11 ms·
Meta accessed women's health data from Flo app without consent, says court
- itsalotoffun 1y agoI mean.. there's simply no repercussions for these companies, and only rivers of money on the other side. The law is laughably inept at keeping them in check. The titans of Surveillance Capitalism don't need to obey laws. CFOs line-item-ing provisional legal settlement fees as (minor) COGS. And us digital serfs, we simply have no rights. Dumb f*cks, indeed.
- dkiebd 1y agoUsers gave their data to Flo, and Flo then gave it to Meta. What repercussions do you want for Meta?
- pbiggar 1y agoMeta should never have used them. Deeply unethical behaviour
- NickC25 1y agoYour mistake was expecting ethical behavior from Mark Zuckerberg.
- Etheryte 1y agoBuying stolen goods does not mean they're yours because the seller never had any ownership to begin with. The same applies here, just because there's an extra step in the middle doesn't mean that you have any rights to the data.
- Ekaros 1y agoSome percent of their revenue as fine per case. Only way to scare these companies at this point.
- j33zusjuice 1y agoA significant portion, too, not fractions of a percent. Frankly, I want the fines to bankrupt them. That’s the point. I want their behavior to be punished appropriately. Killing the company is an appropriate response, imo: FB/Meta is a scourge on society.
- potato3732842 1y agoThe line between big business and the state is blurry and the state wants to advance big business as a means to advance itself. Once you understand this everything makes sense, or as much "sense" as it can.
- pbiggar 1y agoMeta truly is the worst company. In almost everything Meta does, it truly makes the most user-hostile decisions, awful decision, every single time. Cambridge Analytica The Rohingya Genocide Suppressing Palestinian content during a genocide Damage to teenage (and adult) mental health Anyway, I mention this because some friends are building a social media alternative to Instagram: https://upscrolled.com https://upscrolled.com, aiming to be pro-user, pro-ethics, and designed for people, not just to make money.
- deleted 1y ago[deleted]
- ivanmontillam 1y agoYour comment started very useful, then it became spam. Great way to lose goodwill.
- Chris2048 1y agoIs posting a self-made alternative to meta not consistent with the rest of the post, even actively promoting the vibe?
- ivanmontillam 1y agoA Show HN post would have been more appropriate; this seemed to me opportunistic at best.
- kubb 1y agoWhenever you think of a court versus Facebook, imagine one of these mini mice trying to stick it to a polar bear. Or a goblin versus a dragon, or a fly versus an elephant. These companies are for the most part effectively outside of the law. The only time they feel pressure is when they can lose market share, and there's risk of their platform being blocked in a jurisdiction. That's it.
- FirmwareBurner 1y ago[flagged]
- kubb 1y agoFunny, but this kinda implies that some person designed this way. It's a resultant sum of small vectors, with corporate lobbying playing a significant role. Corporate lobbying systemically can't do anything else than try to increase profits, which usually means less regulation. Clean slate design would require a system collapse.
- exe34 1y ago> Funny, but this kinda implies that some person designed this way How do you get to that implication? I'm missing a step or two I think...
- kubb 1y agoFrom "do you want X? this is how you get X". This invokes an image of talking to a person who decided the how, because they can be questioned on whether they want the X.
- moolcool 1y agoWhen Facebook releases an AI Model for free: "Based Facebook. Zuckerberg is a genius visionary" When Facebook does something unforgivable: "It's a systemic problem. Zuck is just a smol bean"
- everdrive 1y agoDon't use apps. It's a simple as that. 95% of the time they are not worth the incredible privacy invasion they impose on users.
- zahlman 1y agoEven beyond that, I expect software developers to prove to me that an Internet connection is necessary for whatever it is they're trying to do.
- bell-cot 1y agoTrue. Unfortunately, users are all humans - with miserably predictable response patterns to "Look at this Free New Shiny Thing you could have!" pitches, and the ruthless business models behind them.
- setsewerd 1y agoPardon my ignorance, but can't you just solve this by disabling location permissions, etc for a given app?
- throwaway290 1y agoWhat they do then is create an app where location is necessary, make that app spin up a localhost server, then add js to facebook and every site with a like button to phone that localhost and basically deanon everyone.
- cnity 1y agoHow could this possibly work without port forwarding?
- mzajc 1y ago2 months ago: https://news.ycombinator.com/item?id=44169115 https://news.ycombinator.com/item?id=44169115. Of course Facebook's JS won't add itself to websites, so half of the blame goes to webmasters willingly sending malware to browsers.
- princevegeta89 1y agoIt's very rare to see any privacy related news without Meta being involved in the story.
- inetknght 1y agoGoogle, Microsoft, and Amazon all like it that way.
- comrade1234 1y agoI don't think many of you read the article... the Flo app is the one in the wrong here, not meta. The app people were sending user data to meta with no restrictions on its use. Despite however the court ruled.
