On July 1, 2025, California Attorney General Rob Bonta announced a $1.55 million settlement, pending court approval, with Healthline Media, LLC. This settlement is the largest penalty issued to date under the CCPA, as amended. Healthline operates one of the most widely visited health and wellness websites in the United States, with more than 6.5 million California users accessing the website per month.
The complaint outlines several alleged violations. First, the complaint alleges Healthline failed to honor consumer opt-out signals in violation of the CCPA and the Unfair Competition Law when it continued to transmit unique identifiers and article titles to dozens of third-party advertising partners despite consumers’ opt-out requests submitted through one or more of Healthline’s multiple opt-out tools, including its “Do Not Sell or Share My Personal Information” link, Global Privacy Control detection, and cookie banner.
Second, the complaint alleges the shared article titles inferred users’ concerns about or diagnoses of potentially intimate health conditions such as HIV, Crohn’s disease, or multiple sclerosis. The attorney general argued Healthline’s sharing potentially health-related information violated the CCPA’s “purpose limitation rule” that requires a business’ use of personal information be limited to the purposes for which the personal information was collected or processed or another disclosed, compatible purpose.
The investigation also revealed Healthline did not maintain proper contracts with many of its advertising vendors. Several contracts did not contain privacy protections for users’ data as required under the CCPA and permitted broad or vague uses of personal information. In addition, Healthline allegedly failed to contractually require vendors receiving opt-out signals to limit their use of consumer data. Moreover, Healthline assumed its advertising vendors followed an industry contractual framework supplementing contracts with CCPA-mandated terms but failed to verify this. The California attorney general later found many vendors were not part of this framework.
Under the settlement, Healthline agreed to pay $1.55 million to the California Consumer Privacy Fund. Healthline is also subject to a permanent injunction requiring significant updates to its data privacy practices. These updates include ensuring that Healthline’s opt-out mechanisms work properly, ceasing the sale or sharing of personal information when a consumer views an article suggesting a medical diagnosis, and clearly notifying users when sensitive personal information is used for advertising purposes.
Healthline must also implement and maintain a CCPA compliance program with annual audits and reporting for a three-year period. Healthline is required to review and update contracts with all third parties to ensure inclusion of all CCPA-mandated terms. The annual audit report must include details on technical testing describing measures Healthline has taken to assess and monitor its processing of user requests and any remediation steps taken in response to identified issues.
This enforcement action and resulting settlement represent a shift in how California regulators are applying the CCPA. While earlier cases focused on retailers and data brokers, the Healthline settlement makes clear that publishers and content platforms are also subject to scrutiny, particularly when sensitive health information is involved. Companies using embedded tracking technologies must ensure their privacy disclosures, opt-out tools, and vendor contracts align with consumer expectations and legal obligations.
To avoid similar enforcement actions, companies can take a proactive approach. This includes reviewing how personal information flows through their systems, testing compliance mechanisms, confirming that third-party service providers uphold CCPA standards, and verifying whether third-party service providers have agreed to abide by an industry contractual framework. The Healthline case is a strong reminder that privacy compliance is not simply about having policies in place, but also about verifying such policies work in practice and reflect the evolving expectations of regulators and consumers alike.