A California jury has found that Meta illegally collected user health data from the Flo period-tracking app, violating the state’s wiretap law. The verdict concludes a lawsuit filed against Flo, Google, Meta, and app analytics company Flurry in 2021, in which Flo app users accused the companies of collecting their private menstrual health data without consent for targeted advertising.

While Flo promised to keep users’ sensitive reproductive health information private, the lawsuit alleged that Flo allowed Google and Meta to eavesdrop on in-app communications between November 2016 and February 2019, violating California’s Invasion of Privacy Act. The cases against Flo, Google, and Flurry were resolved through undisclosed settlements before the trial, leaving Meta as the only remaining defendant.

The jury reached a verdict on Monday that there was a “preponderance” of evidence showing Meta had “intentionally eavesdropped on and/or recorded conversations using an electronic device,” unbeknownst to Flo app users. While financial damages have yet to be decided, each violation of the California Invasion of Privacy Act can result in a penalty of $5,000, with the lawsuit filed on behalf of “millions” of Flo users.

“This verdict sends a clear message about the protection of digital health data and the responsibilities of Big Tech,” lead trial attorneys Michael P. Canty and Carol C. Villegas said in a statement. “Companies like Meta that covertly profit from users’ most intimate information must be held accountable.”

Meta has objected to the verdict and will likely appeal the decision.

“We vigorously disagree with this outcome and are exploring all legal options,” Meta said in a statement reported by TechCrunch. “The plaintiffs’ claims against Meta are simply false. User privacy is important to Meta, which is why we do not want health or other sensitive information, and why our terms prohibit developers from sending any.”