Yliopiston Apteekki: medicine-shopping events exposed more than a generic page view

The authority’s EDPB notice describes medicine-related interactions sent to Google, Meta and other tracking providers with identifying data. Its inquiry covered May 2018 to September 2022. Finnish authority decision, published in Finlex.

The decision’s sanctions section imposes EUR 1,100,000. The notice records the pharmacy’s statement that Google and Meta tracking technologies were discontinued in September 2022. Authority notice on EDPB.

The recorded outcome is an administrative fine and reprimand concerning security of processing. The amount comes from the Finnish decision rather than an inferred figure from the announcement. Payment and later appeal outcomes were not established. Finnish authority decision, published in Finlex.

These are implementation checks suggested by Inth, not additional findings about the company.

• Inspect basket, purchase and medicine-search events for product names, URLs and identifiers.
• Keep advertising integrations away from clinical or authenticated journeys where the responsible team has not approved that data flow.
• Use repository inspection and browser/network tests together; review server-side forwarding separately.

Code audit can trace medicine-related values into reviewed vendor calls. Website audit can record browser requests on pages it can load, with consent state and region.

An opt-in banner does not itself make sensitive disclosures appropriate. Browser observations also cannot show server-side relays or what the recipient does afterwards.

• Finnish authority decision, published in Finlex
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.