- PunchTornado 1y ago> The app people were sending user data to meta with no restrictions on its use And then meta accessed it. So unless you put restrictions on data, meta is going to access it. Don't you think it should be the other way around? Meta to ask for permission? Then we wouldn't have this sort of thing.
- gruez 1y agoDo you think AWS should ask for permission before processing some random B2C app user's data?
- paintbox 1y agoFrom the article: "The jury ruled that Meta intentionally “eavesdropped on and/or recorded their conversations by using an electronic device,” and that it did so without consent." If AWS wanted to eavesdrop and/or record conversations of some random B2C app user, for sure they would need to ask for permission.
- gruez 1y agoIf you read the court documents, "eavesdropped on and/or recorded" basically meant "flo used facebook's SDK to sent analytics events to facebook". It's not like they were MITMing connections to flo's servers. https://www.courtlistener.com/docket/55370837/1/frasco-v-flo-health-inc/ https://www.courtlistener.com/docket/55370837/1/frasco-v-flo...
- Spivak 1y agoI think it a distinction without a difference. To make it more obvious imagine it was one of those AI assistant devices that records your conversations so you can recall them later. Plainly obvious that accessing this data for any purpose other than servicing user requests is morally equivalent to easedropping on a person's conversations in the most traditional sense. If the company sends your conversation data to Facebook that's bad and certainly a privacy violation but at this point nothing has actually been done with the data yet. Then Facebook accesses the data and folds it into their advertising signals; they have now actually looked at the data and acted on the information within. And that to me is easedropping.
- bell-cot 1y agoFor those disinclined to read the article... > [...] users, regularly answered highly intimate questions. These ranged from the timing and comfort level of menstrual cycles, through to mood swings and preferred birth control methods, and their level of satisfaction with their sex life and romantic relationships. The app even asked when users had engaged in sexual activity and whether they were trying to get pregnant. > [...] 150 million people were using the app, according to court documents. Flo had promised them that they could trust it. > Flo Health shared that intimate data with companies including Facebook and Google, along with mobile marketing firm AppsFlyer, and Yahoo!-owned mobile analytics platform Flurry. Whenever someone opened the app, it would be logged. Every interaction inside the app was also logged, and this data was shared. > "[...] the terms of service governing Flo Health’s agreement with these third parties allowed them to use the data for their own purposes, completely unrelated to services provided in connection with the App,” Bashing on Facebook/Meta might give a quick dopamine hit, but they really aren't special here. The victims' data was routinely sold, en mass, per de facto industry practices. Victims should assume that hundreds of orgs, all over the world, now have copies of it. Ditto any government or criminal groups which thought it could be useful. :(
- cindyllm 1y ago[dead]
- chubs 1y agoThis is really disappointing. I used to have a fertility tracking app on the iOS App Store, zero data sharing, all local thus private. But, people don’t want to pay $1 for an app, and I can’t afford the marketing drive that an investor-backed company such as this has… and so we end up with situations like this. Pity :(
- zahlman 1y agoStories like this one can be the basis for effective marketing. We need to normalize paying $1 (or more, where warranted) for apps that provide value in the form of not doing the things that allow the $0 ones to be $0.
- pllbnk 1y agoEverybody misses the key information here - it’s a Belarusian app. CEO and CTO are Belarusian (probably there are more C-level people who are Belarusian or Russian). Not only are users giving up their private information but they are doing so to the malevolent (by definition) regimes. When the Western app says they don’t sell or give out private information, you can be suspicious but still somewhat trustful. When a dictator-ruled country’s app does so, you can be certain every character you type in there is logged and processed by the government.
- ramanh 1y agoThe company cut all ties with Belarus more than three years ago, and all employees relocated to Europe.
- graemep 1y agoWhere in Europe? Belarus is in Europe, and so is much of Russia (the largest European country). Plenty of variation in the rest of Europe. What do you mean by cut all ties? The owners and management have no assets in Belarus or ties to the country?
- ramanh 1y agoyou can open "contact us" page on their website.
- graemep 1y agoNot sure how that helps answer my question. A list of contact addresses is not a list of all locations, or all employees or all a contractors or all shareholders or all financial interests. The one thing the site tells me is that it is operated by two separate companies - Flo Inc and Flo health UK. The directors of Flo Health Limited live in the UK and Cypress, two are Belarusian nationals and one Russian.
