01. Sensitive page-level data shared
Article topics covering specific medical conditions were transmitted to advertisers in URLs and referrers, exposing inferred health status.
Healthline: $1.55M California privacy settlement
California's largest CCPA settlement to date: Healthline paid $1.55M for sharing sensitive health-related browsing data with advertisers without honoring opt-out requests or limiting use of sensitive personal information.
- CCPA
- California
Last updated
Enforcement snapshot
- Amount
- $1.55M
- Regulator
- California Attorney General
- Sector
- Health media
- Published
- July 2025
Technical failure modes
What failed
02. Opt-out and 'limit use of SPI' ignored
Consumers who opted out — or invoked the right to limit use of sensitive personal information — continued to be tracked across the site.
03. Contractual gaps with ad-tech
Vendor contracts did not contain the CCPA-required service-provider terms, so partner sharing counted as a 'sale'.
04. No consent for SPI
Inferred health interests were used for advertising without an affirmative basis the regulator considered sufficient.
Remediation path
What Ketch would help validate
More enforcement analysis
Other settlements with the same failure modes
Next step
Do not wait for a demand letter to find the gap
The Healthline action put sensitive personal information (SPI) and 'purpose limitation' at the center of CCPA enforcement. Health, mental health, and reproductive-health page views cannot be quietly fed into ad-tech. The settlement signals that any sector touching SPI is now a priority enforcement target.
Get Started Free
Get started in less than 5 min