 (N.D. Cal. Sept. 23, 2024).                         
20        Fifth, with the named plaintiffs’ agreement, Dkt. No. 564-3 at 25, summary judgment is 
21   granted on the UCL claim.                                             
22   II.  FLO’S MOTION                                                     
23        First, summary judgment on the ground that all claims are time barred is denied.  A jury 
24   will need to decide whether Flo’s privacy disclosures sufficed to give users constructive notice of 
25   the alleged misconduct, and with respect to the discovery rule, plaintiffs set forth evidence from 
26   which a reasonable jury could find that they did not learn about the alleged misconduct until 
27   January 2021.  See, e.g., Dkt. Nos. 535-11 at 117:23-118:6; 535-14 at 232:10-233:14; 535-18 at 
1   create fact issues about the applicability of the fraudulent concealment doctrine which will need to 
2   be resolved by the trier of fact.  See, e.g., Dkt. No. 496-4 at 289-90; 536-60 at ECF 5.   
3        Second, Flo’s request to enforce the class waiver in its terms of use is not well taken for 
4   the reasons given in the Court’s certification order.  Flo Health II, 

2025 WL 1433825

, at *9-11.   
5        Third, with the named plaintiffs’ agreement, Dkt. No. 560-3 at 24 n.14, summary judgment 
6   is granted on their implied contract and UCL claims.  Summary judgment is also granted on 
7   named plaintiffs’ unjust enrichment claim to the extent it is asserted as an independent cause of 
8   action, as it overlaps with plaintiffs’ other substantive claims.  See LeBrun v. CBS Tv. Studios, 
9   Inc., 

68 Cal. App. 5th 199

, 211 (2021); Paracor Fin., Inc. v. Gen. Elec. Cap. Corp., 

96 F.3d 1151

, 
10   1167 (9th Cir. 1996).  Insofar as plaintiffs pursue equitable remedies, like disgorgement, not as 
11   independent causes of action but pursuant to other claims, like intrusion upon seclusion, Flo did 
12   not meet its burden of showing its entitlement to judgment and the absence of fact disputes 
13   concerning the adequacy of legal remedies.  Fed. R. Civ. P. 56(a).    
14        Fourth, summary judgment on the Confidentiality of Medical Information Act (CMIA) 
15   claim, 

Cal. Civ. Code §§ 56

 et seq., is denied.  Flo’s arguments are not well taken.  Dkt. No. 535-3 
16   at 18-22.  Flo says that it is not a “Provider of health care” as contemplated by § 56.05(p) and that 
17   the CMIA was amended in 2023 to include express references to “[r]eproductive or sexual health 
18   application information.”  Id. at 18-19.  As a result, Flo says the “CMIA did not apply to 
19   pregnancy and fertility tracker apps like Flo from 2016 through 2019.”  Id. at 19.  This argument 
20   was not raised in connection with class certification, and it does not now sink plaintiffs’ claims.   
21        Flo ignores the plain text of both § 56.05(j) and § 56.06(b).  There are fact disputes about 
22   Flo’s services and practices, based on the evidence discussed in the certification order, see Flo 
23   Health II, 

2025 WL 1433825

, at *17, bearing on (1) whether the Custom Event data was 
24   “individually identifiable information . . . in possession of . . . a provider of health care . . . 
25   regarding a patient’s medical history, mental or physical condition, or treatment,” Cal. Civ. Code 
26   § 56.05(j) (2019); and (2) whether Flo is a “business that offers software . . . including a mobile 
27   application . . . that is designed to maintain medical information, as defined in subdivision (j) of 
1   allowing the individual to manage his or her information,” id. § 56.06(b) (2019).  Flo did not say 
2   why the plain text of either subsection should be read more narrowly than their ordinary meaning 
3   simply because the 2023 amendments added provisions that would overlap in some instances.  See 
4   Skidgel v. Cal. Unemployment Ins. App. Bd., 

12 Cal. 5th 1, 14

 (2021) (“We begin by examining 
5   the statutory language, giving it a plain and commonsense meaning.” (citation omitted)).  Insofar 
6   as legislative history is helpful here, it is less definitive than Flo suggests.  See, e.g., Cal. Bill 
7   Analysis, A.B. 254 Sen., 6/13/2023 at 6 (noting the concern that some reproductive health apps 
8   would not “necessarily be captured under the existing definition of medical information”); Cal. 
9   Bill Analysis, A.B. 254 Assem., 4/25/2023 at 5 (expressing concerns about “serious loopholes in 
10   existing protections”).                                               
11        Flo’s contention that the Custom Event data was not “medical information” because the 
12   data was “de-identified” is also unavailing.  Dkt. No. 535-3 at 21-22.  As discussed in the 
13   certification order, there is evidence from which a reasonable jury could find that the transmitted 
14   Custom Events “include[d] or contain[ed] any element of personal identifying information 
15   sufficient to allow identification of the individual.”  

Cal. Civ. Code § 56.05

(j); Flo Health II, 2025 

16 WL 1433825

, at *5.  The CMIA claim will proceed on a classwide basis.  Flo’s specific objections 
17   may be raised at trial as circumstances warrant.                      
18        Fifth, summary judgment is granted on all claims asserted by plaintiff Pietrzyk, who did 
19   not start using the Flo App until long after the class period and whose claims plaintiffs did not 
20   defend.  See Dkt. Nos. 560-3; 579-3 at 1 n.1.                         
21        Finally, Flo’s suggestion in a footnote that it “incorporated” other filings, Dkt. No. 353-3 
22   at 8 n.4, is misdirected.  Paragraph 22 of the Court’s Standing Order for Civil Cases proscribes 
23   such tactics, see J. Donato, Standing Order for Civil Cases ¶ 22, and the Court declines to root 
24   through the record to make Flo’s case for it, see Flo Health II, 

2025 WL 1433825

, at *16. 
25                              CONCLUSION                                 
26        Summary judgment is granted to Meta on named plaintiffs’ CDAFA, federal Wiretap Act, 
27   aiding-and-abetting intrusion upon seclusion, and UCL claims but is denied in all other respects.  
    1    of unjust enrichment insofar as that is asserted as a standalone claim.  Summary judgment is also 
    2  || granted to Flo on all claims asserted by plaintiff Pietrzyk but is denied in all other respects.  The 
    3    request for judicial notice, Dkt. No. 563, is denied as moot. 
    4          IT IS SO ORDERED. 
    5  || Dated: May 22, 2025 
    6 
    7 
                                                        JAM     ONATO 
    8                                                    Unitg#   States District Judge 
    9 
   10 
   11 
    12 

    13 

 © 
    15 
   16 

 =    17 

Z    18 
   19 
   20 
   21 
   22 
   23 
   24 
   25 
   26 
   27 
   28