Court Rules
All enforcement actions
Consent DecreeLow Risk

FTC Settles Flo Health for Sharing Fertility App Data Without Consent

Flo Health, Inc.January 13, 2021Federal Trade Commission

Consumers Affected

100,000,000

Summary

The FTC settled with Flo Health, Inc., developer of a popular fertility-tracking app, alleging it misled users by sharing sensitive health data with third-party analytics providers like Facebook and Google after promising to keep such data private. The proposed consent order requires Flo to obtain user consent before sharing health data, notify affected users, and destroy previously shared data, among other requirements.

Remedy

Flo Health is prohibited from misrepresenting its data practices, must obtain affirmative consent before sharing users' health information, notify affected users about the prior disclosures, and instruct third parties to destroy the shared health data. The company must also undergo an independent review of its privacy practices.

Consent DecreeData DeletionCorrective NoticeAudit Requirement

Contract Impact

In-house legal teams should review vendor agreements with analytics/marketing providers (e.g., Facebook, Google) for unauthorized health data sharing clauses, customer terms of service and privacy policies for consent mechanisms regarding sensitive health information, and data processing agreements to ensure they mandate explicit opt-in consent before disclosing health data. Specific clauses to scrutinize include data sharing restrictions, consent requirements, data retention/deletion obligations, and breach notification provisions. Changes may be needed to incorporate granular consent for health data sharing, update privacy notices to reflect actual practices, and add enforceable data destruction timelines to align with the consent order.

Contract Search Terms

health data sharing clausethird-party analytics provider agreementuser consent for health informationdata processing addendum (health data)sensitive health information definitionprivacy policy integration clausedata destruction provisionbreach notification for health dataanalytics SDK termsdata retention schedule for health data

Laws Cited

EU-U.S. Privacy ShieldSwiss-U.S. Privacy Shield

Violation Types

Entity Details

Entity

Flo Health, Inc.

Also known as: Flo Health

Industry

Healthcare

Official Sources

Source Evidence

Entity Name
"Flo Health, Inc."
Violation Types
"Flo disclosed health data from millions of users of its Flo Period & Ovulation Tracker app to third parties that provided marketing and analytics services to the app, including Facebook’s analytics division, Google’s analytics division, Google’s Fabric service, AppsFlyer, and Flurry."
Violation Types
"Flo disclosed sensitive health information, such as the fact of a user’s pregnancy, to third parties in the form of “app events,” which is app data transferred to third parties for various reasons."
Laws Cited
"The FTC also alleges that Flo violated the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks,which,among other things, require notice, choice, and protection of personal data transferred to third parties."
Remedy Types
"As part of the proposed settlement, Flo is prohibited from misrepresenting the purposes for which it or entities to whom it discloses data collect, maintain, use, or disclose the data... In addition, Flo must notify affected users about the disclosure of their personal information and instruct any third party that received users’ health information to destroy that data."
Consumers Affected
"The developer of a period and fertility-tracking app used by more than 100 million consumers"

Related Enforcement Actions

FTC

Lens.com Inc.

The FTC, Utah, and Nevada sued Lens.com Inc., alleging that it advertised artificially low contact lens prices while hiding mandatory checkout charges and misleading consumers about its AutoRefill subscription. The complaint seeks to stop the alleged practices; the court has not yet decided the case, and no penalty or remedy has been imposed.

FTC

Online platforms

The FTC issued an advance notice of proposed rulemaking seeking public comment on whether ad-optimization tools offered by online platforms may help scammers impersonate businesses and government agencies. This is a proposed regulatory inquiry, not an enforcement action against a named company; no penalty or remedy was imposed.

FTC

Amazon.com, Inc.

$2.5B

A federal court approved a revised order in the FTC's Amazon Prime case under which Amazon will accelerate and expand redress payments under the September 2025 $2.5 billion settlement, which resolved allegations that Amazon enrolled millions of consumers in Prime subscriptions without their consent and knowingly made cancellation difficult. More consumers now qualify for refunds, the maximum payment cap rises from $51 to $200, and all future payments will be distributed automatically starting October 1, 2026, with potential supplemental $149 payments by April 2027. Amazon has already issued more than $845 million in redress payments as of September 2026.

FTC

Amway Corp.

$225.0M

The FTC and the state of Washington filed a joint complaint and proposed stipulated order requiring Amway Corp. and two affiliates—World Wide Group, L.L.C. (WWG) and Leadership Team Development Inc. (LTD)—to pay a $225 million judgment, the largest monetary recovery ever obtained from an MLM in an FTC action, over allegations that they used deceptive earnings claims and unfair tactics to recruit Independent Business Owners. The complaint alleges the companies falsely promised substantial income and recruitment success, pressured IBOs to buy products they could not resell, and instructed IBOs to falsely report sales. Nearly all of the judgment will be used as redress for IBOs who lost money, and the proposed order imposes structural reforms including a 70% resale requirement, independent audits of sales records, and a ban on approved providers charging new IBOs for first-year training.

FTC

FleetCor Technologies Inc. (now Corpay Inc.)

$100.0M

FleetCor Technologies Inc. (now Corpay Inc.) and its CEO Ronald Clarke agreed to pay $100 million to settle an FTC administrative action alleging the company charged small business customers hidden and unauthorized fees for fuel cards and misrepresented gas savings, fraud-control features, and fees. A federal district court granted the FTC summary judgment on all counts in 2023, and a federal appeals court upheld that judgment and the permanent injunction in 2026. The settlement funds will be used to provide redress to harmed business customers.

FTC

Automobile industry (auto dealers) - no named respondent; industry-wide guidance publication

FTC staff published FAQs on price transparency to help the automobile industry comply with the FTC Act, reiterating that an advertised vehicle price must be the actual price any consumer can pay, excluding only government-required charges. The guidance follows warning letters the FTC sent to 97 auto dealership groups earlier in 2026 and signals continued litigation against dealers that advertise one price but charge more through undisclosed fees. No specific entity was charged and no penalty was imposed.