Meta accessed women's health data from Flo app without consent, says court • Hacker News Board

Re: Meta accessed women's health data from Flo app without consent, says court

#141

Post by barbazoo » Thu, Aug 14, 2025, 3:53 PM UTC

lemonberry wrote: post #36

kubb wrote: post #6

Whenever you think of a court versus Facebook, imagine one of these mini mice trying to stick it to a polar bear. Or a goblin versus a dragon, or a fly versus an elephant. These companies are for the most part effectively outside of the law. The only time they feel pressure is when they can lose market share, and there's risk of their platform being blocked in a jurisdiction. That's it.

The worst part for me personally is that almost everyone I know cares about this stuff and yet they keep all of their Meta accounts. I really don't get it and frankly, find it kind of disturbing. I know people that don't see anything wrong with Meta so they keep using it. And that's fine! Your actions seem to align with your stated values. I get human fallibility. I've been human for awhile now, and wow, have I made…

I keep sharing stories like this with them. Privacy violations, genocide, mental health, …. Whenever I think it might be something someone cares about I share with them. I also make an effort to explain to my non tech folks that meta is Facebook, instagram, WhatsApp, to make sure they understand recognize the name. Many people do not know what meta is. Sometimes I suspect it was a way to capture the bad publicity and protect their brands.

Re: Meta accessed women's health data from Flo app without consent, says court

#142

Post by SilasX » Thu, Aug 14, 2025, 3:53 PM UTC

gruez wrote: post #131

jlarocco wrote: post #117

Earlier quoted context omitted.

That's only the first part of the story, though. Facebook isn't guilty because Flo sent medical data through their SDK. If they were just storing it or operating on it for Flo, then the case probably would have ended differently. Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. They knew, or should have known, that they needed t…

>Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. What exactly did this entail? I haven't read all the court documents, but at least in the initial/amended complaint the plaintiffs didn't make this argument, probably because it's totally irrelevant to the charge of whether they "intentionally eavesdropped" or not. Either they we…

Yeah, I'm not sure if I'm missing something, and I don't like to defend FB, but ...

AIUI, they have a system for using data they receive to target ads. They tell people not to put sensitive data in it. Someone does anyway, and it gets automatically picked up to target ads. What are they supposed to do on their end? Even if they apply heuristics for "probably sensitive data we shouldn't use"[1], some stuff is still going to get through. The fault should still lie with the entity that passed on the sensitive data.

An analogy might be that you want to share photos of an event you hosted, and you tell people to send in their pics, while enforcing the norm, "oh make sure to ask before taking someone's photo", and someone insists that what they sent in was compliant with that rule, when it wasn't. And then you share them.

[1] Edit: per your other comment, they indeed had such heuristics: https://news.ycombinator.com/item?id=44901198

Re: Meta accessed women's health data from Flo app without consent, says court

#143

Post by at-fates-hands » Thu, Aug 14, 2025, 3:55 PM UTC

HeavyStorm wrote: post #77

gruez wrote: post #72

As much as I don't like facebook as a company, I think the jury reached the wrong decision here. If you read the complaint[1], "eavesdropped on and/or recorded their conversations by using an electronic device" basically amounted to "flo using facebook's sdk and sending custom events to it" (page 12, point 49). I agree that flo should be raked over the coals for sending this information to facebook in the first place…

That's why in these cases you'd prefer a judgment without a jury. Technical cases like this will always confuse jurors, who can't be expected to understand details about sdk, data sharing, APIs etc. On the other hand, in a number of highprofile tech cases, you can see judges learning and discussing engineering in a deeper level.

>> Technical cases like this will always confuse jurors.

This has been an issue since the internet was invented. Its always been the duty of the lawyers on both sides to present the information in cases like this in a manner that is understandable to the jurors.