- pllbnk 1y ago[flagged]
- gruez 1y agoAs much as I don't like facebook as a company, I think the jury reached the wrong decision here. If you read the complaint[1], "eavesdropped on and/or recorded their conversations by using an electronic device" basically amounted to "flo using facebook's sdk and sending custom events to it" (page 12, point 49). I agree that flo should be raked over the coals for sending this information to facebook in the first place, but ruling that facebook "intentionally eavesdropped" (exact wording from the jury verdict) makes zero sense. So far as I can tell, flo sent facebook menstrual data without facebook soliciting it, and facebook specifically has a policy against sending medical/sensitive information using its SDK[2]. Suing facebook makes as much sense as suing google because it turned out a doctor was using google drive to store patient records. [1] https://www.courtlistener.com/docket/55370837/1/frasco-v-flo-health-inc/ https://www.courtlistener.com/docket/55370837/1/frasco-v-flo... [2] https://storage.courtlistener.com/recap/gov.uscourts.cand.372884/gov.uscourts.cand.372884.625.1.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.37... page 6, line 1
- HeavyStorm 1y agoThat's why in these cases you'd prefer a judgment without a jury. Technical cases like this will always confuse jurors, who can't be expected to understand details about sdk, data sharing, APIs etc. On the other hand, in a number of highprofile tech cases, you can see judges learning and discussing engineering in a deeper level.
- echoangle 1y agoIs it easier for the prosecution to make the jury think Facebook is guilty or for Facebook to make the jury think they are not? I don’t see why one would be easier, except if the jury would be prejudiced against Facebook already. Or is it just luck who the jury sides with?
- azemetre 1y agoI mean it totally depends what your views on democracy are. Juries are one of the few, likely only, practices taken from Ancient Athenian democracy which was truly led by the people. The fact that juries still work this way is a testament to the practice. With this in mind, I personally believe groups will always come to better conclusions than individuals. Being tried by 12 instead of 1 means more diversity of thought and opinion.
- josefritzishere 1y agoZuckerberg does not seem to repect the law. There really should be criminal charges by now.
- aboringusername 1y agoAnother aspect of this is why Apple/Google let this happen in the first place. GrapheneOS is the only mobile OS I can think of that lets you disable networking on an per-app level. Why does a period tracking app need to send data to meta (why does it even need networking access at all)? Why is there no affordance of user-level choice/control that allows users to explicitly see the exact packets of data being sent off device? It would be trival for apps to have to present a list of allowed IPs/hostnames, and users to consent/not otherwise the app is not allowed on the play store. Simply put, it should not be possible to simply send arbitrary data without some sort of user consent/control, and to me, this is where the GDPR has utterly failed. I hope one day users are given a legal right to control what data is sent off their device to a remote server with serious consequences for non-compliance.
- toast0 1y ago> Why does a period tracking app need to send data to meta (why does it even need networking access at all)? In case you want to sync between multiple devices, networking is the least hassle way. > Why is there no affordance of user-level choice/control that allows users to explicitly see the exact packets of data being sent off device? It would be trival for apps to have to present a list of allowed IPs/hostnames, and users to consent/not otherwise the app is not allowed on the play store. I don't know that it ends up being useful, because wherever the data is sent to can also send the data further on.
- 1vuio0pswjnm7 1y ago"GrapheneOS is the only mobile OS I can think of that lets you disable networking on a per-app level." Don't need to "root" mobile phone and install GrapheneOS. Netguard app blocks connections on a per-app basis. It generally works. But having to take these measures, i.e., installing GrapheneOS or Netguard (plus Nebulo, etc.), is why "mobile OS" all suck. People call them "corporate OS" because the OS is not under the control of the computer owner, it is controlled by a corporation. Even GrapheneOS depends on Google's Android OS, relies on Google hardware, makes default remote connections to a mothership that happen without any user input (just like any corporate OS), and uses a Chromium-based default browser. If one is concerned about being tracked, perhaps it is best to avoid these corporate, mobile OS. It is easy to control remote connections on a non-corporate, non-mobile OS where the user can compile the OS from source on a modestly resourced computer. The computer user can edit the source and make whatever changes they want. For example, I use one where, after compilation from source, everything is disabled by default (this is not Linux). The user must choose whether to create and enable network interfaces for remote connectivity.
- thrance 1y agoWhy would an app that tracks menstrual cycles need to integrate with the Facebook SDK?? Pure insanity.
- zahlman 1y agoWhy would an app that tracks menstrual cycles need to connect to the Internet at all? TFA mentions asking about quite a few other personal things as well. Is the app trying to do more than just tracking? If they're involved in any kind of diagnosis then I imagine there are further legal liability issues....
- arkwin 1y agoTo any other women in here, check out Drip. https://dripapp.org https://dripapp.org They seem to be the most secure.
- _fat_santa 1y agoMy wife uses Flo though every time I see her open the app and input information the tech side of my brain is quite alarmed. An app like that keeps very very personal information and really highlights for me the need to educate non-technical folks on information security.
