The Natural Cycles lawsuit is a proposed class action filed on December 4, 2025, in the U.S. District Court for the Northern District of California, accusing the FDA-cleared fertility app of embedding hidden third-party tracking tools that transmitted users’ pregnancy status, menstrual cycle details, sexual activity, and other reproductive health information to Google, TikTok, Mixpanel, and AddShoppers without consent.1Top Class Actions. Natural Cycles Class Action Claims App Shared Reproductive Health Data Without User Consent The case is captioned S.A., et al. v. NaturalCycles USA Corp., et al., Case No. 3:25-cv-10421-WHO, and names both the U.S. subsidiary and the Stockholm-based parent, NaturalCycles Nordic AB.
Four plaintiffs, identified by their initials A.S., M.F., S.A., and S.S., brought the suit through the firm Parasmo Lieberman Law.2PACER Monitor. S.A. et al v. NaturalCycles USA Corporation The case is pending; no settlement has been reached or proposed.3Truth in Advertising (TINA.org). Natural Cycles Class Action
What the Plaintiffs Say Was Shared
The complaint’s central claim is a gap between what Natural Cycles promised users and what its app allegedly did behind the scenes. The company marketed itself as a confidential, FDA-cleared medical device. At the same time, according to the plaintiffs, it embedded tracking technologies from four third parties that captured sensitive health data in real time and sent it out for advertising and analytics use.1Top Class Actions. Natural Cycles Class Action Claims App Shared Reproductive Health Data Without User Consent
The categories of data the lawsuit says were shared without user consent include:
- Pregnancy status
- Menstrual cycle details
- Fertility goals
- Sexual activity
- Contraceptive use
- Medical conditions
The four third parties named as recipients are Mixpanel, AddShoppers, Google, and TikTok.
The California Laws Behind the Claims
The plaintiffs are suing under two California statutes: the California Confidentiality of Medical Information Act (CMIA) and the California Invasion of Privacy Act (CIPA).1Top Class Actions. Natural Cycles Class Action Claims App Shared Reproductive Health Data Without User Consent Both statutes carry real financial teeth, which is why they anchor a growing wave of health-app cases.
CIPA started life in the 1960s as a wiretapping law. In recent years, plaintiffs have used it to argue that cookies, tracking pixels, and embedded software development kits (SDKs) amount to illegal surveillance of electronic communications when they operate without adequate consent. It requires all-party consent and carries a penalty of $5,000 per violation, or triple the actual damages.
The CMIA reaches any entity in possession of medical information. California law specifically treats businesses that offer software designed to maintain medical data as “providers of health care” subject to the act. Penalties run from $1,000 per negligent violation up to $250,000 for willful disclosures. For an app reporting more than six million users, the potential exposure is substantial.4Natural Cycles. About Natural Cycles
The plaintiffs are seeking class certification, damages, legal fees, and a jury trial.
Why HIPAA Isn’t the Tool Here
Users often assume federal medical privacy law protects everything a health app collects. It doesn’t. Most period-tracking and fertility apps, Natural Cycles included, are not covered by HIPAA because they are not traditional “covered entities” like hospitals or insurers. That gap is why state laws such as California’s CMIA and CIPA, and Washington’s My Health My Data Act, have become the primary sources of legal accountability for reproductive health apps.5Washington State Nursing Care Quality Assurance Commission. My Health My Data FAQ
Who Can Join and How
Two separate legal tracks are moving against Natural Cycles at the same time, and eligibility for each is different.
The Class Action
The California federal case seeks class certification but has not yet been certified. If the court certifies a class, affected users would typically be notified through court-approved procedures and given the option to participate or opt out. Nothing needs to be filed by users at this stage.
The Mass Arbitration
Attorneys working with ClassAction.org are separately organizing a mass arbitration against Natural Cycles targeting suspected violations of the Federal Wiretap Act and other state and federal privacy laws.6ClassAction.org. Health Data Privacy Security Wiretapping Mass arbitration is a workaround for the class action waivers that health apps typically bury in their terms of service: instead of one consolidated case, hundreds or thousands of individuals file concurrent individual claims.
