
Michael P. Canty
Securities Fraud · Public Funds and Other Large Investors · Trial Teams · Technology and Life Sciences
“This settlement represents an important recovery for investors and reflects the strength of the claims asserted in this case.
Frasco v. Flo Health: A San Francisco Jury Finds Meta Intentionally Recorded Women’s Period and Pregnancy Entries
Michael P. Canty gave the closing argument and questioned Meta’s witnesses in the two-week trial that ended on August 1, 2025 with a federal jury’s finding that Meta had intentionally recorded what women typed into the Flo period-tracking app, and he leads the Labaton Keller Sucharow teams that recovered $210 million from Estée Lauder, $210 million from Fidelity National Information Services, $125 million from Alexion, $90 million from Allstate and $60 million from Okta for the public funds and pension plans that led those cases.
The verdict form Judge James Donato sent out with the jury asked three questions. Did Meta intentionally eavesdrop on or record the women’s communications with the app? Could the women reasonably expect that what they entered about their periods and pregnancies was not being shared? Did Meta have their consent? The jurors answered yes, yes and no, and the no, Canty recalled afterward, carried a bold X. Five women had testified about what they had typed into the app and what they had expected would become of it, from a teenager to a woman in menopause; one of them, Jen Chen, told the jury she had expected the app to keep her information private and felt violated.
Flo Health launched the app in 2016 for tracking periods, ovulation and pregnancy, and its onboarding survey asked women for the date of their last period, the length of their cycle and whether they wanted to become pregnant. Meta supplied its software development kit to app developers at no charge; Flo built the kit into the app, and the app’s custom events carried the survey answers to Meta. The plaintiffs put twelve of those events in front of the jury, among them “R_SELECT_LAST_PERIOD_DATE” and “R_SELECT_CYCLE_LENGTH.” Serge Egelman, a computer scientist at the University of California, Berkeley, had downloaded eighteen versions of the app and testified that the transmission came from Meta’s code rather than Flo’s, and a May 2018 document written by a Meta engineer, Tobias Wooldridge, warned that advertisers could send health information through custom fields. The Federal Trade Commission had already proposed an order against Flo in January 2021 for sending health data, including the fact that a user was pregnant, to Facebook’s and Google’s analytics divisions, AppsFlyer and Flurry after promising its more than 100 million users to keep it private; the order required Flo to tell its users and to instruct the recipients to destroy what they had received.
Carol Villegas, Canty’s co-lead trial counsel, opened the case, and Christian Levis of Lowey Dannenberg examined Egelman. Canty questioned Wooldridge and Steve Satterfield, Meta’s vice president and associate general counsel for privacy. Satterfield began by calling the kits “business tools” and then agreed that Meta benefits from app event data and knew the risk that health information would arrive with it; Wooldridge agreed that Meta could have forbidden Flo to use the kit and had not switched off Flo’s transmissions during the class period. The plaintiffs showed the jury that the first thing Meta did with what arrived was try to match it to a Facebook user it already knew, a match it could make, by their count, 34 million times. Meta’s lawyer, Michele Johnson of Latham & Watkins, told the jurors that Flo, not Facebook, had created the custom events and decided what to send, that a kit was an envelope rather than a recording device, and that Facebook barred developers from sending it health data and required them to get consent. Canty’s closing answered that Meta had collected the data, used it and profited from it: “Ladies and gentlemen of the jury, that is intent.” He asked whether any reasonable person would think she had consented to what happened, challenged Meta to find the words in its data policy that gave it permission to record private app conversations in secret, and told the jury, “You have the opportunity today to tell Meta: you don’t get a pass.” Flo had settled on July 31, the day before the verdict, and Google and Flurry earlier; Meta was the only defendant left in the room.
