Third-Party Data Sharing and Data Brokers
How health and wellness app data can reach advertisers and data brokers, with US Federal Trade Commission cases as the record, plus what the cases do and do not prove.
Content last updated . This page has not been medically reviewed.
Why this matters
Many people assume the information in a health or wellness app stays with the app. Official records show that is not always true. This page summarizes what the US Federal Trade Commission (FTC) has said in public enforcement actions, using the agency's own press releases. These are allegations and settlement terms, mostly agreed without a trial. They show what regulators consider unlawful. They do not show how common the practices are today, and they say nothing about any app not named. This is education, not legal advice; laws and cases change.Who can get your data
- Advertising and analytics companies. An app can include code from other companies that measures use or targets ads. If an app sends health details through that code, those companies receive them.
- Data brokers. The FTC has described data brokers as obtaining and sharing vast amounts of consumer information, typically behind the scenes, without consumer knowledge. [1]
- Buyers of a company. If a company is sold or goes bankrupt, its data can be among the assets. See the 23andMe example below.
What the FTC has alleged and ordered
| Case (date) | What the FTC said | Outcome as stated |
|---|---|---|
| Flo Health, period and fertility app (final order June 2021) | Despite promising to keep users' health data private, it shared sensitive health data from millions of users with firms including Facebook and Google [2] | Must get users' affirmative consent before sharing health information; independent review of privacy practices [2] |
| GoodRx, prescription discount service (Feb 2023) | Shared sensitive personal health information with advertising companies for years [3] | Proposed order: $1.5 million penalty for violating the Health Breach Notification Rule, ban on sharing health data with applicable third parties for advertising; court approval needed [3] |
| Premom, ovulation tracking app (May 2023) | Failed to fully disclose its data sharing and broke direct promises to users [4] | Proposed order: $100,000 civil penalty; permanent ban on sharing personal health data with third parties for advertising [4] |
| BetterHelp, online counseling (final order July 2023) | Shared consumers' sensitive data with third parties after promising to keep it private [5] | $7.8 million used for partial refunds; ban on sharing personal information for re-targeting; consent required before disclosing to certain third parties [5] |
Each of these companies is named only because the FTC named it. Other apps were not examined here, and a company appearing in this table is not a statement about its practices today.
Location data and brokers
The FTC has also acted against companies that sell location data, which can reveal visits to health clinics. Examples as stated by the agency:- X-Mode Social and Outlogic (January 2024): the order says they will be prohibited from sharing or selling any sensitive location data. [6]
- Mobilewalla (December 2024): the FTC alleged it sold access to raw location data to third parties, including advertisers and data brokers, and that the data was not anonymized; the order concerns sensitive locations such as health clinics. [7]
- Gravy Analytics and Venntel (final order January 2025): the complaint alleged geofencing was used to identify and sell lists of consumers who visited healthcare facilities and places of worship. [8]
- Kochava (May 2026): the FTC filed a proposed order that would bar selling sensitive location data without affirmative express consent. It is a proposal until a court approves it. [9]
More on this theme is in genetic and location data privacy.
What the cases do and do not tell you
- They show that sharing health data with advertisers, against a company's own promises, has been treated as unlawful in the cases above.
- They do not show that every app shares data, or that data in a given app has been misused.
- Privacy law differs by place and by type of company. See health data vs consumer-app data privacy.
- Sharing can also happen through a program sponsored by an employer or insurer; see employer and insurer wellness programs.
Questions worth asking before you sign up
The FTC suggests looking for a privacy notice that explains in simple terms what health information an app collects, and notes that default settings often encourage sharing, so choosing more protective options can be useful. [10] It also advises turning off unnecessary permissions or deleting apps that request many permissions they do not need to function. [11] See app permissions and cloud storage for more.Frequently asked questions
Is it illegal for a health app to share my data with advertisers?
It depends on the law that applies and on what the company promised. In the cases above, the FTC alleged sharing broke the company's own promises or breached a rule, and orders banned or limited the practice. [2][3][4] That is not a rule that fits every app or country.
Are FTC settlements proof the companies did wrong?
They record what the FTC alleged and what the company agreed to or was ordered to do. Some orders were proposed and needed court approval. [3][9]
What is a data broker?
The FTC describes data brokers as companies that obtain and share large amounts of consumer information, typically behind the scenes. [1]
Can location data show health information?
The FTC has alleged that location data was used to identify visits to healthcare facilities. [8]
How can I limit sharing?
Review privacy settings and permissions, and consider deleting apps you do not need. [10][11] See account deletion and exporting your data.
References
- FTC. FTC Recommends Congress Require the Data Broker Industry to be More Transparent (27 May 2014). Read 2026-10-22.
- FTC. FTC Finalizes Order with Flo Health (22 Jun 2021). Read 2026-10-22.
- FTC. FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising (1 Feb 2023). Read 2026-10-22.
- FTC. Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order (17 May 2023). Read 2026-10-22.
- FTC. FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising (14 Jul 2023). Read 2026-10-22.
- FTC. FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (9 Jan 2024). Read 2026-10-22.
- FTC. FTC Takes Action Against Mobilewalla for Collecting and Selling Sensitive Location Data (3 Dec 2024). Read 2026-10-22.
- FTC. FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (14 Jan 2025). Read 2026-10-22.
- FTC. FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data (4 May 2026; proposed order). Read 2026-10-22.
- FTC Consumer Advice. Does your health app protect your sensitive info? (13 Jan 2021). Read 2026-10-22.
- FTC Consumer Advice. How Websites and Apps Collect and Use Your Information (September 2023). Read 2026-10-22.
Education, not medical advice. This page is for general information. It does not diagnose or treat any condition and is not a substitute for care from a qualified health professional. Natural does not automatically mean safe. Ask a clinician or pharmacist before changing your care, especially if you take medication, are pregnant or breastfeeding, or have a health condition.