[Enforcement library](/enforcement)

# Yliopiston Apteekki: medicine-shopping events exposed more than a generic page view

The Finnish authority fined Yliopiston Apteekki EUR 1.1 million over tracking technologies that disclosed identifiable online-pharmacy interactions.

## Key facts

- **Regulator or court:** Finnish Data Protection Ombudsman
- **Jurisdiction:** Finland
- **Framework:** GDPR Articles 5(1)(f) and 32
- **Record date:** 2025-05-27
- **Procedural status:** Administrative fine and reprimand; later appeal status not established

The Finnish authority fined Yliopiston Apteekki EUR 1.1 million over tracking technologies that disclosed identifiable online-pharmacy interactions.

Finnish Data Protection Ombudsman · GDPR Articles 5(1)(f) and 32 · Decision: 27 May 2025

## The problem

Basket and purchase events can identify a medicine or a health-related journey when they are sent with a browser identifier.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Finnish Data Protection Ombudsman |
| Jurisdiction | Finland |
| Law | GDPR Articles 5(1)(f) and 32 |
| Decision date | 27 May 2025 |
| Recorded fine | EUR 1,100,000 |
| Procedural status | Administrative fine and reprimand; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [Finnish authority decision, published in Finlex](https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2473).

## What the authority found

The authority's EDPB notice describes medicine-related interactions sent to Google, Meta and other tracking providers with identifying data. Its inquiry covered May 2018 to September 2022. [Finnish authority decision, published in Finlex](https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2473).

The decision's sanctions section imposes EUR 1,100,000. The notice records the pharmacy's statement that Google and Meta tracking technologies were discontinued in September 2022. [Authority notice on EDPB](https://www.edpb.europa.eu/news/finnish-sa-pharmacy-company-yliopiston-apteekki-issued-administrative-fine-for-online-shop_en).

## Outcome and limits

The recorded outcome is an administrative fine and reprimand concerning security of processing. The amount comes from the Finnish decision rather than an inferred figure from the announcement. Payment and later appeal outcomes were not established. [Finnish authority decision, published in Finlex](https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2473).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Inspect basket, purchase and medicine-search events for product names, URLs and identifiers.
- Keep advertising integrations away from clinical or authenticated journeys where the responsible team has not approved that data flow.
- Use repository inspection and browser/network tests together; review server-side forwarding separately.

## How Inth helps

Code audit can trace medicine-related values into reviewed vendor calls. Website audit can record browser requests on pages it can load, with consent state and region.

An opt-in banner does not itself make sensitive disclosures appropriate. Browser observations also cannot show server-side relays or what the recipient does afterwards.

## Sources and limits

- [Finnish authority decision, published in Finlex](https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2473)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/finnish-sa-pharmacy-company-yliopiston-apteekki-issued-administrative-fine-for-online-shop_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.