You searched for a medical condition. Suddenly you start seeing ads for treatments, clinics, and products. Coincidence?
Regulators Have Said This Plainly: Ordinary Behavior Can Reveal Health Information
The FTC has specifically noted that information which seems unrelated to health on its face — browsing history, physical location, purchase history — can nonetheless reveal sensitive information about a person's health. Visiting a specific type of clinic, searching a symptom repeatedly, or buying a particular over-the-counter product are all behaviors that can be aggregated and inferred into a health profile, even without you ever directly telling anyone about a medical condition.
The Enforcement Record: Location and Browsing Data Specifically
- Kochava, a data broker, was sued by the FTC in 2022 for selling precise geolocation data from hundreds of millions of mobile devices — data the FTC alleged could reveal visits to sensitive locations including reproductive health clinics and places of worship. In a settlement resolved in 2026, Kochava and its successor entity were barred from selling, sharing, or disclosing sensitive location data without a consumer's affirmative express consent.
- X-Mode Social / Outlogic was separately barred by the FTC from selling sensitive location data after similar allegations regarding tracking of visits to health-related locations.
- GoodRx, BetterHelp, Premom, and Cerebral — covered in more detail elsewhere on Kibbo — were all penalized specifically for sharing health-linkable user activity data with advertising platforms via tracking pixels embedded directly in their apps and websites.
The common thread across these cases: the FTC treats the act of letting health-linkable data flow to an advertising platform as the violation itself, largely regardless of whether the company intended harm — the standard remedy has consistently been an outright ban on using that data for advertising going forward.
Why "I Didn't Share My Medical Information" Doesn't Mean You're Not Exposed
None of the enforcement actions above required the person to have directly entered a diagnosis anywhere. Location visits, search terms, and purchase patterns were enough to construct a health-relevant profile. This is precisely why a privacy policy's promises about "health information" specifically can miss the bigger picture — the underlying behavioral data used to infer health status often isn't labeled as "health data" by the company collecting it, even though regulators have treated it as sensitive in exactly this context.
What This Means Practically
- Be aware that location, browsing, and purchase data — not just information you explicitly label as medical — can be used to infer health status.
- Check your phone and browser's location and ad-tracking permissions periodically, particularly for apps with no clear reason to need your location.
- If you notice targeted ads that seem to reflect a private health search or visit, that's a real signal worth investigating — check the specific app or site's privacy settings and consider opting out of ad tracking where offered.
- Report a suspected violation to the FTC directly — this is an area with an active and growing enforcement record, not a dead-end complaint.