Ad Tech Compliance

California CMIA and CCPA health data rules for advertisers: which law applies and what it requires

Published November 10, 2026 · Last updated November 10, 2026
Next scheduled review: 9 February 2027

California governs health data in advertising through two laws. The Confidentiality of Medical Information Act (CMIA) bars providers, plans, pharmaceutical companies and many health apps from using medical information for marketing without authorization. The California Consumer Privacy Act (CCPA) treats other health information as sensitive personal information that consumers can limit (Civ. Code 56.10).

California has no stand-alone consumer health data law like Washington's. Instead, the answer depends on who holds the data. This page sorts the cases, then reads each law's rules for advertising. For the cross-state view, see the state health privacy law tracker.

Contents

Key facts

CMIA bars marketing use without express authorization. Providers, plans, contractors and corporations and their affiliates may not "share, sell, use for marketing, or otherwise use medical information" for a purpose not necessary to provide care (Civ. Code 56.10(d)).
Health apps can be providers. Businesses offering software or devices that maintain medical information for the user are "deemed to be a provider of health care" (Civ. Code 56.06(b)). Reproductive and sexual health digital services were added from 1 January 2024 (AB 254).
$1,000 without proof of harm. A person whose information was negligently released may recover nominal damages of $1,000 without showing actual damages (Civ. Code 56.36(b)).
CCPA sensitive data includes health. "Personal information collected and analyzed concerning a consumer's health" is sensitive personal information (Civ. Code 1798.140(ae)).
A health publisher paid $1.55 million. The Attorney General's settlement with Healthline Media, announced on 1 July 2025, bars sharing article titles that suggest a diagnosis (California AG, 1 July 2025).

Jump to the table

Definition

Medical information, under the CMIA, is "any individually identifiable information, in electronic or physical form, in possession of or derived from" a provider, health plan, pharmaceutical company or contractor (Civ. Code 56.05(j)). It must concern a patient's medical history, mental health or reproductive or sexual health application information, condition or treatment. Information is individually identifiable if it includes an element such as an email address, or reveals identity when combined with public information.

The CMIA's own definition of marketing is "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service", with three exclusions (Civ. Code 56.05(i)). The wording matches HIPAA's, but the exclusions differ; compare the HIPAA marketing rule.

Which law applies: sorting by who holds the data

The CCPA does not apply to medical information governed by the CMIA, or to protected health information collected by a HIPAA covered entity or business associate (Civ. Code 1798.146(a)(1)). Providers are also outside the CCPA to the extent they treat patient information in the same way. So the first question is who holds the data, and how.

6 of 6 rows

Density


Hospital, clinic or licensed professional	Patient information	CMIA (and HIPAA for PHI)	CCPA excluded to the extent handled as medical information, 1798.146
Pharmaceutical company	Medical information it holds or derived from a provider	CMIA	"Pharmaceutical company" is named in 56.05(j) and (n)
App that maintains medical information for the user	Medical information in the app	CMIA, as a deemed provider	56.06(b)
Mental health or reproductive health app or site	Application information	CMIA, as a deemed provider	56.06(d)-(e)
Health publisher or general retailer	Browsing, purchases, inferences about health	CCPA	Sensitive personal information if collected and analyzed concerning health, 1798.140(ae)
Ad platform receiving data from any of the above	Whatever it receives	Depends on its role and the source	A CMIA source's disclosure needs authorization, 56.10(a)

Hospital, clinic or licensed professional

Data: Patient information
Main California law: CMIA (and HIPAA for PHI)
Notes: CCPA excluded to the extent handled as medical information, 1798.146

Pharmaceutical company

Data: Medical information it holds or derived from a provider
Main California law: CMIA
Notes: "Pharmaceutical company" is named in 56.05(j) and (n)

App that maintains medical information for the user

Data: Medical information in the app
Main California law: CMIA, as a deemed provider
Notes: 56.06(b)

Mental health or reproductive health app or site

Data: Application information
Main California law: CMIA, as a deemed provider
Notes: 56.06(d)-(e)

Health publisher or general retailer

Data: Browsing, purchases, inferences about health
Main California law: CCPA
Notes: Sensitive personal information if collected and analyzed concerning health, 1798.140(ae)

Ad platform receiving data from any of the above

Data: Whatever it receives
Main California law: Depends on its role and the source
Notes: A CMIA source's disclosure needs authorization, 56.10(a)

Download JSON

Table by AdSovereign, CC BY 4.0.