Five Thousand Dollars a Violation
Donato had certified the class on May 19, 2025: everyone in the United States who entered menstruation or pregnancy information into the Flo app between November 1, 2016 and February 28, 2019, with a California subclass for the claim under the California Invasion of Privacy Act, whose section 632 sets damages at $5,000 a violation. After the verdict Meta moved to decertify the California class, for judgment as a matter of law and for a new trial, and in September 2025 Donato denied all three. The decertification motion was “an improper attempt to seek reconsideration” whose arguments “have virtually nothing to do with the evidence admitted at trial”; the expert evidence showed the kit intercepting users’ entries as they were made, the evidence of intent showed Meta acting “with the purpose or desire of recording a confidential conversation,” and the statute, he wrote, prohibits “a particular result, rather than a particular act.”
At a hearing on September 30, 2025, Canty proposed a claims process in which California class members would attest under penalty of perjury to their residence and to having downloaded Flo in the class period, with a third-party company to validate the data; the plaintiffs estimated about 1.6 million eligible Californians and asked for the statutory $5,000 for each of them. Meta’s lawyer objected to further cross-checks on due process grounds, and Donato called the objections “not grounded in reality” and said, “There’s no reason that gives me undue concern that there will be rampant fraud.” Canty told him the damages should “have teeth.” The settlements with the other defendants came to $59.5 million, $3.5 million from Flurry, $8 million from Flo and $48 million from Google, and on April 16, 2026 Donato said he would grant them preliminary approval for a class the parties estimate at nearly ten million people, with the final hearing set for October 29, 2026. The damages Meta owes remain for the court to fix.
Half-Truths About the Daigou
On a 2019 earnings call, after China moved to end the tax advantage of the daigou, the resellers who buy luxury goods duty-free and sell them at a markup below retail, Estée Lauder’s chief executive, Fabrizio Freda, told analysts, “we were never benefiting from a lot of the daigou business.” In 2020 Hainan, the island province that was a hub of the trade, raised its duty-free spending limits, and, the investors who later sued alleged, Estée Lauder shipped product there in volume to feed the gray market and make up what the pandemic had cost it. In mid-2021 China Duty Free Group, the company’s largest customer, announced that it was severely cracking down on the daigou, and on December 7, 2021 China announced rules, effective January 1, 2022, aimed at them. The company’s quarterly report of February 3, 2022 attributed its travel-retail growth to “continued strength of our brands with the Chinese consumer,” and through 2022 and 2023 Freda and the chief financial officer, Tracey Travis, attributed the slowdown that followed to lockdowns, inventory, traffic and the dollar; in August 2023 Travis called travel retail’s trouble a “timing issue.” On November 1, 2023 the company named changes in government and retailer policies toward unstructured market activity as a primary cause of its decline, and the stock fell $24.36, nearly 19 percent, about $8.7 billion of market value in a day.
The Macomb County Employees’ Retirement System, the Macomb County Retiree Health Care Fund and the Wayne County Employees’ Retirement System were appointed lead plaintiffs on February 20, 2024, with Labaton as lead counsel, and Canty and James Christie traced the product through the travel-retail channel and connected reseller demand to the revenue, inventory, margins and discounting the company reported. The complaint drew on three former employees, a regional marketing director for travel retail in Asia-Pacific, a senior vice president who had overseen demand planning for a sales region, and a senior travel-retail leader for Europe, the Middle East and Africa, and Judge Arun Subramanian credited them, rejecting the defendants’ description of one as “low-level.” On March 31, 2025 he denied the motion to dismiss. The company had touted the reasons for its success “while leaving out the parts of the truth it found inconvenient.” “Sure, daigou are gray, not black, markets,” he wrote, but an omitted source of revenue need not be “fraudulent or otherwise illegal” for its omission to mislead, and “even the allegedly forward-looking statements and opinions at issue are mired in half-truths,” outside the safe harbor because they rested on misstatements of present fact. Freda and Travis, with sales, pricing and tracking data in front of them and a team devoted to the daigou, “had to have known” what the turn to the gray market would mean to investors, and as to the crackdown, “the question wasn’t if but when.” On May 7, 2026 the parties filed a $210 million all-cash settlement, which Estée Lauder, a company that draws about a fifth of its sales from mainland China, said its insurers would partly cover, and on October 14, 2026 Subramanian entered final judgment approving it.
