Data Sharing Practices: What FTC Cases Mean for Your Privacy Policy

Most businesses write a privacy policy once, publish it, and move on. Meanwhile the website gains an ad pixel, a chat widget, a booking tool and an analytics script, each of which may send visitor data somewhere new. The policy stays the same.

That gap is where many FTC privacy cases start. The agency's view is simple: what you tell people about how you share their data is a promise, and breaking it can be a deceptive practice under Section 5 of the FTC Act. For health data, the FTC has also argued that sharing it without clear consent can be unfair, even if the policy is vague.

This guide walks through a recent dating app case, the FTC's health data cases, and what they mean for clinic and telehealth websites.

A dating app case from March 2026

On March 30, 2026, the FTC announced a settlement with OkCupid, operated by Humor Rainbow, Inc., and its affiliate Match Group Americas. According to the FTC:

• OkCupid's privacy policy said it shared personal information only with service providers, business partners, affiliated companies, or after notice and a chance to opt out.
• Starting in 2014, the company gave nearly three million user photos, along with location and other information, to an unrelated third party with which it had no business relationship. OkCupid's founders were financial investors in that company.
• No formal agreement or restrictions governed what the recipient could do with the data.
• The FTC alleged the companies tried to conceal the sharing, including by obstructing the investigation.

The stipulated order, filed in federal court in Dallas, permanently bars the companies from misrepresenting how they collect, use, share, delete or protect personal data. The FTC's announcement did not include a monetary payment. The companies did not admit the allegations, and Match Group has said the practices do not reflect how OkCupid operates today.

The lesson is not limited to dating apps. A privacy policy that lists categories of recipients is only accurate if every actual recipient fits one of those categories.

The health data cases

Since 2023 the FTC has brought a series of cases against health companies that shared sensitive data with advertising platforms, often through tracking pixels and software development kits (SDKs) built into their websites and apps.

Two details stand out for smaller practices. Monument's custom event names, such as "Paid: Weekly Therapy," told the ad platform what service someone had bought. And Monument claimed HIPAA compliance even though, according to the FTC, an outside assessor it hired had found it was not fully compliant.

The Health Breach Notification Rule

Many health apps and wellness services are not covered by HIPAA. For those businesses, the FTC enforces the Health Breach Notification Rule (HBNR). The FTC finalized amendments on April 26, 2024, effective July 29, 2024. Key points:

• The rule clearly covers most health apps and similar technologies that hold identifiable health information and are not covered by HIPAA.
• A "breach" includes an unauthorized disclosure, not only a hack. Sharing health data with an ad platform without authorization can trigger notice duties.
• Notices must identify the third parties that received the data, or describe them where naming them would create a risk.
• For breaches affecting 500 or more people, the FTC must be notified at the same time as individuals, and no later than 60 days after discovery.

HBNR violations are treated as rule violations, so civil penalties can apply. The current maximum is $53,088 per violation, the level set in January 2025, which carries over into 2026 because no inflation adjustment was issued this year.

What this means for a clinic or telehealth website

If you are a HIPAA covered entity

Medical and dental practices that bill insurance electronically are generally HIPAA covered entities. Many cash-only med spas are not, though the FTC Act and state privacy laws still apply to them. HHS's Office for Civil Rights issued guidance on tracking technologies in December 2022 and revised it on March 18, 2024. It says covered entities may not use tracking tools in a way that discloses protected health information to vendors without a HIPAA-permitted basis, such as a business associate agreement (BAA) or patient authorization.

In June 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated one part of that guidance: the position that an IP address combined with a visit to a public, unauthenticated page about a condition or provider is automatically protected health information. OCR later withdrew its appeal. The rest of the guidance still stands, including its treatment of patient portals, logged-in pages and appointment flows.

On July 20, 2023, the FTC and HHS jointly sent letters to about 130 hospital systems and telehealth providers warning about pixels such as the Meta Pixel and Google Analytics. The letter made clear that businesses outside HIPAA still answer to the FTC Act and the HBNR.

If you are not covered by HIPAA

Cash-pay wellness brands, supplement stores and many telehealth startups may fall outside HIPAA. That does not make health data fair game. The FTC cases above were brought under the FTC Act, and the HBNR applies to many of these businesses directly.

Where data leaks on a typical practice site

• Ad pixels firing on appointment request and confirmation pages
• Form tools that send field contents to analytics or ad platforms
• Event names or URLs that reveal a service or condition, such as "/thank-you-hormone-consult"
• Chat widgets and AI receptionists whose vendors keep transcripts
• Session replay tools that record what visitors type
• Third-party booking or intake tools without a BAA

A practical review checklist

Businesses often run through these steps once a year and whenever the site changes:

1. Inventory every tag and integration. Use your tag manager and a browser's network panel to list what loads on each page, especially forms and booking flows.
2. Map where data goes. For each tool, note what it collects, who receives it, and whether that vendor will sign a BAA if PHI is involved.
3. Compare the map to your privacy policy. Every recipient should fit a category the policy discloses, described in plain language.
4. Pull trackers off sensitive pages. Many practices remove ad pixels from intake, booking, portal and thank-you pages entirely.
5. Rename events. Conversion events should not describe a condition, treatment or service purchased.
6. Get real consent where needed. If you share health information for advertising, the FTC orders above show the agency expects affirmative express consent.
7. Put contracts in place. BAAs for HIPAA vendors, and data processing terms that restrict use for everyone else.
8. Set a retention schedule. Delete data you no longer need, including in vendor systems.
9. Watch your badges. Do not claim "HIPAA compliant" or "100% confidential" on the site unless counsel agrees you can back it up.
10. Recheck after every redesign or new tool. Many leaks start with a marketing plugin added without review.

Privacy counsel can help decide which laws apply to your practice and what consent wording you need.

Where NutriCove fits

NutriCove builds websites and web apps for practices and brands, with lead capture, CRM and booking wired in, plus care plans for ongoing updates. When we build or rebuild a site, tracking can be set up so ad pixels stay off forms and booking pages. If you are reviewing what your current site shares, see how we build practice websites. We do not provide legal advice, so your privacy policy wording should come from your attorney.

Sources

• FTC Takes Action Against Match and OkCupid for Deceiving Users by Sharing Personal Data with Third Party, Federal Trade Commission
• FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising, Federal Trade Commission
• FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Federal Trade Commission
• Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising, Federal Trade Commission
• Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising, Federal Trade Commission
• FTC Finalizes Changes to the Health Breach Notification Rule, Federal Trade Commission
• Updated FTC Health Breach Notification Rule puts new provisions in place, FTC Business Blog
• FTC and HHS Warn Hospital Systems and Telehealth Providers about Online Tracking Technologies, Federal Trade Commission
• Federal Judge Vacates Portions of OCR Guidance on Online Tracking Technologies, Morrison Foerster
• OCR Withdraws Appeal in AHA v. Becerra, McDermott Will and Schulte
• 16 CFR 1.98, Adjustment of civil monetary penalty amounts, eCFR

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.