CMIA rules for marketing and ad tech

What the statute says. A provider, plan or contractor may not disclose medical information "without first obtaining an authorization", unless a listed exception applies (Civ. Code 56.10(a)). Separately, unless the patient expressly authorizes it, they and their affiliates may not share, sell or use medical information for marketing or any purpose not needed for care (56.10(d)).

The authorization form. A valid authorization must be handwritten or in "a typeface no smaller than 14-point type". It must be clearly separate from other language on the page, with a signature that serves no other purpose. It must be signed and dated and state the specific uses and limits (Civ. Code 56.11). A cookie banner or a general terms checkbox does not look like that form.

Deemed providers. Since 1 January 2024, businesses offering a reproductive or sexual health digital service are deemed providers, alongside mental health digital services and apps that maintain medical information (56.06). The section's history note cites AB 254 (Stats. 2023, ch. 254). Such a business must keep the same confidentiality standards as a provider and faces the same penalties (56.06(f)-(g)).

An example. A period-tracking app fires an ad platform's SDK event called "pregnancy_mode_on". The app is a reproductive health digital service and so a deemed provider. The event is medical information derived from the app. Sending it to the platform is a disclosure that needs an authorization meeting 56.11. Using it to target ads is a marketing use under 56.10(d).

What regulators have said. In its 2020 settlement with Glow, a fertility-tracking app, the Attorney General said the company "failed to realize that it had to comply with" the CMIA, which reaches health apps. Glow paid $250,000 (California AG, 17 September 2020).

CMIA remedies and penalties

The CMIA gives individuals two private routes and sets a scale of civil penalties.

6 of 6 rows

Density


Negligent release of medical information	Nominal damages of $1,000 with no need to prove harm, plus actual damages	56.36(b)
Use or disclosure in violation of 56.10 causing economic loss or injury	Compensatory damages, punitive damages up to $3,000, fees up to $1,000	56.35
Negligent disclosure	Fine or civil penalty up to $2,500 per violation	56.36(c)(1)
Knowing and willful violation by a business	Up to $25,000 per violation	56.36(c)(2)(A)
Knowing or willful violation for financial gain	Up to $250,000 per violation, plus disgorgement	56.36(c)(3)(A)
Unauthorized recipient that knowingly and willfully obtains or uses medical information	Up to $250,000 per violation	56.36(c)(5)

Negligent release of medical information

Remedy or penalty: Nominal damages of $1,000 with no need to prove harm, plus actual damages
Citation: 56.36(b)

Use or disclosure in violation of 56.10 causing economic loss or injury

Remedy or penalty: Compensatory damages, punitive damages up to $3,000, fees up to $1,000
Citation: 56.35

Negligent disclosure

Remedy or penalty: Fine or civil penalty up to $2,500 per violation
Citation: 56.36(c)(1)

Knowing and willful violation by a business

Remedy or penalty: Up to $25,000 per violation
Citation: 56.36(c)(2)(A)

Knowing or willful violation for financial gain

Remedy or penalty: Up to $250,000 per violation, plus disgorgement
Citation: 56.36(c)(3)(A)

Unauthorized recipient that knowingly and willfully obtains or uses medical information

Remedy or penalty: Up to $250,000 per violation
Citation: 56.36(c)(5)

Download JSON

Table by AdSovereign, CC BY 4.0.

The last row matters for ad tech. It reaches a person "not permitted to receive medical information" who obtains or uses it knowingly and willfully without written authorization. Whether an ad platform that receives pixel data fits that description is a question for counsel.

CCPA rules for health data in advertising

Sensitive personal information. The list includes precise geolocation and "personal information collected and analyzed concerning a consumer's health", sex life or sexual orientation (Civ. Code 1798.140(ae)). Health information collected or processed "without the purpose of inferring characteristics" is not subject to the right to limit (1798.121(d)).

The right to limit. A consumer may direct a business to limit its use of sensitive personal information to what is "necessary to perform the services or provide the goods reasonably expected by an average consumer" (Civ. Code 1798.121(a)). A business that uses it for other purposes must give notice of that right. This is an opt-out model, not the opt-in consent that Washington or Nevada require; compare Nevada's consumer health data law.

Sharing for ads. "Sharing" means disclosing personal information to a third party for "cross-context behavioral advertising", whether or not money changes hands (1798.140(ah)). Consumers may opt out of sale and sharing, including through the Global Privacy Control, as the Attorney General stressed in the Healthline case. Many publishers pass that status downstream in the Global Privacy Platform (GPP) string.

