[Enforcement library](/enforcement)

# Healthline: check what your event data reveals about readers

You can check what an event reveals when it combines a page title with an identifier. Healthline’s 2025 settlement shows why context matters.

California DOJ · CCPA · Settlement announced 1 July 2025

- Case record
- What happened
- Technical behaviour
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | California Department of Justice |
| Entity | Healthline Media LLC |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) and Unfair Competition Law |
| Action | Settlement through a stipulated judgment |
| Announced | 1 July 2025 |
| Amount | USD 1.55 million in civil penalties |
| Source review | 16 October 2026 |

[DOJ announcement](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155) · [Complaint](https://oag.ca.gov/system/files/attachments/press-docs/People%20v.%20Healthline%20Media%20Complaint.pdf) · [Signed judgment](https://oag.ca.gov/system/files/attachments/press-docs/Signed%20Judgment_0.pdf). Healthline and the California Department of Justice (DOJ) agreed to a stipulated judgment. This page separates the complaint’s allegations from the settlement terms.

## What happened

The DOJ alleged that opt-outs failed and contracts lacked necessary safeguards. It also alleged that the banner’s controls did not stop the data transfers that its text described.

The settlement called for effective opt-outs and restrictions on disclosures that link a person to article titles that suggest a prior diagnosis. It also called for a programme for contracts with relevant recipients. [DOJ announcement](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155)

## Technical behaviour

The complaint describes trackers that sent identifiers with article titles. It also alleges that disclosures to companies for ads continued after opt-outs.

The concern involved titles that suggest a prior diagnosis. The complaint does not say that every health article reveals a diagnosis. These are allegations that the settlement resolved. [Complaint, paragraphs 1–2 and 18–31](https://oag.ca.gov/system/files/attachments/press-docs/People%20v.%20Healthline%20Media%20Complaint.pdf)

Inth’s technical interpretation: the values in an event need review together. A page title, web address, or referrer can reveal sensitive context beside an identifier. The event name `page_view` does not show that context.

A referrer identifies the page that sent a visitor to another page. Global Privacy Control (GPC) is a browser signal for an opt-out.

## Checks for your own systems

### In the repository

- Check event fields for titles, full web addresses, query strings, referrers, and identifiers.
- Check the code that adds values to events.
- Trace automatic data collection and explicit event calls.
- Follow the opt-out decision through browser tags, queues, and server integrations.
- Check the permitted fields and destinations.

### In the browser and network

- Use invented pages and test accounts without real health information.
- Compare data payloads before and after a manual opt-out.
- Repeat the comparison with GPC on.
- Check the first page load and later navigation.
- Compare the banner’s stated effect with the observed storage and data transfers.

### With the people responsible for data use

- Map each field and destination to a stated purpose.
- Check whether each purpose needs all the data in the payload.
- Review whether the combined values reveal sensitive context.
- Check the signed contract terms and the recipient’s behaviour.

## Sources and limits

[DOJ announcement, 1 July 2025](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155) · [Complaint](https://oag.ca.gov/system/files/attachments/press-docs/People%20v.%20Healthline%20Media%20Complaint.pdf) · [Signed judgment](https://oag.ca.gov/system/files/attachments/press-docs/Signed%20Judgment_0.pdf).

Source review: 16 October 2026. This page describes the cited settlement. It does not audit Healthline’s current systems or establish the status of every later legal action.

Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. A browser capture cannot show all server operations.

Membership of an industry framework does not prove that a recipient signed the necessary contract terms.

Related: [Sephora and GPC](/enforcement/sephora) · [Todd Snyder and portal reliability](/enforcement/todd-snyder).

Explore [Code audit](/code-audit) and [Website audit](/website-audit).