1. Introduction

Cross-context behavioral targeting using health signals refers to the collection, analysis, combination, and commercial use of an individual's health-related information across different digital environments to predict, influence, or modify that individual's behaviour.

It occurs when information generated in one context, such as a healthcare application, fitness tracker, online pharmacy, medical website, wearable device, or telemedicine platform, is used in another context, such as:

Targeted advertising and commercial marketing.

Insurance pricing and risk assessment.

Employment-related decision-making.

Financial product recommendations.

Political or commercial persuasion.

Consumer profiling and behavioural prediction.

Personalised pricing and automated decision-making.

Example: An individual searches for information about diabetes on a medical website. A third-party advertising network combines that information with fitness-app activity, location history, and online shopping behaviour. The network subsequently delivers advertisements for diabetes medication, insurance products, dietary supplements, or related financial services.

The legal concern is not limited to whether the information is technically medical information. Even seemingly ordinary data, such as sleep patterns, exercise frequency, heart rate, menstrual-cycle information, or food purchases, may reveal an individual's health status.

The central legal question is:

To what extent may an organisation use health-related information collected in one context to influence an individual's behaviour in another context without violating privacy, data-protection, consumer-protection, and human-rights principles?

2. Meaning and Nature of Cross-Context Behavioural Targeting

Cross-context targeting involves the transfer or reuse of personal information beyond the purpose and environment for which it was originally collected.

It generally has five stages:

Collection: Health signals are collected through applications, devices, websites, medical platforms, or connected services.

Aggregation: Data from different sources are combined into a behavioural profile.

Inference: Algorithms predict possible diseases, medical conditions, psychological characteristics, or health-related preferences.

Targeting: The inferred profile is used to select advertisements, offers, recommendations, or other interventions.

Behavioural influence: The individual is encouraged to purchase a product, change conduct, obtain a service, or make a particular decision.

Frontiers | Mind the FemTech gap: regulation failings and exploitative systems

frontiersin.org

A significant legal distinction exists between ordinary contextual advertising and cross-context behavioural targeting.

The second practice creates greater privacy concerns because individuals may not reasonably expect their healthcare-related activities to influence unrelated commercial decisions.

3. Legal Restrictions on Health-Signal Processing

A. Special-category protection of health information

Under the European Union's General Data Protection Regulation (GDPR), health information receives enhanced protection.

Article 4(15) defines data concerning health broadly to include personal data relating to physical or mental health, including information revealing the health status of an individual.

Article 9(1) generally prohibits processing special-category personal data, including health data, subject to specified exceptions.

Article 9(2) provides limited grounds on which such processing may be permitted, including:

Explicit consent.

Certain healthcare and medical-treatment purposes.

Public-health interests under appropriate legal safeguards.

Scientific research under applicable conditions.

Substantial public interest under a legal framework.

Legal implication: A business cannot automatically justify health-based advertising merely by arguing that it has a legitimate commercial interest in personalised marketing. It must satisfy the applicable Article 9 exception as well as an Article 6 lawful basis.

B. Purpose limitation

Article 5(1)(b) GDPR requires personal data to be collected for specified, explicit and legitimate purposes.

Consequently, information collected to provide medical treatment cannot automatically be reused for unrelated advertising.

For example:

A hospital collects information to diagnose a patient.

A fitness application collects information to monitor exercise.

A fertility platform collects information to provide reproductive services.

These organisations cannot simply assume that the original collection authorises behavioural advertising.

C. Transparency and informed consent

Articles 12, 13 and 14 GDPR require appropriate transparency concerning personal-data processing.

Organisations should disclose:

What health-related signals are collected.

Whether third-party tracking technologies are used.

Which advertising platforms receive the information.

Whether health-related inferences are generated.

Whether the information is used for behavioural targeting.

Whether automated profiling takes place.

How consent can be withdrawn.

Consent must satisfy Article 4(11): it must be freely given, specific, informed and unambiguous.

Where Article 9 applies, explicit consent under Article 9(2)(a) is required if consent is the chosen exception.

A general acceptance of lengthy terms and conditions should not automatically be treated as explicit consent to health-based advertising.

D. Restrictions on profiling and automated decisions

Article 22 GDPR regulates certain decisions based solely on automated processing, including profiling, where they produce legal effects or similarly significant effects on individuals.

For example, an insurer's automated decision to refuse coverage because an algorithm predicts a medical condition may raise Article 22 concerns.

However, not every targeted advertisement automatically falls within Article 22. The legal assessment depends on the nature and consequences of the decision.

Article 35 also requires a Data Protection Impact Assessment (DPIA) in specified circumstances, particularly where processing is likely to result in high risks to individuals' rights and freedoms.

4. Important Judicial Decisions and Case Laws

The following cases establish important principles concerning cross-context data use, health information, consent, profiling, and informational privacy.

Case 1. Meta Platforms Inc. v Bundeskartellamt (2023)

Highly relevant landmark judgment

Citation: Case C-252/21, ECLI:EU:C:2023:537, Court of Justice of the European Union, 4 July 2023.