- ChrisArchitect 1y agoPreviously: https://news.ycombinator.com/item?id=44763949 https://news.ycombinator.com/item?id=44763949
- thisisit 1y ago5 years ago I was researching the iOS app ecosystem. As part of that exercise I was looking at the potential revenue figures for some free apps. One developer had a free app to track some child health data. It was long time ago so I don't remember the exact data being collected. But when asked about the economics of his free app, the developer felt confident about a big pay day. As per him the app's worth was in the data being collected. I don't know what happened to the app but it seemed that app developers know what they are doing when they invade privacy of their users - under the guise of "free" app. After that I became very conscious about disabling as many permissions as possible and especially not using apps to store any personal data, especially health data.
- SoftTalker 1y agoI don't understand why anyone would let these psychopathic corporations have any of their personal or health data. Why would you use an app that tracked health data, or use a wearable device from any of these companies that did that. You have to assume, based on their past behavior, that they are logging every detail and it's going to be sold and saved in perpetuity.
- dm319 1y agoI guess because people want to track some things about their health, and people provide good pieces of software with a simple UI to do it, and this is more useful that, say, writing it down in a notebook, or in a text file or notes app. I guess also people feel that corporations _shouldn't_ be allowed to do bad things with it. Sadly, we already know with experience in the last 20 years, that many people don't care about what information they give to large corporations. However, I do see more and more people increasingly concerned about their data. They are still mainly people involved in tech or related disciplines, but this is how things start.
- doctorpangloss 1y agoWell maybe one reason this is hard to understand is that the plaintiff in this case hasn’t been harmed in any way. I suppose you could also argue, why would anyone go outside, there are literally satellites in space that image your every move in control of psychopathic corporations, logging every detail which they sell and save in perpetuity.
- maxehmookau 1y agoNo ifs, no buts. Stuff like this deserves ruinous fines for its executives. Cycle data in the hands of many country's authorities is outright dangerous. If you're storing healthcare data, it should require IN BIG RED LETTERS an explicit opt-in, every single time, when that data leaves your device.
- oxqbldpxo 1y agoOh boy, what's Mark up to these days.
- 12_throw_away 1y agoThanks for asking! Also on the front page today: https://news.ycombinator.com/item?id=44898934 https://news.ycombinator.com/item?id=44898934 From that article: “It is acceptable to engage a child in conversations that are romantic or sensual,” according to Meta’s “GenAI: Content Risk Standards. [...] The document seen by Reuters, which exceeds 200 pages, provides examples of “acceptable” chatbot dialogue during romantic role play with a minor. They include: “I take your hand, guiding you to the bed” and “our bodies entwined, I cherish every moment, every touch, every kiss.”
- wnevets 1y agoCan someone explain me why this shouldn't be illegal?
- 12_throw_away 1y agoWell, my steelman argument against regulating this repulsive shit: every time a government says it's going to regulate infotech to protect children, it almost invariably ends up having a chilling effect that ends up restricting children's access to high quality educational and medical information. Even if a law is well-intentioned and equitable, its enforcement never is. In this case, I'm confident that whoever wrote this section, just checking their hard drive should be sufficient to send them to jail.
- wnevets 1y agoIts already illegal to distribute pornographic material to children tho. Why shouldn't this be considered that?
- rchaud 1y agoWhat features does this app have that couldn't be duplicated in an Excel file (or LibreCalc or MacOS Numbers)?
- neilv 1y ago> Yet between 2016 and 2019 Flo Health shared that intimate data with companies including Facebook and Google, along with mobile marketing firm AppsFlyer, and Yahoo!-owned mobile analytics platform Flurry. [...] Every interaction inside the app was also logged, and this data was shared. Proposed resolution: 1. Wipe out Flo with civil damages, and also wipe out the C-suite and others at the company personally. 2. Prison for Flo's C-suite, and everyone else at Flo who knew what was going on and didn't stop it, or who was grossly negligent when they knew they were handling sensitive info. 3. Investigate what Flo's board and investors knew, for possible criminal and civil liability. 4. Investigate what Flo's data-sharing partner companies knew, and what was done with the data, for possible criminal and civil liability. Tech industry gold rushes have naturally attracted much of the shittiest of society. And the Overton window within the field has shifted so much due to this, with some dishonest and underhanded practices as SOP, that even decent people have lost references for what's right and wrong. So the tech industry is going to keep doing every greedy, underhanded, and reckless thing they can, until society starts holding them accountable. That doesn't mean regulatory handslaps; that means predatory sociopaths rotting in prison, and VCs and LPs wiped out, as corporate veils of companies that the VCs knew were underhanded are pierced.
- shrubble 1y agoNothing will change until VPs start going to jail. Unlikely I know...
- tracker1 1y agoAnd this is why I have a general no-apps policy on my phone... Or at least, I have a minimal number of apps on my phone. While this doesn't prevent a given website/webapp from sharing similar information, I just feel slightly better not giving hard device access. Along a similar vein, I cannot believe after the stunts LinkedIn pulled, that they're even allowed on app stores at all.
- heyoleftycunts 1y ago[flagged]