USA: FTC announces finalised settlement with Flo Health over health data disclosure misrepresentations
The Federal Trade Commission ('FTC') announced, on 22 June 2021, that it had finalised a settlement with Flo Health, Inc., the developer of a period and fertility-tracking app used by more than 100 million consumers, which will require Flo Health to obtain the affirmative consent of users of the company's fertility-tracking app before sharing their personal health information with others and to obtain an independent review of their privacy practices. Moreover, the FTC noted that following it's initial complaint in January 2021, the FTC alleged, that despite promising to keep users' health data private, Flo Health shared sensitive health data from millions of users of its Flo Period & Ovulation Tracker app with marketing and analytics firms, including Facebook and Google.
In addition, the FTC outlined as part of the settlement, Flo Health must notify affected users about the disclosure of their health information and instruct any third party that received users' health information to destroy that data. Furthermore, the FTC noted that Flo is prohibited from misrepresenting:
- the purposes for which it (or entities to whom it discloses data) collect, maintain, use, or disclose the data;
- how much consumers can control these data uses;
- its compliance with any privacy, security, or compliance program; and
- how it collects, maintains, uses, discloses, deletes, or protects users' personal information.