Facts:

Meta collected information from users' activities outside Facebook, including visits to third-party websites and applications.

It subsequently linked that information with users' Facebook accounts to create detailed behavioural profiles and provide personalised advertisements.

The German Federal Cartel Office challenged the practice.

Legal issues:

Whether information collected outside a social network could be combined with platform information.

Whether such processing could reveal special-category information.

Whether users' consent was valid.

Whether commercial advertising interests justified extensive data processing.

Judgment:

The CJEU held that collecting information from third-party websites and applications, linking it to social-network accounts and using the resulting information may constitute processing of special-category data under Article 9 GDPR where it reveals protected information.

Importantly, this can apply even where the information is not deliberately provided by the individual as health information.

The Court also explained that the platform's dominant market position is relevant when assessing whether consent is genuinely freely given.

Legal principles:

Off-platform information can become protected personal information when linked with other data.

Information revealing health-related characteristics may attract Article 9 protection.

Consent must be genuinely voluntary.

Commercial personalisation does not automatically override fundamental privacy rights.

Relevance: This is one of the most important authorities for restricting cross-context behavioural targeting using health signals.

EUR-Lex+2

Case 2. Justice K.S. Puttaswamy (Retd.) v Union of India (2017)

Citation: (2017) 10 SCC 1; AIR 2017 SC 4161.

Court: Supreme Court of India, nine-judge Constitution Bench.

Facts:

The case concerned whether the Constitution of India recognises privacy as a fundamental right.

Legal issue:

Whether privacy, informational autonomy and individual control over personal information receive constitutional protection.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms guaranteed by Part III of the Constitution.

Justice D.Y. Chandrachud's opinion discussed informational privacy and the dangers arising from the processing of personal information by both State and non-State actors.

The judgment also established a three-part test for assessing permissible privacy restrictions:

Legality: There must be a valid legal basis.

Legitimate aim: The interference must pursue a legitimate objective.

Proportionality: The means adopted must be proportionate to that objective.

Legal principles:

Informational privacy is constitutionally protected.

Personal autonomy includes control over personal information.

Technological innovation does not eliminate privacy obligations.

Data-processing practices must respect constitutional liberty and dignity.

Relevance: In India, this judgment provides an important constitutional foundation for challenging intrusive health-data profiling and behavioural targeting.

It is not a direct ruling on health-based advertising, but its privacy principles are highly relevant.

Indian Kanoon+2

Case 3. Commissioner Initiated Investigation into Monash IVF Pty Ltd (2026)

Directly relevant health-advertising determination

Citation: [2026] AICmr 40, 11 June 2026.

Authority: Australian Information Commissioner.

Facts:

Monash IVF used third-party tracking pixels on its fertility-service website.

These technologies collected information about individuals' website interactions and enabled information to be shared with external platforms for advertising purposes.

Legal issues:

Whether website interactions relating to fertility services could constitute sensitive health information.

Whether tracking pixels amounted to collection of sensitive information.

Whether appropriate consent was obtained.

Whether the information could be used for targeted advertising.

Determination:

The Privacy Commissioner found privacy breaches involving Australian Privacy Principles (APPs) 3.3, 5.1, 5.2 and 7.1.

The determination treated information collected through tracking pixels on fertility-related webpages as sensitive information where it could reveal an individual's health circumstances or concerns.

The Commissioner found that consent was required for the relevant collection and direct-marketing use.

Legal principles:

Website interactions can reveal sensitive health information.

Tracking pixels can constitute personal-information collection.

Health-service providers must consider third-party advertising technologies in their privacy compliance.

Targeted advertising using sensitive health information requires appropriate consent.

Relevance: This determination is particularly important because it addresses the precise problem of transferring health-related browsing information into advertising ecosystems.

OAIC+2

Case 4. Commissioner Initiated Investigation into Medmate Australia Pty Ltd (2026)

Citation: [2026] AICmr 41, 11 June 2026.

Facts:

Medmate, an Australian telehealth provider, used third-party tracking pixels on its website.

The tracking technologies collected information concerning users' interactions with healthcare-related content.

Legal issue:

Whether the collection and subsequent use of website interaction information for targeted advertising violated Australian privacy requirements.

Determination:

The Australian Privacy Commissioner found breaches of APPs 3.3, 5.1, 5.2 and 7.1.

The decision emphasised that health-related browsing information may constitute sensitive information even when users have not directly entered a medical diagnosis into a website.

Legal principles:

Health information can be inferred from online conduct.

Third-party advertising technologies can create sensitive-data processing obligations.

Privacy notices must adequately explain relevant collection practices.

Consent requirements cannot be avoided by describing tracking as ordinary website analytics.

Relevance: This decision provides a practical regulatory precedent against undisclosed health-data sharing for behavioural advertising.

OAIC+1

Case 5. FTC v GoodRx Holdings, Inc. (2023)

Authority: United States Federal Trade Commission.

Nature: Federal Trade Commission enforcement proceeding and proposed stipulated order.

Facts:

GoodRx operated digital healthcare and prescription-related services.