To be considered for the mass arbitration, the attorneys are looking for people who:
- Are 18 or older
- Hold a Natural Cycles account
- Provided health or medical information to the app within the past two years
The investigation page says consumers could potentially recover between $100 and thousands of dollars per violation, with no guarantees.6ClassAction.org. Health Data Privacy Security Wiretapping As of mid-2026, arbitration demands do not appear to have been formally filed, and claimant numbers have not been publicly disclosed.
What Natural Cycles Says
Natural Cycles has addressed the lawsuit on its help center, calling it a “privately initiated legal filing” rather than a government investigation or a data breach. The company describes the allegations as a “misunderstanding” of its operations and says they are “inconsistent with our privacy practices.”7Natural Cycles. How Does Natural Cycles Protect My Data The company disputes the framing of its Mixpanel relationship specifically, stating that data shared with the service is not used for advertising purposes.
Natural Cycles also pointed out that roughly 2,000 CIPA cases have been filed in California over the past two-plus years, positioning the suit as part of a wider litigation wave. The company said the case has not altered its operating procedures or security commitments and that it is “fully prepared to address this matter through the appropriate legal channels.”7Natural Cycles. How Does Natural Cycles Protect My Data
The privacy policy, updated in August 2025, states that Natural Cycles does not sell personal information in the “traditional sense” for monetary consideration but acknowledges that disclosures to advertising partners for targeted advertising may qualify as a “sale” or “sharing” under certain U.S. privacy laws. The policy explicitly says the company does not sell or share “fertility status data, period data, sexual activity data, medical condition data, or logged symptom or pregnancy data.”8Natural Cycles. Privacy Policy Whether the alleged tracking-tool transmissions fall outside that carve-out is one of the central disputes in the case.
Why the Flo Health Verdict Matters Here
The Natural Cycles suit follows a template that has already produced a landmark verdict against a similar app. In January 2021, the Federal Trade Commission settled with Flo Health over allegations that it shared sensitive user health data, including pregnancy status and menstrual information, with Facebook, Google, and other analytics providers despite promising confidentiality.9FTC. In the Matter of Flo Health, Inc. That settlement required Flo to notify affected users, direct third parties to destroy the data, obtain consent going forward, and submit to independent oversight, but did not include monetary fines or an admission of wrongdoing.10MobiHealthNews. Fertility App Flo Health Settles FTC Over Sensitive Data Sharing Complaint
The private litigation that followed went much further. In Frasco v. Flo Health Inc., a federal jury in San Francisco found on August 1, 2025, that Meta Platforms violated CIPA by using its SDK embedded in the Flo app to eavesdrop on users’ confidential reproductive health information without consent.11Bloomberg Law. Meta’s Health Privacy Trial Loss Spotlights Power of Wiretapping The jury specifically found that Meta intentionally eavesdropped, that users reasonably expected their menstrual data was not being shared, and that Meta did not have consent. At $5,000 per violation across a class of millions, Meta has acknowledged total damages could reach into the billions.12Courthouse News Service. Meta Violated Privacy Law Jury Says in Menstrual Data Fight Flo Health itself settled with the plaintiffs mid-trial.13Lawdragon. Big Tech on Trial: Jury Finds Meta Liable for Misusing Women Health Data
Both cases allege the same mechanism: third-party tracking tools embedded in a health app that intercept reproductive data and route it to advertising or analytics companies without meaningful consent. Both invoke CIPA. And in May 2025, the Frasco court, in certifying the class, rejected the argument that plaintiffs lacked standing because data was anonymized, holding that the unauthorized interception itself is a concrete injury.6ClassAction.org. Health Data Privacy Security Wiretapping That standing ruling, and the jury’s willingness to award massive statutory damages, shape the terrain on which Natural Cycles will now have to defend itself.