Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Record-Breaking $1.55M CCPA Settlement Against Health Information Website Publisher

DOJ and HHS Launch New False Claims Act Working Group to Target Healthcare Fraud

Sports

BakerHostetler Services

Raj Bandla, Cynthia Bast Present at 2025 Texas Housing Conference

core/heading

This settlement underscores the importance of validating that opt-out mechanisms truly work as intended. This requires testing and coordination with various stakeholders to ensure that data flows to the third parties engaging in behavioral advertising actually cease after the opt-out. This settlement emphasized that improper functionality resulting in false representations could be framed as deceptive practices.

core/list-item

Healthcare and wellness entities that collect and share sensitive information continue to be under scrutiny. Website operators in this industry should take special care in establishing a cookie governance program and evaluate what sensitive data may be collected and shared with third-party advertising vendors.

Businesses must evaluate whether their data sharing would be consistent with a consumer’s reasonable expectations. And even if a business provides detailed disclosures in a privacy notice, their personal data sharing practices could still violate the purpose limitation principle if the disclosed purposes would be unexpected based on a consumer’s reasonable expectations.

It is imperative to undertake due diligence efforts and validate data flows and vendor relationships to ensure that specific, CCPA-required contractual requirements are actually in place.

core/list

On July 1, the California attorney general (CA AG) <a href="https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155" target="_blank" rel="noreferrer noopener">announced</a> the largest CCPA <a href="https://oag.ca.gov/system/files/attachments/press-docs/Proposed%20Order%20re%20Injunction%20with%20case%20number.pdf" target="_blank" rel="noreferrer noopener">settlement</a> to date, $1.55 million, and the first settlement against a website publisher, Healthline Media LLC (Healthline). The settlement (pending court approval) resolves allegations against Healthline, a health and wellness information website, for violating the California Consumer Privacy Act (CCPA) and the California Unfair Competition Law (UCL) and would involve novel injunctive requirements. This is the first CCPA enforcement action focused on health-related data, following years of heightened federal enforcement trends triggered by healthcare entities’ treatment and disclosure of this category of sensitive personal information.

core/paragraph

The California Department of Justice (DOJ) investigation into Healthline was triggered by a finding that the opt-out functionality on its website was not functioning as required under the CCPA, namely that consumers could not effectively opt out of numerous behavioral advertising cookies that were allegedly used to transmit health information to third-party advertising vendors. In CA AG Rob Bonta’s press release accompanying this settlement, Bonta emphasized the DOJ’s authority under the CCPA to “fight online surveillance,” as well as the sensitive nature of the underlying data, which “could have revealed consumers’ private medical diagnosis.”

The CA AG’s <a href="https://oag.ca.gov/system/files/attachments/press-docs/Proposed%20Order%20re%20Injunction%20with%20case%20number.pdf" target="_blank" rel="noreferrer noopener">complaint</a> described the following areas of noncompliance:

Selling and sharing consumer personal information to third parties, even after receiving opt-outs from consumers.

Collecting and selling consumer personal information without appropriate contractual agreements in place with vendors.

Violating the CCPA’s “purpose limitation principle” by engaging in data-sharing with third parties that would not have been reasonably expected by the consumer (in this case, sharing article titles that could be used to infer an underlying health condition of the consumer).

Deceptive practices, including offering a cookie banner purporting to allow website visitors to disable targeting/advertising cookies but failing to effectively disable those cookies.

The settlement contains the following key provisions and requirements:

Comply with the CCPA. This will include providing consumers with legally required privacy notices regarding the sale and sharing of personal information as well as the right to opt out of all sales and sharing.

Properly process consumer requests to opt out of sales or sharing, including requests made via an opt-out preference signal such as the Global Privacy Control.

Do not sell or share personal information combined with information that allows the recipient to determine that a website visitor has been recently diagnosed.  This includes transmitting the title of an article or the URL of a web page that may reveal that the consumer visiting the web page has already been diagnosed with a medical condition.

Implement and maintain a privacy compliance program to assess and monitor the efficacy of Healthline’s privacy compliance measures. This includes testing opt-out mechanisms and an annual reporting requirement.

Enter CCPA-compliant vendor contracts. Additionally, conduct an annual review to ensure that the appropriate contracts are in place.

Related Services

Featured Insights