When Privacy Policies Are Just Pretty Lies: Lessons from the Flo Health Case
In 2019, the Wall Street Journal dropped a bombshell.
Flo Health the company behind the world’s most downloaded period and ovulation tracking app had been quietly sharing millions of users’ most intimate health details with advertising giants like Facebook and Google. This, despite repeated promises in its privacy policy that such data would never be shared without explicit consent.
The facts are chilling. To use the Flo App, users entered not just their names and emails, but deeply personal information: sexual activity, menstrual cycles, contraception methods, reproductive health conditions, moods, and more. The app promised this data was safe, private, and strictly for the user’s benefit.
In reality, between 2016 and 2019, Flo Health contracted with dozens of third-party firms through standard SDK (Software Development Kit) integrations that were allowed to use this data for their own purposes, including targeted advertising. The terms Flo signed with these third parties directly contradicted its own privacy promises.
The U.S. Federal Trade Commission investigated and charged Flo Health with deceptive practices. A class action suit followed (Frasco v. Flo Health). A jury later found that Meta (Facebook) had violated privacy laws by using this data for advertising.
The Mirage of “Artificial Privacy Policies”
Cases like Flo Health’s expose a growing corporate trend I call Artificial Privacy Policies beautifully written, lawyer-approved promises that look strong on a website but are not embedded in the organisation’s actual systems, processes, or procedures.
These policies:
a) Win user trust at face value.
b) Create a veneer of compliance.
c) Are undermined by back-end practices that leak, misuse, or over-share data.
For Flo Health, the gap between policy on paper and practice in reality wasn’t just a PR problem it became a legal, financial, and reputational disaster.
Why Organisations Should Pay Attention
If you collect personal data especially sensitive categories like health data, the Flo Health case should make you pause. The key takeaways:
- A policy is only as good as the systems and governance that enforce it.
- SDKs and third-party tools are part of your privacy ecosystem, if you can’t control their data practices, you can’t honestly promise users you will.
- Contracts must reflect your public commitments,
- Transparency is non-negotiable..
The Fix: Privacy by Design & Data Governance
The antidote to Artificial Privacy Policies is a living, breathing Data Privacy Governance Structure, one that aligns your promises with your practices.
That means:
a) Mapping all personal data flows, including SDKs and analytics tools.
b) Vetting and contractually binding vendors to your privacy commitments.
c) Embedding privacy into the design of your products (“Privacy by Design”).
d) Regular audits to ensure your systems match your policies.
Privacy is not static text. It’s a dynamic, ongoing practice that should evolve with technology, regulation, and user expectations.
The Flo Health case is more than a scandal; it’s a cautionary tale for any organisation that believes good marketing copy can replace good governance.