Penalties and private suits. The California Privacy Protection Agency can impose administrative fines of up to $2,500 per violation, or $7,500 per intentional violation, adjusted for inflation (Civ. Code 1798.155). The CCPA's private right of action covers only certain data breaches (1798.150(c)).

What the Healthline settlement shows

What the AG alleged. The Attorney General alleged that Healthline.com let trackers send advertisers data that could identify a reader together with the article title. Some titles suggested a diagnosis, such as one about being newly diagnosed with MS. The complaint also alleged that opt-outs, including Global Privacy Control signals, were not honoured. It said advertising contracts lacked the CCPA's required terms and that a consent banner did not disable tracking cookies (California AG, 1 July 2025).

The legal theory. The AG used the CCPA's purpose limitation principle. Sharing titles that suggest a diagnosis to target ads was, in the AG's view, not a purpose compatible with why the data was collected. The settlement included $1.55 million in civil penalties and a ban on disclosing information that links a specific consumer to such a title (Healthline judgment, via the AG's list).

Location data. In March 2025 the AG announced an investigative sweep of advertising networks, app providers and data brokers that handle location data, citing risks to reproductive and gender-affirming care (same release).

The 2026 session. The Governor signed several privacy bills and vetoed one that would have broadly restricted the sale and sharing of sensitive personal information (Inside Privacy, 14 October 2026). The CCPA's sensitive data framework therefore stays as described above.

Dates that matter

6 of 6 rows

Density


17 Sep 2020	Glow settlement applies the CMIA to a fertility app ($250,000)	California AG
1 Jan 2024	Reproductive or sexual health digital services deemed providers (AB 254)	Civ. Code 56.06
1 Jul 2025	Healthline settlement, $1.55 million	California AG
20 Sep 2025	SB 81 amends 56.05 and 56.10 (immigration enforcement disclosures)	Civ. Code 56.10
1 Jan 2026	Latest amendment to the CCPA definitions in force (AB 1170)	Civ. Code 1798.140
Sep 2026	Veto of a bill restricting sale and sharing of sensitive personal information	Inside Privacy, 14 October 2026

17 Sep 2020

Event: Glow settlement applies the CMIA to a fertility app ($250,000)
Source: California AG

1 Jan 2024

Event: Reproductive or sexual health digital services deemed providers (AB 254)
Source: Civ. Code 56.06

1 Jul 2025

Event: Healthline settlement, $1.55 million
Source: California AG

20 Sep 2025

Event: SB 81 amends 56.05 and 56.10 (immigration enforcement disclosures)
Source: Civ. Code 56.10

1 Jan 2026

Event: Latest amendment to the CCPA definitions in force (AB 1170)
Source: Civ. Code 1798.140

Sep 2026

Event: Veto of a bill restricting sale and sharing of sensitive personal information
Source: Inside Privacy, 14 October 2026

Download JSON

Table by AdSovereign, CC BY 4.0.

What the text means for each part of an ad stack

6 of 6 rows

Density


Pixels and SDKs in CMIA-covered apps or patient portals	CMIA 56.10(a), (d); 56.11	Disclosure to an ad platform needs a 14-point, separately signed authorization
Audience building from patient or app data	CMIA 56.10(d)	Marketing use needs express authorization
Health publisher tags	CCPA 1798.140(ah); 1798.121	Honour opt-outs of sharing and the right to limit; contract terms with ad partners
Page titles and URLs in ad calls	CCPA purpose limitation, per the Healthline settlement	Titles suggesting a diagnosis are a known enforcement target
Location data	CCPA 1798.140(ae)	Precise geolocation is sensitive; subject to the right to limit
Vendor contracts	CCPA (per the Healthline allegations)	Required privacy terms in advertising contracts, verified rather than assumed

Pixels and SDKs in CMIA-covered apps or patient portals

Law and section: CMIA 56.10(a), (d); 56.11
What changes under the text: Disclosure to an ad platform needs a 14-point, separately signed authorization

Audience building from patient or app data

Law and section: CMIA 56.10(d)
What changes under the text: Marketing use needs express authorization

Health publisher tags

Law and section: CCPA 1798.140(ah); 1798.121
What changes under the text: Honour opt-outs of sharing and the right to limit; contract terms with ad partners

Page titles and URLs in ad calls

Law and section: CCPA purpose limitation, per the Healthline settlement
What changes under the text: Titles suggesting a diagnosis are a known enforcement target

Location data

Law and section: CCPA 1798.140(ae)
What changes under the text: Precise geolocation is sensitive; subject to the right to limit

Vendor contracts

Law and section: CCPA (per the Healthline allegations)
What changes under the text: Required privacy terms in advertising contracts, verified rather than assumed

Download JSON

Table by AdSovereign, CC BY 4.0.

