A patient searches for help with a sensitive condition, finds a telehealth service, and completes an intake form. Unbeknownst to the patient, information about their visit is being shared with advertisers.
On July 14, 2026, a federal court in California allowed privacy claims to proceed over exactly that journey, in a case alleging that tracking pixels on a telehealth platform sent prescription-related data to two major advertising platforms.
The court’s reasoning matters more than the case itself: Language buried in a privacy policy did not amount to the specific, informed consent that health data demands.
Consent management is the practice of collecting, recording and enforcing individuals’ choices about how their personal data is used, and in healthcare it operates under the highest standard the law applies anywhere. Patient trust in digital health services rests on whether that standard is visibly met.
Health Data Carries the Highest Consent Bar
Regulators and legislators treat health information as a special category.
- Washington’s My Health My Data Act requires separate opt-in consent to collect consumer health data and a separate signed authorization to sell it, and it hands enforcement to consumers themselves through a private right of action
- Most comprehensive US state privacy laws impose opt-in consent for sensitive data
- The EU’s General Data Protection Regulation (GDPR) requires explicit consent to use health data in most commercial contexts
The definitions are broad by design. Data that merely relates to a person’s past, present or future health status can qualify, which pulls symptom pages, appointment flows and wellness apps into scope alongside clinical records.
A Cookie Banner Is Not a Health-Data Consent
Much of the sector’s exposure comes from treating generic web consent as sufficient to process health data..
A valid health-data consent is specific about what will be disclosed, to whom and for what purpose, and under the Health Insurance Portability and Accountability Act (HIPAA), a marketing disclosure of protected health information generally needs a signed authorization rather than a banner click.
The July 2026 ruling made the gap explicit, and it echoes what enforcement agencies have said for several years: Consent mechanisms drafted for advertising convenience do not meet the standard, and trackers firing on scheduling pages and patient portals turn routine visits into unauthorized disclosures.
The Enforcement Record Keeps Growing
The Federal Trade Commission (FTC) built a sustained enforcement program around health data shared with advertising platforms.
- A prescription discount platform paid a $1.5 million civil penalty in the first action under the Health Breach Notification Rule
- An online therapy provider paid $7.8 million in consumer refunds
- A telehealth mental health startup paid $7 million and accepted a ban on using health data for advertising.
Private litigation adds a second front. A Midwestern hospital system paid $12.25 million to settle class claims after tracking pixels on its websites and portal shared appointment and physician details with advertising platforms, and plaintiffs’ firms now scan provider websites for trackers as a matter of routine.
Consent Has to Be Enforced In the Tags, Not Just the Banner
A consent banner that displays correctly while trackers load underneath it makes the problem worse, because it documents a choice the organization then ignores.
Pixels are frequently configured to fire on page load, collecting IP addresses and click behavior before the visitor has answered the banner at all, and regulators have characterized pre-consent collection as a deceptive practice.
Healthcare organizations should test the machinery rather than the interface: Confirm that a refusal actually blocks every tag on scheduling pages and portal entry points, and that a withdrawal stops trackers that were previously allowed.
The technical audit is the compliance position, since regulators and plaintiffs now run exactly that test from the outside.
Trust Decides Whether Patients Engage
The commercial case runs in the same direction as the legal one. Digital health services depend on patients volunteering accurate, sensitive information, and patients hold back from services they distrust, by withholding details, declining portals, or avoiding online scheduling entirely.
Transparency reverses that. When a provider shows patients what data it collects, why, and how to change their choices, engagement becomes safer for the patient and more valuable for the provider, because consented first-party data is the only kind that can be used with confidence.
Preference management belongs in that picture too. Patients want appointment reminders through the channel they actually check, and they want a clean line between care communications and marketing.
A patient-facing preference center that separates the two, and honors changes immediately, is a trust signal patients can see.
Where Healthcare Organizations Should Start
- Audit every tracker on scheduling pages, condition-specific content and portal entry points, mapping what fires, what it transmits and where it goes.
- Separate consents: Care communications, marketing, and any disclosure to third parties each need their own specific, recorded basis, captured away from the cookie banner.
- Enforce: A revoked consent must actually stop the data flow in every connected system, and the organization must be able to prove that it did.
Unified consent and preference management platforms are increasingly how the sector operationalizes this, but the obligation, and the trust at stake, belong to the provider.
Every patient interaction now starts with an implicit question about what happens to their information. Providers that can answer it clearly will be the ones patients keep choosing.