FTC health-app privacy enforcement
FTC enforcement actions and FTC/HHS warning letters put digital health companies, telehealth providers, and hospital systems on notice that sharing sensitive health information through advertising or tracking technologies can trigger federal consumer-protection and breach-notification enforcement.
Federal · Effective · Implementation Jul 20, 2023
What it is
- What changed
- FTC took its first Health Breach Notification Rule enforcement action against GoodRx for alleged unauthorized health-data disclosures and later joined HHS OCR in warning hospital systems and telehealth providers about online tracking technologies that may disclose sensitive health information.
- Why it matters
- Caregiver-facing tools can collect medication, diagnosis, appointment, and household context; these federal enforcement signals define privacy hazards that product and partner reviews need to catch before data reaches ad or tracking vendors.
- Who it touches
- Family caregivers, Care providers and plans, People using AI and digital health tools, People receiving care, Businesses and agencies that must complydigital health users, family caregivers, telehealth patients, health app vendors, hospital systems
- What it does
- Gives people a right or protection
Sources
- FTC GoodRx Health Breach Notification Rule enforcement action
- FTC/HHS online tracking technology warning letters
Last reviewed Jul 4, 2026. This is information, not legal advice; check the source for the current text.