The planned guides to telehealth advertising rules and pharma programmatic advertising apply these rules to two common advertisers. New York's pending bill would add an authorization regime closer to the CMIA's; see New York's Health Information Privacy Act. The ad tech compliance hub links the related pages, and the glossary compares health data terms.

FAQ

Does the CMIA apply to health apps?

Yes, if the app maintains medical information for the user to manage, or for diagnosis or treatment. Such a business "shall be deemed to be a provider of health care" for the CMIA (Civ. Code 56.06(b)). Mental health and reproductive or sexual health digital services are covered too.

Is marketing under the CMIA the same as under HIPAA?

The core definition uses the same words, but the exclusions differ (Civ. Code 56.05(i)). The CMIA excludes unpaid communications, some plan communications and certain paid adherence messages that carry a 14-point notice and an opt-out.

Does the CCPA require opt-in consent to use health data for ads?

No. It gives consumers a right to limit use of sensitive personal information and to opt out of sale and sharing (Civ. Code 1798.121). Medical information under the CMIA follows the CMIA's authorization rule instead.

Can consumers sue over health data used in advertising in California?

Under the CMIA, yes: negligent release supports $1,000 nominal damages without proof of harm (Civ. Code 56.36(b)). The CCPA's private action is limited to certain data breaches (1798.150).

What did the Healthline settlement change for health publishers?

It showed the Attorney General applying purpose limitation to ad tracking. Healthline paid $1.55 million and may not share information linking a consumer to an article title that suggests a diagnosis (California AG, 1 July 2025).

How this works on owned infrastructure

The California split raises one practical question for every health data flow: did this record start as CMIA medical information, or as CCPA personal information? The answer decides whether a 14-point signed authorization or an opt-out check governs the next step. When records from a patient app and from a publisher site meet in a third-party platform, that origin is usually lost. AdSovereign is designed to keep audience records and their source tags on the operator's own servers. A CMIA-origin record can then be blocked from any marketing segment unless an authorization record exists, while CCPA records follow opt-out and limit flags. The use cases page covers health configurations, and security describes access controls.

Sources

California Legislative Information, Civil Code 56.05, CMIA definitions (amended by SB 81, effective 20 September 2025), read 9 November 2026. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.05
California Legislative Information, Civil Code 56.06, businesses deemed providers (amended by AB 254, Stats. 2023 ch. 254, effective 1 January 2024). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.06
California Legislative Information, Civil Code 56.10, disclosure and marketing use. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10
California Legislative Information, Civil Code 56.11, authorization requirements. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.11
California Legislative Information, Civil Code 56.35, damages. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.35
California Legislative Information, Civil Code 56.36, remedies and penalties. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.36
California Legislative Information, Civil Code 1798.140, CCPA definitions (amended by AB 1170, effective 1 January 2026). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140
California Legislative Information, Civil Code 1798.121, right to limit use of sensitive personal information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.121
California Legislative Information, Civil Code 1798.146, exemptions for medical information and PHI. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.146
California Legislative Information, Civil Code 1798.150, private action for breaches. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150

More sources (5)

California Legislative Information, Civil Code 1798.155, administrative enforcement. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.155
California Attorney General, "Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com" (1 July 2025). https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155
California Attorney General, "Attorney General Becerra Announces Landmark Settlement Against Glow, Inc." (17 September 2020). https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-landmark-settlement-against-glow-inc-%E2%80%93
California Attorney General, Privacy Enforcement Actions (list), checked 9 November 2026. https://oag.ca.gov/privacy/privacy-enforcement-actions
Covington & Burling, Inside Privacy, "California Enacts New Privacy Legislation Affecting Consumer Rights, Data Brokers, and Website Tracking Litigation" (14 October 2026). https://www.insideprivacy.com/state-privacy/california-enacts-new-privacy-legislation-affecting-consumer-rights-data-brokers-and-website-tracking-litigation/

Changelog

9 November 2026: page created; CMIA and CCPA sections read on California Legislative Information; enforcement from the Attorney General's releases.

Author: Art Kukharenko, CEO, AdSovereign. Published: 10 November 2026. Last updated: 10 November 2026.