Twilio Class Action: Bender Case, TurboTax Arbitration, and Flowers Settlement

If you’re looking into a Twilio class action lawsuit, here’s where things stand: the most recent case, which accused Twilio of secretly collecting app users’ data through its Segment software kit, was pushed out of court and into private arbitration in August 2025. An older class action over recorded phone calls and text messages settled for $10 million back in 2019 and has already paid class members. A separate mass arbitration tied to TurboTax users is closed to new claims.

The Segment SDK Case: Bender v. Twilio

Noah Bender filed the complaint on August 8, 2024 in the U.S. District Court for the Northern District of California, case number 3:24-cv-04914.¹ The lawsuit targeted Twilio’s Segment product, a customer data platform that app developers embed into their apps to collect user interaction data.

According to the complaint, the Segment SDK worked as a “secret backdoor” that pulled real-time in-app activity out of apps without users knowing. The data allegedly included keystrokes, button presses, search terms, page views, names, email addresses, and device fingerprinting information like phone model, operating system version, and mobile advertising identifiers.² Bender claimed Twilio bundled this information into “comprehensive digital dossiers” that could be shared with advertising networks like Google and Facebook.¹

The complaint used the meditation and mental health app Calm as its lead example, arguing that because Calm users open the app to manage stress, anxiety, or depression, the collected data could reveal sensitive mental health information. Twilio, the complaint said, never told users this was happening and offered no way to opt in or out.³

The suit raised claims under the federal Wiretap Act (18 U.S.C. § 2511), the California Wiretap Act (Cal. Penal Code § 631), and the California Comprehensive Computer Data Access and Fraud Act.¹ The proposed class covered everyone who downloaded and used a mobile app containing the Twilio Segment SDK where the app did not disclose Twilio’s role in its privacy notices.³

Why the Case Is No Longer in Court

On August 11, 2025, U.S. District Judge Araceli Martínez-Olguín granted Twilio’s motion to compel arbitration and stayed the case.⁴ The case was terminated on August 29, 2025.⁵

The ruling turned on an arbitration clause in Calm’s terms of service. Although Twilio was not a party to that agreement, the court held that Twilio could enforce the clause under equitable estoppel. Judge Martínez-Olguín found that Bender’s claims were “intimately founded in and intertwined with” Calm’s terms and privacy policy, because proving unauthorized data access required addressing the consent framework Calm had set out for sharing user data with third-party service providers like Twilio.⁴

The court rejected any third-party beneficiary theory, noting Calm’s terms expressly disclaimed one. The ruling rested instead on the principle that a plaintiff cannot invoke an agreement when it supports his claims while disavowing the arbitration clause in the same agreement.⁴ The practical effect: there is no open class action in court for Segment SDK users to join. Any individual pursuit of these claims would have to proceed through arbitration.

TurboTax Mass Arbitration Against Twilio

The law firm Labaton Keller Sucharow pursued mass arbitration claims against Twilio on behalf of TurboTax users, alleging that TurboTax used Twilio’s tracking SDKs to collect and share sensitive personal information without user consent. The claims were brought under federal and state privacy and consumer protection laws, with each claim handled individually by a neutral arbitrator rather than as a class.⁶

The firm said eligible users — those who had a TurboTax account within the three years preceding the filing — could be entitled to up to $2,500 per claim. As of 2026, the matter is closed to new clients, and the proceedings are private and confidential.⁶

The 2019 Call-Recording Settlement: Flowers v. Twilio

The earliest major class action against the company was Flowers, et al. v. Twilio, Inc., filed February 18, 2016. It alleged that Twilio recorded phone calls and text messages on behalf of its customers — including Handy Technologies, Homejoy, and Trulia — without consent from all parties, in violation of the California Invasion of Privacy Act.⁷

The Alameda County Superior Court granted final approval of a $10 million settlement in June 2019. Twilio also agreed to revise its Terms of Service and Acceptable Use Policy, notify existing customers of the changes, and provide guidance on complying with call-recording laws.⁷

Payments went out on a pro-rata basis. Text-message recipients received one share, while anyone with at least one recorded phone call received eight shares. Estimated payouts came to roughly $8.04 for text-only class members and about $64.30 for those whose calls were recorded. Initial checks were mailed in September 2019, and a second round was reissued in March 2020 for recipients who did not cash the originals.⁸ The claim window is long closed.

Parallel Lawsuits Against Other SDK Providers

Twilio was not the only company Edelson PC sued over SDK data collection. On the same day the Bender complaint was filed, the firm brought parallel class actions in the Northern District of California against two other SDK providers.⁹

Woods v. Verve Group Inc. alleged Verve’s PubNative SDK used “identity graphs” linking device identifiers to personal data. The proposed class was limited to California residents.
Atkins v. Amplitude Inc. alleged unauthorized data collection through Amplitude’s SDK, which was reportedly integrated into more than 40,000 apps, including DoorDash.

These cases are relevant context if your data was collected through a different SDK, but they are separate lawsuits from the Twilio action and do not cover Twilio users.

Twilio Data Breaches Are a Separate Matter

Twilio has also had publicized security incidents that are distinct from the class actions above. In August 2022, SMS phishing attacks on Twilio employees led to a breach affecting data for about 125 Twilio customers. Downstream, the encrypted messaging service Signal disclosed that roughly 1,900 of its users were exposed because Signal uses Twilio for phone number verification.¹⁰¹¹

In July 2024, Twilio confirmed that unauthorized actors accessed data belonging to roughly 33.4 million users of its Authy multifactor authentication app. The breach happened because an API endpoint was not authenticated, allowing attackers to feed in phone numbers and pull back account information. The cybercrime group ShinyHunters leaked the data in late June 2024, and a law firm announced it was investigating potential class action claims over that breach, though no formal regulatory action has been publicly reported.¹² Any filed class action tied to the Authy breach is separate from the Segment SDK and call-recording cases described above.

1
ClassAction.org. Bender v. Twilio Inc. Complaint
2
The Register. Twilio’s Segment SDK Challenged With Wiretapping Claim
3
ClassAction.org. Privacy Lawsuits Allege Twilio, Verve, Amplitude Software Dev Kits Steal Consumers’ Data
4
Justia. Bender v. Twilio Inc., Order Granting Motion to Compel Arbitration
5
PACER Monitor. Bender v. Twilio Inc.
6
Labaton Keller Sucharow. Twilio Mass Arbitration
7
DHKL Law. Flowers v. Twilio Inc.
8
Ben Edelman. Class Action Settlement: Phone Calls and Text Messages Recorded by Twilio
9
The Recorder. Edelson Files Wave of Digital Privacy Class Actions Against Tech Companies Over Geolocation Data Collection
10
Ars Technica. Phishers Breach Twilio and Target Cloudflare Using Workers’ Home Numbers
11
Signal. Twilio Incident: What Signal Users Need to Know
12
PR Newswire. Privacy Alert: Twilio Under Investigation for Data Breach of Over 33 Million Authy MFA Users