Web-tracking health data: regs and enforcement beyond HIPAA

The Federal Trade Commission, joined by Utah and Los Angeles County, has taken action over how some health data collected online is shared with advertisers. This highlights limits of HIPAA for non‑medical website users and shows regulators using consumer-protection laws to scrutinize tracking technologies such as pixels and cookies that can reveal health conditions.

What changed

Regulators asserted that certain health data collected through websites and apps could be disclosed to advertisers in ways that reveal a person’s health condition. The action signals a shift from relying mainly on HIPAA rules to using broader consumer-protection laws to curb web-tracking practices that expose sensitive health information. The FTC is pursuing enforcement actions, backed by state partners, to address practices they view as deceptive or unfair.

Who is affected

Patients and website/app users who interact with health sites or services that may collect data for advertising or analytics could be impacted. Health organizations and tech platforms that handle health-related data online may face new scrutiny and potential remedies or penalties if their tracking practices are found unlawful. The case references actions that extend beyond traditional HIPAA-covered entities to cover unauthenticated online health data use.

Practical next steps

For individuals: review privacy settings on health-related sites and apps, limit cross-site data sharing where possible, and consider browser features that block third‑party trackers. For providers and organizations: assess current data practices for health information collected online, ensure disclosures about data sharing are clear, and prepare for possible changes driven by consumer-protection rules beyond HIPAA. If you handle health data in a digital environment, consult privacy counsel about permissible data sharing with advertisers and analytics providers.

Limits and questions

The new focus does not overturn HIPAA but adds layers of oversight for non-traditional health data flows. Key questions include how “health information” is defined in online contexts, what constitutes deceptive or unfair practices in digital tracking, and what remedies regulators may require. Consumers should monitor updates from the FTC and state partners for specifics on enforcement actions and any guidance for industry best practices.

Information and responsibility notice: This article is general information based on the cited material available when published. It is not legal, tax, immigration, medical, financial, banking, or investment advice; it does not create a professional-client relationship; and it is not a guarantee of outcome, availability, accuracy, or eligibility. Rules, schedules, prices, and third-party information can change. Confirm material decisions with the relevant authority and an appropriately qualified adviser before acting.