Consumers Affected
100,000,000
The FTC settled with Flo Health, Inc., developer of a popular fertility-tracking app, alleging it misled users by sharing sensitive health data with third-party analytics providers like Facebook and Google after promising to keep such data private. The proposed consent order requires Flo to obtain user consent before sharing health data, notify affected users, and destroy previously shared data, among other requirements.
Flo Health is prohibited from misrepresenting its data practices, must obtain affirmative consent before sharing users' health information, notify affected users about the prior disclosures, and instruct third parties to destroy the shared health data. The company must also undergo an independent review of its privacy practices.
In-house legal teams should review vendor agreements with analytics/marketing providers (e.g., Facebook, Google) for unauthorized health data sharing clauses, customer terms of service and privacy policies for consent mechanisms regarding sensitive health information, and data processing agreements to ensure they mandate explicit opt-in consent before disclosing health data. Specific clauses to scrutinize include data sharing restrictions, consent requirements, data retention/deletion obligations, and breach notification provisions. Changes may be needed to incorporate granular consent for health data sharing, update privacy notices to reflect actual practices, and add enforceable data destruction timelines to align with the consent order.
Entity
Flo Health, Inc.
Also known as: Flo Health
Industry
HealthcareOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about
flo health order
https://www.ftc.gov/system/files/documents/cases/flo_health_order.pdf
flo health complaint
https://www.ftc.gov/system/files/documents/cases/flo_health_complaint.pdf
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"Flo Health, Inc."
"Flo disclosed health data from millions of users of its Flo Period & Ovulation Tracker app to third parties that provided marketing and analytics services to the app, including Facebook’s analytics division, Google’s analytics division, Google’s Fabric service, AppsFlyer, and Flurry."
"Flo disclosed sensitive health information, such as the fact of a user’s pregnancy, to third parties in the form of “app events,” which is app data transferred to third parties for various reasons."
"The FTC also alleges that Flo violated the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks,which,among other things, require notice, choice, and protection of personal data transferred to third parties."
"As part of the proposed settlement, Flo is prohibited from misrepresenting the purposes for which it or entities to whom it discloses data collect, maintain, use, or disclose the data... In addition, Flo must notify affected users about the disclosure of their personal information and instruct any third party that received users’ health information to destroy that data."
"The developer of a period and fertility-tracking app used by more than 100 million consumers"
$930K
The FTC finalized orders requiring CMG Media Corporation (doing business as Cox Media Group), MindSift LLC, and 1010 Digital Works LLC to pay a total of $930,000 for falsely claiming they offered an AI-powered service that could target ads based on conversations captured from consumers' smart devices, and that consumers had opted into such targeting. The orders also prohibit the companies from making misrepresentations about their advertising services, voice data collection, and consumer consent.
The FTC announced it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing, which is the use of personal data to set prices based on what a company believes an individual consumer is willing to spend. The statement warns that undisclosed collection or use of personal data for personalized pricing could violate the FTC Act's prohibition on unfair or deceptive practices. The Commission voted 2-0 to authorize the Federal Register notice.
$4.0M
The FTC and Connecticut secured a $4 million settlement with Chase Nissan LLC (doing business as Manchester City Nissan) over allegations the dealership charged consumers unauthorized fees, including double-charging for 'certified pre-owned' vehicles and inserting charges like total loss protection into financing agreements without consent. The settlement requires $4 million in consumer redress, prohibits misrepresentations about vehicle certification and warranties, mandates prominent disclosure of the maximum total vehicle price, and requires express informed consent for all charges.
The FTC filed a complaint against Credit Glory LLC and related entities for deceptive credit repair practices, including false promises, impersonating debt collectors, charging illegal upfront fees, and using negative option billing without consent. A federal court temporarily halted the operation.
The FTC issued a policy statement abandoning disparate-impact liability, stating it will no longer bring claims based on this theory. It also modified compliance obligations for several companies based on past decisions.
The FTC, along with Utah and California, filed a complaint against Hims & Hers alleging the telehealth provider shared consumers' sensitive health information with third-party advertising platforms without consent, and deceived consumers about billing and cancellation practices. The complaint alleges violations of the FTC Act and the Restore Online Shoppers' Confidence Act.