On July 1, 2025, the California attorney general (AG) announced a $1.55 million settlement (pending court approval) with Healthline Media, LLC (Healthline), who publishes Healthline.com, a health information website. This settlement marks the regulator’s continued focus on online tracking technologies for targeted advertising and the effectiveness of consumer opt-out systems. Importantly, this is the first U.S. regulatory privacy enforcement action where a company is fined for disclosing inferred sensitive personal information, rather than sharing explicit health information.
Pursuant to the proposed final judgment, Healthline is also required to:
- Implement a program to monitor its processing of consumers’ requests to opt out of sale and sharing, as well as consumers’ requests to limit the use of their sensitive information. Healthline must publish an annual report describing any problems encountered with consumer opt-out and limiting requests and the steps taken to remediate such problems.
- Conduct an annual review of its website and mobile app to determine third parties and service providers with whom it makes consumers’ personal information available through online tracking technologies. For the next three years, Healthline must publish a report providing details of the specific personal information shared and how it transmits opt-out signals to third parties to advise them to process such data as service providers.
State investigators identified the following ways that Healthline’s data practices failed to comply with the California Consumer Privacy Act (CCPA).
Read the full Alert.