Healthline CCPA settlement: what did the $1.55 million cover?

The fact that made this case unusual is not that Healthline collected health data. It is that the office treated the title of the article a person was reading as the sensitive information, and then banned Healthline from sharing it.

The four alleged violations

The complaint alleged violations of the CCPA and the Unfair Competition Law across four counts, and they are worth separating because only two of them are the ones people remember.

Failing to opt consumers out of sharing for targeted advertising. The CCPA gives consumers the right to opt out of the sale or sharing of personal information for certain targeted advertising, and businesses must honor those requests, including requests submitted through the Global Privacy Control. Healthline continued to share data with some advertising third parties even for consumers who had exercised that right.

Violating the purpose limitation principle. Under the CCPA, a business's use of personal information is limited to the purposes for which it was collected or processed, or another disclosed, compatible purpose. Healthline breached that by sharing article titles suggesting a consumer may have been diagnosed with a specific medical condition in order to target advertising at that consumer.

Failing to maintain CCPA-required contracts. Healthline had not ensured its advertising contracts contained the privacy protections the CCPA requires. It had assumed, but not verified, that the third parties had agreed to abide by an industry contractual framework.

Deceiving consumers about privacy practices. This count runs under the Unfair Competition Law rather than the CCPA. Healthline.com featured a consent banner that did not disable tracking cookies, despite purporting to do so if a consumer unchecked a box.

The article-title theory

Healthline is a health and wellness information site, one of the forty most visited websites in the world, and it funds itself with advertising, some of it personally targeted. To maximize that revenue it allowed online trackers, cookies and pixels, to communicate data about readers to advertisers and other third parties.

What went out was data that could uniquely identify the consumer, together with the title of the article they were reading. Some of those titles indicated the reader may already have been diagnosed with a serious illness. The Attorney General's example was an article titled "You've Been Newly Diagnosed with MS. What's Next?"

Nothing in that transmission is a lab result or a medical record. It is a URL and a headline. The office's position was that the combination of an identifier and that headline conveys the diagnosis just as effectively, and the settlement's novel term follows directly: Healthline must stop disclosing information that can link a specific consumer to a specific article title that suggests consumers have been diagnosed with a disease.

The release also makes the practical point that because these trackers run invisibly in the background in the first milliseconds when a webpage loads, consumers often have no idea how many are running. In Healthline's case, dozens of trackers were sharing consumer data with numerous third parties.

On "largest to date"

The headline on the July 2025 announcement calls this the largest CCPA settlement to date. It was, then. It has since been passed twice: by Disney at $2.75 million in February 2026, and by General Motors at $12.75 million in May 2026.

If you are reading an article that still describes Healthline as the CCPA record, check its date. The number that has not changed is the one that matters for planning, which is that a mid-size publisher's advertising configuration produced a seven-figure penalty.

What this means if you publish anything

The exposure here does not require a health site. It requires pages whose subject matter says something about the reader, plus advertising tags that receive the page context. A debt advice section, a legal help center, a bereavement resource, a page about a specific medical device, all carry the same structure.

The contract finding is the other portable lesson, and it is cheaper to fix. Healthline was not faulted for having bad contracts. It was faulted for assuming without verifying, which is a records problem more than a legal one. The distinction between the roles those contracts have to establish is covered in service provider vs third party.