Pixels and health data
Tracking pixel fines and health data
A pixel on a booking, prescription or symptom page can tell an advertising platform about a visitor's health. Regulators in Sweden, the United States, Australia and Canada have treated that as unlawful disclosure, even where the business did not mean to send it.
Each record names what was shared and with whom, as the regulator described it.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines
-
€7m about £5.86m
Fnac Darty Participations et Services and Fnac Direct
The CNIL found the Fnac mobile app sent a user identifier and browsing activity to a third party domain via an API to power product recommendations and train the algorithm, even when users had not consented. It held that personalisation trackers of this kind are not exempt from consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Fnac Darty Participations et Services and Fnac Direct -
US$7.8m about £5.95m
BetterHelp, Inc.
The FTC found the online counselling service gave email addresses, IP addresses and answers from its health intake questionnaire to Facebook, Snapchat, Criteo and Pinterest for ad targeting. The final order bans sharing health data for advertising, and the 7.8 million dollar payment funds consumer refunds.
FTC Act s5
Read the FTC decision on BetterHelp, Inc. -
US$7m about £5.61m
Cerebral, Inc.
The FTC alleged the telehealth company exposed sensitive data of nearly 3.2 million people to LinkedIn, Snapchat, TikTok and others through tracking tools on its website and apps, and made cancelling difficult. The proposed order bans using or disclosing health data for advertising.
FTC Act s5 / ROSCA / Opioid Addiction Recovery Fraud Prevention Act
Read the FTC decision on Cerebral, Inc. -
SEK 37m about £2.75m
Apoteket AB
IMY found the pharmacy chain's use of the Meta Pixel on its website passed sensitive customer purchase data to Meta, and that it lacked appropriate technical and organisational security measures. The issue came to light through the company's own breach notification in 2022.
GDPR, Art. 32, Art. 58(2), Art. 83
Read the IMY decision on Apoteket AB -
US$2.75m about £2.01m
The Walt Disney Company
The Attorney General said Disney's opt outs, including Global Privacy Control signals, only covered one device or service while embedded third party ad tech kept receiving data. The settlement requires opt outs that stop sale and sharing across a logged in account.
CCPA
Read the CA-AG decision on The Walt Disney Company -
US$1.5m about £1.22m
GoodRx Holdings Inc.
The FTC said the prescription discount platform passed users' health information to Facebook, Google, Criteo and others for advertising and never notified anyone of those disclosures. It was the first enforcement action under the Health Breach Notification Rule and bans GoodRx from sharing health data for advertising.
FTC Act s5 / Health Breach Notification Rule
Read the FTC decision on GoodRx Holdings Inc. -
SEK 15m about £1.13m
Avanza Bank AB
IMY found the bank accidentally switched on extra Meta Pixel features on its website and app, sending data such as holdings, loan amounts, account numbers and personal ID numbers of up to one million people to Meta between 2019 and 2021.
GDPR, Art. 32
Read the IMY decision on Avanza Bank AB -
US$1.55m about £1.13m
Healthline Media LLC
The Attorney General said the health publisher kept sharing data with ad partners after users opted out, including via Global Privacy Control, shared article titles hinting at medical diagnoses for ad targeting, lacked required contracts, and ran a cookie banner that did not actually switch off tracking.
CCPA / Unfair Competition Law
Read the CA-AG decision on Healthline Media LLC -
US$1.2m about £1.02m
Sephora, Inc.
Landmark first CCPA settlement: the Attorney General said the retailer did not tell shoppers it was selling their data, ignored opt out signals sent through Global Privacy Control, and did not cure within 30 days.
CCPA
Read the CA-AG decision on Sephora, Inc. -
SEK 8m about £594k
Apohem AB
IMY found the online pharmacy's Meta Pixel transferred sensitive customer data to Meta without adequate security measures. The administrative court upheld the fine in May 2026 and the company has appealed further.
GDPR, Art. 32, Art. 58(2), Art. 83
Read the IMY decision on Apohem AB -
US$100k about £80k
Easy Healthcare Corporation (Premom)
The FTC said the developer of the Premom ovulation tracking app shared users' health data through third party SDKs, including with Google, AppsFlyer and two China based firms, without telling users. The order bans sharing health data for advertising; Connecticut, DC and Oregon obtained a further 100,000 dollars in total.