A Synergy Was Any New Worldpay Sale
In 2019 Fidelity National Information Services paid $48 billion for Worldpay, a merchant payment processor, and booked about $38.4 billion of the price, four-fifths of it, as goodwill. It told investors to expect $500 million in revenue synergies over three years, mostly from selling each company’s products to the other’s customers, and over the next three years its executives reported the synergies “ahead of schedule,” “strong cross-selling performance” and no “negative surprises with Worldpay.” The investors who sued, led by the Nebraska Investment Council, the North Carolina Retirement Systems and the North Carolina Supplemental Retirement Plans, alleged on the accounts of eleven former employees of the two companies that the systems were never integrated, that cross-selling was abandoned and cross-sales were “virtually non-existent,” that FIS had counted any new Worldpay sale as a synergy, that Worldpay had lost Sony, its second-largest e-commerce customer at $500,000 a week, and that in the summer of 2022 the company had quietly tried to sell Worldpay for $30 billion, less than two-thirds of what it had paid three years before, and found no buyer. The stock fell $7.56 a share in August 2022 and $22.29 in November. On February 10, 2023 FIS wrote off $17.6 billion of Worldpay goodwill and announced a spinoff, and the stock fell $9.43 more, over 12 percent. A majority stake in Worldpay later went for $11.7 billion, and the rest, in 2025, for $6.6 billion.
Labaton was appointed lead counsel on June 8, 2023, and Canty led the team with Christie and Michael Rogers. On September 30, 2024 Judge Timothy J. Corrigan denied the motion to dismiss in full. “A statement is puffery only if it is immaterial because it is so exaggerated and vague that no reasonable investor would rely on it,” he wrote; three of the challenged statements had been answers to investors’ questions and a fourth a press release raising the synergy estimate because of cross-sales, and the investors had alleged that FIS gave “inaccurate numbers to at least some of the auditors,” that “Fidelity’s executives knew how poorly Worldpay was doing” and that its “goodwill was clearly impaired and yet leaders refused to perform impairment tests.” The class certification motion was filed on March 3, 2025; the parties mediated in October, reached agreement in principle on November 14, 2025 and signed on December 17: $210 million for purchasers of FIS stock between May 7, 2020 and February 10, 2023. At the July 9, 2026 hearing in Jacksonville, Corrigan said he would approve the settlement and the plan of allocation. “Had the settlement not been reached,” Canty had written to the court in May, “there were considerable barriers to a greater recovery, or any recovery at all.”
Three Quarters of Rising Claims
In 2013 Allstate set out to grow its auto insurance business and told investors that the plan might put “some pressure” on claim frequency, the rate at which policyholders file claims, which it would “closely monitor.” In October 2014 it reported a strong quarter, and the next day one of its executives said frequency trends had been good and within historical ranges; in December 2014, at an investor conference, another said he felt good about auto profitability, which “doesn’t mean frequency won’t tick up.” The investors who sued, led by the Carpenters Pension Trust Fund and the Carpenters Annuity Trust Fund for Northern California and later joined by the City of Providence Employee Retirement System, alleged that frequency had already ticked up because the company had loosened its underwriting standards to grow, and that the executives knew it. On February 4, 2015 Allstate disclosed the increase and the next day attributed it to miles driven and precipitation, saying nothing suggested a problem with the quality of its business; in May it reported a second quarter of increases and again cited outside causes; on August 4, 2015, after three quarters, an executive acknowledged that growth had contributed and that underwriting would be tightened, and the stock fell 10 percent the next day.
