The Attorney General alleged that Healthline.com’s opt-outs for targeted advertising did not work and that its consent banners misled visitors. It also alleged that article titles suggesting a reader’s medical diagnosis were shared with ad partners, and that its advertising contracts lacked the required privacy terms. Healthline agreed to pay $1.55 million, fix its opt-out mechanisms, stop sharing data that links a reader to diagnosis-suggestive article titles, and keep a programme with contract audits.
On 1 July 2025, California's Attorney General, Rob Bonta, announced a settlement with Healthline Media, publisher of Healthline.com, a health and wellness website his office describes as one of the forty most visited in the world. Healthline agreed to pay $1.55 million, which the office called the largest settlement yet under the California Consumer Privacy Act.
The office claimed that Healthline kept sharing readers' data with some advertising partners after those readers had opted out of targeted ads, and that its consent banner did not switch off tracking cookies when a reader unchecked a box. It also claimed that article titles suggesting a reader may have been diagnosed with a serious illness were sent to third parties with data that could identify the reader, and that Healthline's ad contracts lacked the privacy protections the office said they needed.
Beyond the payment, Healthline must make its opt-out tools work, stop disclosing information that links a specific reader to a title suggesting a diagnosis, keep a privacy programme that includes audits of its contracts, and keep its disclosures and privacy policy accurate. Healthline settled; the problems described are the office's allegations.
No hacker or leaked database was involved. The office pointed to ordinary cookies and pixels, which load in the first moments a page opens and run out of sight; in Healthline's case, it said, dozens of them were sharing data. That is why ordinary tags matter: readers cannot see what they send, and a banner is only as good as what the tags do after someone clicks it.
Healthline is not the first case of its kind. In August 2022, the same office settled with Sephora for $1.2 million, alleging, among other things, that the retailer ignored Global Privacy Control opt-out signals sent by shoppers' browsers.
So ask a few questions of any website. Which tags fire before a visitor makes a choice? Do they stop when a visitor says no, or when the browser sends an opt-out signal? What does each tag send, page titles included? Do the contracts with ad partners carry the privacy terms regulators look for? Tolbrook checks a site the way a visitor would and shows the evidence, privately. Tolbrook is not a law firm and gives no legal advice.