FTC Act s5 / Health Breach Notification Rule
Read the FTC decision on Easy Healthcare Corporation (Premom)
Orders, reprimands and findings
-
Order or finding
Medmate Australia Pty Ltd
The Privacy Commissioner found that telehealth provider Medmate interfered with visitors' privacy by collecting sensitive health information through third-party tracking pixels used for social media ad targeting, without consent. The determination sets the position that pixel tracking on health websites is a collection of sensitive information that needs consent.
Privacy Act 1988 (Cth)
Read the OAIC decision on Medmate Australia Pty Ltd -
Order or finding
Monash IVF Pty Ltd
In a parallel determination, the Privacy Commissioner found that fertility clinic operator Monash IVF interfered with privacy by collecting sensitive information from website visitors via third-party tracking pixels without consent. The OAIC published a companion report on its inspection of 50 health service websites.
Privacy Act 1988 (Cth)
Read the OAIC decision on Monash IVF Pty Ltd -
Order or finding
Monument, Inc.
The FTC said the online alcohol addiction treatment service sent health information of up to 84,000 users to Meta and Google through tracking pixels and APIs despite promising confidentiality. The order bans disclosing health data for advertising.
FTC Act s5 / Opioid Addiction Recovery Fraud Prevention Act
Read the FTC decision on Monument, Inc. -
Order or finding
Home Depot of Canada Inc.
The OPC found that Home Depot sent hashed email addresses and in-store purchase details of e-receipt customers to Meta through the Offline Conversions tool, which Meta could also use for its own advertising, without the express consent customers would expect. The complaint was well-founded and resolved after Home Depot stopped using the tool in October 2022.
PIPEDA
Read the OPC decision on Home Depot of Canada Inc. -
Order or finding
The TDL Group Corp. (Tim Hortons)
A joint federal and provincial investigation found that the Tim Hortons app, through a third-party SDK, tracked users' location as often as every few minutes even when the app was closed, to infer home, work and visits to competitors, without valid consent or an appropriate purpose. The matter was well-founded and conditionally resolved after the company committed to delete the data and set up a privacy management programme.
PIPEDA; Quebec Private Sector Act; PIPA (BC); PIPA (Alberta), s 6.1
Read the OPC decision on The TDL Group Corp. (Tim Hortons) -
Order or finding
Flo Health Inc.
Landmark earlier case: the FTC found the period and fertility tracking app shared users' health data with marketing and analytics firms including Facebook and Google despite privacy promises. The final order requires affirmative consent before sharing health data, notice to users and an independent privacy review, with no money penalty.
FTC Act s5
Read the FTC decision on Flo Health Inc.
Laws, deadlines and guidance
-
Law and guidance
Final storage and access technologies guidance published | ICO
The ICO issued final guidance on storage and access technologies, covering cookies, tracking pixels, fingerprinting and similar tools and reflecting the Data (Use and Access) Act changes. A separate review of the regulation 6 consent rule for online advertising was passed to government as advice in May 2026.
PECR / UK GDPR, Reg. 6
Read the ICO decision on Final storage and access technologies guidance published | ICO -
Law and guidance
Pixels de suivi dans les courriers électroniques : la CNIL publie ses recommandations pour mieux protéger la vie privée
The CNIL published its final recommendation on tracking pixels in emails, setting out when consent is needed, an exemption for measuring deliverability of service emails, and a three month window to inform recipients on existing lists.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Pixels de suivi dans les courriers électroniques : la CNIL publie ses recommandations pour mieux protéger la vie privée -
Law and guidance
OAIC publishes guidance on tracking pixels and privacy obligations | OAIC
The OAIC issued guidance to private sector organisations on meeting Privacy Act obligations when they place third-party tracking pixels on their websites. The guidance later underpinned the 2026 Medmate and Monash IVF determinations on health website pixels.
Privacy Act 1988 (Cth)
Read the OAIC decision on OAIC publishes guidance on tracking pixels and privacy obligations | OAIC -
Law and guidance
Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive
The EDPB published the final version 2.0 of its guidelines on which technologies fall under the ePrivacy consent rule for device access, with use cases going beyond cookies to URL and pixel tracking, IP based tracking, IoT reporting and unique identifiers.
ePrivacy Directive 2002/58/EC art. 5(3), Art. 5(3) ePrivacy Directive
Read the EDPB decision on Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive -
Law and guidance
Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
OCR's guidance on online tracking technologies says regulated entities may not use trackers in a way that leaks health data to vendors. On 20 June 2024 a Texas federal court vacated the part saying HIPAA applies when a tracker links an IP address to a visit to an unauthenticated public health page; the rest of the guidance stands.
HIPAA Privacy Rule
Read the HHS-OCR decision on Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.