Labaton was appointed lead counsel on January 20, 2017 and filed the consolidated complaint on March 30, 2017, and Judge Robert W. Gettleman certified the class on March 26, 2019. The Seventh Circuit heard the defendants’ appeal, and on July 16, 2020 Judge David Hamilton, writing for a panel with Judges Michael Kanne and Amy Coney Barrett, held that a claim that false statements had maintained an already inflated price was viable even where the price did not move, that adding Providence as a class representative was proper, and that the defendants bore the burden of proving the absence of price impact on remand; Gettleman certified the class again on December 21, 2020. The investor team reviewed nearly 300,000 pages, took or defended thirty-five fact and expert depositions and submitted fifteen expert reports. On July 26, 2022 Gettleman denied summary judgment on the December 2014 statement and on everything the company said from February 4, 2015 onward: having chosen to say that frequency “won’t tick up,” the company had to disclose that it already had; the later statements expressed confidence and certainty that could not be called mere opinion; a jury could find scienter from the timing of stock sales; and “a reasonable jury could very well find that the August 2015 statements constitute a corrective disclosure.” With a motion to bifurcate the trial, the defendants’ trial brief and the motions in limine on file, the parties went back to Layn Phillips, the retired judge who had mediated in August 2019 and June 2022, and on June 28, 2023 signed a term sheet for $90 million; Gettleman gave final approval on December 19, 2023.
Soliris and Auth0
Alexion Pharmaceuticals earned nearly all of its revenue from Soliris, a drug for two ultra-rare blood disorders. In November 2016 the company disclosed that it was investigating whistleblower reports that employees had used sales practices inconsistent with its policies; its chief executive, David Hallal, and its chief financial officer, Vikas Sinha, left in December, and in January 2017 the company reported that its audit committee had found that “senior management applied pressure on personnel to use pull-in sales to meet targets,” booking orders in a quarter before customers needed the drug. The stock was down 30 percent by the end of the class period, January 30, 2014 to May 26, 2017. Labaton was co-lead counsel for the Public Employee Retirement System of Idaho, and Canty led the investor-side work for the public funds, organizing the evidence on the drug’s commercialization, the company’s compliance practices, its investigations, its disclosures and the market’s reaction. Judge Alvin W. Thompson certified the class on April 13, 2023; the parties settled for $125 million on September 13, 2023, the settlement papers putting the inflation at $68.08 a share for most of the class period, and Thompson approved it at a hearing in Hartford on December 20, 2023.
In May 2021 Okta bought Auth0, a customer identity and access management company, and, the investors alleged, soon had severe problems integrating it; in January 2022 it suffered a data-security incident that it did not disclose for two months and that cost it sales. The Nebraska Investment Council and the North Carolina Retirement Systems were the class representatives for purchasers of Okta’s Class A stock between March 3 and August 31, 2022; Judge Susan Illston certified the class and appointed Labaton class counsel, and Canty’s team used contemporaneous records and witness evidence to separate ordinary integration difficulties from the facts alleged to make specific statements misleading. Okta paid $60 million, and Illston heard and approved the settlement in November 2024.
Face Templates in Illinois
Labaton filed its complaint against Facebook on April 21, 2015, alleging that the Tag Suggestions feature extracted a face template from every photograph an Illinois user uploaded without the written consent the Illinois Biometric Information Privacy Act requires. Judge Donato held on May 5, 2016 that Illinois law applied despite the California choice-of-law clause in Facebook’s terms, denied a second motion to dismiss on February 7, 2017, certified the class on April 16, 2018 and denied the summary judgment motions that May, and the Ninth Circuit affirmed the certification in a published opinion on August 8, 2019 and refused rehearing. Canty helped carry the case, litigated with Edelson and Robbins Geller for nearly five years, to its $650 million settlement, which Donato approved on February 26, 2021: at least $345 to every Illinois user who filed a claim, face recognition switched off by default, and the stored templates of class members deleted unless they consented after a separate disclosure.
