California AG Agrees Largest Ever California Consumer Privacy Act Settlement
California has agreed to a $1.55 million settlement with Healthline Media LLC to resolve alleged violations of the California Consumer Privacy Act (CCPA) and California Unfair Competition Law. This is the largest settlement to date to resolve alleged CCPA violations.
Healthline Media (Healthline) is the owner and operator of the website healthline.com, which provides medical and health-related information to consumers. According to Comscore, Healthline was the fastest-growing health information site in 2024, and the site attracts more than 50 million visitors a month. The website generates revenue by displaying advertisements and maximizes revenues through the use of online trackers such as pixels and cookies.
CCPA is a comprehensive consumer privacy law that took effect on January 1, 2020. The act gives state residents several rights, including the right to know what personal data is being collected about them and whether their data is being shared or sold. California residents can access their personal data, prevent their data from being sold, and request that their personal information be deleted. Individuals can also opt out of having their personal data used for targeted advertising.
In the fall of 2023, the state Attorney General tested the opt-out mechanisms on the Healthline website and found that they did not work correctly. Even when individuals chose to opt-out, their identifiable information continued to be shared with advertisers and was used to serve targeted advertising. If a visitor to the Healthline website viewed a page about a specific medical condition, that information was shared with advertisers. The individual would then be shown advertisements related to that condition, even when the user had opted out.
The investigation uncovered multiple violations of California law related to the use of online tracking technologies. In addition to failing to honor requests to opt-out, Healthline had not included required CCPA contract provisions in its agreements with third party advertising partners, displayed a cookie consent banner that did not disable targeted advertising cookies if rejected, and the CCPA purpose limitation principle was violated, which limits the use of personal information to the purposes for which the information was collected.
Since article titles were shared that a website visitor had viewed, advertisers could infer that the individual had been diagnosed with a specific disease or medical condition. The California Attorney General alleged that information was disclosed for two unexpected uses – targeted advertising and third-party inferences based on what a consumer had read, and opting out did not stop those disclosures and uses.
Under the terms of the settlement, Healthline is required to pay a $1.55 million financial penalty and make changes to its business practices to ensure CCPA compliance. They include fixing its opt-out mechanism, stopping disclosing article titles that suggest consumers have been diagnosed with a specific medical condition/disease, and maintaining a CCPA compliance program. The compliance program must include audits of contracts for specific, required privacy terms or confirm that third parties have signed an industry contractual framework that includes those terms. Healthline must also ensure it maintains accurate online disclosures and a privacy policy.
“Our settlement with Healthline underscores that Californians have critical privacy rights under the CCPA to fight online surveillance — including by website publishers. Healthline shared data with third parties that could have revealed consumers’ private medical diagnoses, and while doing so, disregarded consumers’ rights to opt out of the sale and sharing of this data,” said Attorney General Bonta. “California continues to lead the nation in enforcing our robust privacy protection law, and businesses that collect consumer data must honor consumers’ privacy rights. My office is committed to the continued enforcement of the CCPA — every Californian has the right to their online privacy.” The settlement now awaits approval from the court.