I distinctly remember during the OJ case, there were many issues that the media said most likely were presented in such a detailed manner, many in the jurors seemed to be checked out. At the time, the prosecution spent days just on the DNA evidence. In contrast, the defense spent days just on how the LAPD collected evidence at the crime scene with the same effect, that many on the jury seemed to check out the deeper the defense dug into it.

So it not just technical cases, any kind of court case that requires a detailed understanding of anything complex comes down to how the lawyers present it to the jury.

Re: Meta accessed women's health data from Flo app without consent, says court

#144

Post by decisionsmatter » Thu, Aug 14, 2025, 3:58 PM UTC

qwertylicious wrote: post #133

decisionsmatter wrote: post #132

Earlier quoted context omitted.

It's difficult for me to parse what exactly your argument is. Facebook built a system to ingest third party data. Whether you feel that such technology should exist to ingest data and serve ads is, respectfully, completely irrelevant. Facebook requires any entity (e.g. the Flo app) to gather consent from their users to send user data into the ingestion pipeline per the terms of their SDK. The Flo app, in a phenomenal…

So let's consider the possibilities: #1. Facebook did everything they could to evaluate Flo as a company and the data they were receiving, but they simply had no way to tell that the data was illegally acquired and privacy-invading. #2. Facebook had inadequate mechanisms for evaluating their partners, and that while they could have caught this problem they failed to do so, and therefore Facebook was negligent. #3. Fa…

No one is arguing that FB has not engaged in egregious and illegal behavior in the past. What pc86 and I are trying to explain is that in this instance, based on the details of the court docs, Facebook did not make a conscious decision to process this data. It just did. Because this data, combined with the billion+ data points that Facebook receives every single second, was sent to Facebook with the label that it was "consented and non-sensitive health data" when it most certainly was not consented and very sensitive health data. But this is the fault of Flo. Not Facebook.

You could argue that Facebook should be more explicit in asking developers to self-certify and label their data correctly, or not send it at all. You could argue that Facebook should bolster their signal detection when it receives data from a new apps for the first time. But to argue that a human at Facebook blindly built a system to ingest data illegally without any attempt to prevent it is a flawed argument, as there are many controls, many disclosures, and (I'm sure) many internal teams and systems designed exactly for the purpose of determining whether the data they receive is has the appropriate consents (which it did, that Flo sent to them). This case is very squarely #1 in your example and maybe a bit of #2.

Re: Meta accessed women's health data from Flo app without consent, says court

#145

Post by changoplatanero » Thu, Aug 14, 2025, 3:58 PM UTC

qwertylicious wrote: post #133

decisionsmatter wrote: post #132

Earlier quoted context omitted.

It's difficult for me to parse what exactly your argument is. Facebook built a system to ingest third party data. Whether you feel that such technology should exist to ingest data and serve ads is, respectfully, completely irrelevant. Facebook requires any entity (e.g. the Flo app) to gather consent from their users to send user data into the ingestion pipeline per the terms of their SDK. The Flo app, in a phenomenal…

So let's consider the possibilities: #1. Facebook did everything they could to evaluate Flo as a company and the data they were receiving, but they simply had no way to tell that the data was illegally acquired and privacy-invading. #2. Facebook had inadequate mechanisms for evaluating their partners, and that while they could have caught this problem they failed to do so, and therefore Facebook was negligent. #3. Fa…

"doing everything they could" is quite the high standard. Personally, I would only hold them to the standard of making a reasonable effort.

Re: Meta accessed women's health data from Flo app without consent, says court

#146

Post by ramonga » Thu, Aug 14, 2025, 4:00 PM UTC

changoplatanero wrote: post #114

prasadjoglekar wrote: post #95

Earlier quoted context omitted.

Flo shouldn't have sent those data to FB. That's true. Which is why they settled. But FB, having received this info proceeded to use it and mix it with other signals it gets. Which is what the complaint against FB alleged.

I wish there was information about who at Facebook received this information and “used” it. I suspect it was mixed in with 9 million other sources of information and no human at Facebook was even aware it was there.