A Wedding at Easter
Before Labaton, Canty spent about six and a half years as an Assistant United States Attorney in Brooklyn, in the national security and cybercrimes section and as deputy chief of the general crimes section, and before that he was an assistant district attorney in Nassau County, where he grew up, rising to the homicide bureau; by his own count he has tried thirty to thirty-five cases, three of them in about three months at the district attorney’s office. In February and March 2015 he and Zainab Ahmad led the prosecution of Abid Naseer before Judge Raymond J. Dearie, with Celia Cohen. Naseer, a Pakistani who had entered Britain on a student visa in 2006, had been arrested in Manchester on April 8, 2009, days before, the government charged, he and others meant to bomb the Arndale shopping center over Easter. The case rested on emails to the same Peshawar handler, “Ahmad,” who directed the New York subway plot: Naseer wrote to him in early April 2009 of a large “wedding” planned for the Easter weekend, and Najibullah Zazi, who had pleaded guilty to the subway plot, testified that Ahmad had told him to call that attack a “marriage” and that he had emailed “the marriage is ready” before driving to New York in September 2009. Five British intelligence officers who had tracked Naseer testified in disguise, and a letter to Osama bin Laden dated April 16, 2009 from Saleh al-Somali, recovered from bin Laden’s compound in May 2011, discussed the Manchester arrests. Naseer, defending himself, told the jury the emails were about finding a bride. The jury convicted him on March 4, 2015 of providing and conspiring to provide material support to al-Qaeda and of conspiring to use a destructive device, and Dearie sentenced him to forty years on November 24, 2015.
Canty had also led the investigation of Marcos Alonso Zea of Brentwood, on Long Island, who boarded a flight at Kennedy Airport for London on January 4, 2012 on his way to Yemen to join al-Qaeda in the Arabian Peninsula, was turned back by the British, kept at it, encouraging Justin Kaliebe, who was arrested at the same airport in January 2013 on the same errand, and, on learning that he was under investigation, had the electronic media on his computer destroyed; Zea pleaded guilty on September 9, 2014 to attempting to provide material support and to obstruction, and was sentenced on April 20, 2015 to twenty-five years. “It was just a wonderful and humbling experience to be able to do that type of work on behalf of my country,” Canty has said of those years.
A Firefighter’s Son From Nassau County
Canty’s father is a retired New York City firefighter, two of his brothers are New York City firefighters, a third brother is a Navy officer and his mother is a nurse; there were no lawyers in the family. At Mary Washington College he sat on a panel judging a cheating case under the honor system, and a professor on the honor council asked him whether he wanted to be a lawyer. After graduating cum laude he moved to Washington and worked for a House investigations committee, as the liaison between the Majority Leader’s office and the Government Reform and Oversight Committee, overseeing the Postal Service and reviewing counter-narcotics legislation; then came St. John’s University School of Law, cum laude, admission in New York in 2005 and the Nassau County district attorney’s office. His mentor in Brooklyn was Seth DuCharme, then chief of the office’s counterterrorism unit. “Facts matter. That’s always been my attitude,” he has said. “The truth matters and, as lawyers, I think we have an obligation to make sure that we are seeking out the truth.”
At Labaton Keller Sucharow he is a partner in New York, a member of the executive committee and the firm’s general counsel, reviewing its contracts and retention agreements and handling personnel matters; he leads one of its securities litigation teams and co-chairs its consumer protection and data privacy practice. His other securities recoveries include $100 million from PG&E, $47 million from Novavax and $39 million from Opendoor. He is co-lead counsel in Garner v. Amazon, which alleges that Alexa-enabled devices recorded and wiretapped the people who used them, and he is leading securities cases against ZoomInfo, Roblox, Regeneron and Lockheed Martin. He sits on the securities litigation committee of the National Conference on Public Employee Retirement Systems, belongs to the National Association of Public Pension Attorneys and the Federal Bar Council American Inn of Court, and is a board member of the Christopher J. Keller Memorial Foundation. Of trials he has said, “The trial is a reflection of all the hard work that you put in beforehand,” and of what to put in front of a jury: “Present to the jury the evidence that you have that makes out the elements of the claim. No more. No less.”
Related profiles
-
KC
Privacy & data breaches
Katrina Carroll
Carroll Shamberg LLC
Chicago, Illinois
Read profile → -
CV
Privacy & data breaches
Carol C. Villegas
Labaton Keller Sucharow LLP
New York, New York
Read profile → -
MM
Privacy & data breaches
Mark C. Molumphy
Cotchett, Pitre & McCarthy LLP
Burlingame, California
Read profile →