California Attorney General Rob Bonta has announced a settlement with Healthline Media LLC, pending court approval. The agreement resolves allegations that Healthline’s use of online tracking technology on its website, Healthline.com, violated the California Consumer Privacy Act (CCPA). An investigation by the California Department of Justice found that Healthline failed to allow consumers to opt out of targeted advertising and shared data with third parties without required privacy protections.
The proposed settlement includes $1.55 million in civil penalties and mandates strong injunctive terms. These terms include prohibiting Healthline from sharing article titles that might indicate a consumer’s medical condition.
“Our settlement with Healthline underscores that Californians have critical privacy rights under the CCPA to fight online surveillance — including by website publishers,” said Attorney General Bonta. “Healthline shared data with third parties that could have revealed consumers’ private medical diagnoses, and while doing so, disregarded consumer’s rights to opt-out of the sale and sharing of this data.”
Healthline.com is a major health information site generating revenue through ads, some personally targeted at readers. To maximize ad revenue, it allowed trackers like cookies and pixels to communicate data about readers to advertisers. This included sharing article titles suggesting serious illnesses such as “You’ve Been Newly Diagnosed with MS. What’s Next?”
The complaint alleges violations under both the CCPA and Unfair Competition Law for failing to allow consumers to opt out of personal information sharing for targeted advertising, violating the Purpose Limitation Principle by using personal information beyond its intended purpose, not maintaining CCPA-required contracts ensuring privacy protections, and deceiving consumers about privacy practices.
Under the settlement terms, Healthline must ensure opt-out mechanisms function correctly; stop disclosing specific consumer-related information; maintain a compliance program auditing contracts for required privacy terms; and maintain accurate disclosures and policies.
This marks Attorney General Bonta’s fourth enforcement action under the CCPA. Previous actions included settlements with Tilting Point Media LLC over children’s data collection without consent in June 2024, DoorDash in February 2024 for selling personal information without notice or an opt-out option, and Sephora in August 2022 for undisclosed sales of personal information.
In March 2025, Bonta announced an investigative sweep into the location data industry due to concerns over widespread data collection amid federal threats affecting California’s immigrant communities and healthcare access.
For more details on the CCPA or to report violations, visit oag.ca.gov/ccpa.