I would expect an app with 150 million active users to trigger some kind of compliance review in Meta

Re: Meta accessed women's health data from Flo app without consent, says court

#147

Post by Capricorn2481 » Thu, Aug 14, 2025, 4:01 PM UTC

changoplatanero wrote: post #114

prasadjoglekar wrote: post #95

Earlier quoted context omitted.

Flo shouldn't have sent those data to FB. That's true. Which is why they settled. But FB, having received this info proceeded to use it and mix it with other signals it gets. Which is what the complaint against FB alleged.

I wish there was information about who at Facebook received this information and “used” it. I suspect it was mixed in with 9 million other sources of information and no human at Facebook was even aware it was there.

This is the argument companies use for having shitty customer support. "Our business is too big for our small support team."

Why are you scaling up a business that can't refrain from fucking over customers?

Re: Meta accessed women's health data from Flo app without consent, says court

#148

Post by myaccountonhn » Thu, Aug 14, 2025, 4:02 PM UTC

qwertylicious wrote: post #128

pc86 wrote: post #127

Earlier quoted context omitted.

What does the system look like where a human being individually verifies every pieces of data fed into an advertising system? Even taking the human out of the loop, how do you verify the "legality" of one piece of data vs. another coming from the same publisher? None of your example have anything to do with the thing we're talking about, and are just meant to inflame emotional opinions rather than engender rational d…

That's not my problem to solve? If Facebook chooses to build a system that can ingest massive amounts of third party data, and cannot simultaneously develop a system to vet that data to determine if it's been illegally acquired, then they shouldn't build that system . You're running under the assumption that the technology must exist, and therefore we must live with the consequences. I don't accept that premise. Edit…

I often think about what having accountability in tech would entail. These big tech companies only work because they can neglect support and any kind of oversight.

In my ideal world, platforms and their moderation would be more localized, so that individuals would have more power to influence it and also hold it accountable.

Re: Meta accessed women's health data from Flo app without consent, says court

#149

Post by AtlasBarfed » Thu, Aug 14, 2025, 4:04 PM UTC

gruez wrote: post #131

jlarocco wrote: post #117

Earlier quoted context omitted.

That's only the first part of the story, though. Facebook isn't guilty because Flo sent medical data through their SDK. If they were just storing it or operating on it for Flo, then the case probably would have ended differently. Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. They knew, or should have known, that they needed t…

>Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. What exactly did this entail? I haven't read all the court documents, but at least in the initial/amended complaint the plaintiffs didn't make this argument, probably because it's totally irrelevant to the charge of whether they "intentionally eavesdropped" or not. Either they we…

[flagged]

Re: Meta accessed women's health data from Flo app without consent, says court

#150

Post by dm319 » Thu, Aug 14, 2025, 4:07 PM UTC

SoftTalker wrote: post #136

thisisit wrote: post #98

5 years ago I was researching the iOS app ecosystem. As part of that exercise I was looking at the potential revenue figures for some free apps. One developer had a free app to track some child health data. It was long time ago so I don't remember the exact data being collected. But when asked about the economics of his free app, the developer felt confident about a big pay day. As per him the app's worth was in the…

I don't understand why anyone would let these psychopathic corporations have any of their personal or health data. Why would you use an app that tracked health data, or use a wearable device from any of these companies that did that. You have to assume, based on their past behavior, that they are logging every detail and it's going to be sold and saved in perpetuity.

I guess because people want to track some things about their health, and people provide good pieces of software with a simple UI to do it, and this is more useful that, say, writing it down in a notebook, or in a text file or notes app.

I guess also people feel that corporations _shouldn't_ be allowed to do bad things with it.

Sadly, we already know with experience in the last 20 years, that many people don't care about what information they give to large corporations.

However, I do see more and more people increasingly concerned about their data. They are still mainly people involved in tech or related disciplines, but this is how things start.