The plaintiffs claimed that tracking code on Kaiser’s websites and apps disclosed members’ health-related information to third parties such as Google, Microsoft, Adobe and X without their knowledge. Kaiser agreed to a class settlement of $46 million, which can rise to $47.5 million, covering about 13.4 million people. It denied the claims and admitted no wrongdoing.
In December 2025, Kaiser Permanente agreed to a $46 million class settlement in the U.S. District Court for the Northern District of California. The settlement covers about 13.4 million members and can rise to $47.5 million if certain conditions are met.
The members claimed that tracking code on Kaiser's websites, mobile apps and patient portal sent their information to third parties such as Google, Microsoft, Adobe and X without their knowledge. The information described included names, IP addresses, whether a member was signed in, and which pages they visited.
Kaiser's own notice in April 2024 said that search terms typed into its online health encyclopedia may also have been shared, and those searches can include symptoms, medicines and injuries. The class covers members who used Kaiser's signed-in pages and apps between November 2017 and May 2024.
Under the settlement, $46 million goes into a fund for class members, with up to $1.5 million more if certain conditions are met. Kaiser denied the claims and admitted no wrongdoing. It had already removed the tracking tools after its own investigation.
No one hacked Kaiser, and no passwords were stolen. The case turned on ordinary analytics and advertising tags running on the pages where members check their health.
It is not the only case of its kind. In October 2026, a federal court in Arizona gave final approval to LifeStance Health's $3.03 million class settlement over tracking pixels on its patient booking tool.
The questions apply to any site with signed-in pages or sensitive searches: which tags load on those pages, what each one sends and to whom, whether search terms or page addresses go with it, and who checks again each time the site changes.
Why it matters for your siteAnalytics and ad tags inside patient portals and apps can turn into an eight-figure class settlement even when no misuse is shown.
The transcript
Forty-six million dollars. That's what Kaiser Permanente agreed to pay to settle a class action over the tracking code on its websites and apps. The settlement covers about thirteen million members, and it can rise to forty-seven and a half million dollars.
So what was it accused of? The members claimed that tracking code on Kaiser's sites, apps and patient portal sent their information to companies like Google, Microsoft, Adobe and X, without their knowledge. Names. Internet addresses. Whether they were signed in, and which pages they visited.
It didn't stop there. Kaiser's own notice in April 2024 said search terms typed into its health encyclopedia may also have been shared. Symptoms. Medicines. Injuries. The class covers members who used Kaiser's signed-in pages and apps from November 2017 to May 2024.
And what did it pay? Forty-six million dollars into a settlement fund, in federal court in San Francisco, with up to one and a half million more if certain conditions are met. Kaiser denied the claims and admitted no wrongdoing. It had already removed the tracking tools after its own investigation.
Notice what this was not. No hacker. No stolen passwords. Just analytics and ad tags, on the pages where members check their health.
And it's not alone. In October 2026, LifeStance Health agreed to a three million dollar class settlement over the tracking pixels on its patient booking site. Different company, same pattern: ordinary tags, on sensitive pages.
Most sites can't say which tags fire on their signed-in pages, or what those tags send. That's the question every one of these cases turns on.
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.