The FTC alleged that GoodRx disclosed users' sensitive health information to advertising companies and other third parties without adequately informing consumers or obtaining the required consent.

Legal issues:

Whether health information could be disclosed to advertising platforms without proper authorisation.

Whether privacy representations were deceptive.

Whether the Health Breach Notification Rule applied.

Outcome:

The FTC pursued enforcement under the FTC Act and the Health Breach Notification Rule. The resulting order imposed restrictions and compliance obligations concerning the handling and disclosure of health information.

Legal principles:

Health-related information cannot be treated as ordinary advertising data.

Misleading privacy statements can constitute deceptive commercial conduct.

Sharing identifiable health information with advertising networks can trigger regulatory obligations.

Consumer consent and accurate privacy disclosures are essential.

Relevance: This enforcement action demonstrates that companies outside traditional hospital and insurance systems can also face health-privacy enforcement for advertising-related disclosures.

It is an administrative enforcement matter rather than a conventional appellate judicial precedent.

Federal Trade Commission+1

Case 6. FTC v BetterHelp, Inc. (2023)

Authority: United States Federal Trade Commission.

Nature: FTC enforcement proceeding.

Facts:

BetterHelp provided online mental-health counselling services.

The FTC alleged that the company disclosed sensitive information, including information connected with users' mental-health services, to advertising platforms despite privacy representations that allegedly suggested stronger confidentiality protections.

Outcome:

The FTC obtained an order restricting certain disclosures of health information for advertising purposes and requiring other consumer-protection measures.

Legal principles:

Mental-health information requires particularly careful handling.

Privacy representations must accurately reflect actual data practices.

Companies must not create misleading impressions about the confidentiality of health information.

Third-party advertising relationships must be included in privacy compliance assessments.

Relevance: This matter demonstrates the risks of converting confidential mental-health service interactions into commercial advertising intelligence.

As with GoodRx, this is an enforcement proceeding, not a judicial appellate ruling.

Federal Trade Commission

5. Indian Legal Framework

India does not have a separate comprehensive statute exclusively regulating health-data-based behavioural advertising. Several legal frameworks are relevant.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) provides the principal general framework for digital personal-data processing in India.

Important provisions include:

Important distinction: Unlike the GDPR, the DPDP Act does not create a separate statutory category of sensitive personal data specifically for health information. Nevertheless, identifiable health information falls within personal data when it relates to an identifiable individual.

Consequently, organisations processing such information must comply with applicable DPDP obligations.

B. Restrictions on children's behavioural targeting

Section 9(3) of the DPDP Act restricts processing that involves tracking or behavioural monitoring of children and targeted advertising directed at children, subject to the statutory framework and applicable exemptions.

This is particularly important for:

Children's fitness applications.

Paediatric healthcare platforms.

Educational health-monitoring applications.

Child-focused nutrition services.

Digital mental-health platforms.

A company cannot simply rely on commercial advertising interests to avoid the statutory protections applicable to children.

C. Information Technology Act, 2000

Section 43A historically provided compensation for failure by a body corporate to maintain reasonable security practices in relation to sensitive personal data or information.

Section 72A addresses disclosure of personal information in breach of a lawful contract, subject to its statutory elements.

The interaction of these provisions with the DPDP framework and applicable repeal and transitional arrangements must be assessed according to the relevant commencement notifications.

D. Constitutional protection under Article 21

Following Puttaswamy, the collection and use of health information may raise constitutional privacy concerns.

For example, an organisation that secretly combines fertility information, medical searches and behavioural profiles to influence an individual's commercial decisions may raise questions of informational autonomy, dignity and privacy.

The constitutional position is particularly significant where State authorities are involved or where a challenge concerns State action.

E. Consumer Protection Act, 2019

Health-based advertising can also create consumer-protection issues.

Relevant concerns include:

Misleading medical claims.

Manipulative advertisements.

Concealment of commercial relationships.

False claims concerning health products.

Unfair trade practices.

Misrepresentation of privacy protections.

The Consumer Protection Act and applicable advertising standards may therefore operate alongside data-protection requirements.

6. International Legal Framework

A. European Union – GDPR

The GDPR offers one of the most comprehensive legal frameworks for regulating cross-context health-data targeting.

Important provisions include:

Article 5: Principles of personal-data processing.

Article 6: Lawfulness of processing.

Article 9: Special-category personal data.

Article 12–14: Transparency and information.

Article 21: Right to object.

Article 22: Automated individual decision-making.

Article 25: Data protection by design and default.

Article 32: Security of processing.

Article 35: Data Protection Impact Assessment.

A company that uses medical browsing histories to construct advertising profiles must examine both the lawful basis and the special-category processing restrictions.

B. United States – HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) protects specified health information held by covered entities and their business associates.

However, HIPAA does not automatically cover every fitness application, wellness platform, consumer health website or advertising technology company.

This creates a regulatory gap where consumer health information may fall outside HIPAA but still be protected under other laws.

Relevant safeguards may arise under:

Federal Trade Commission Act.

FTC Health Breach Notification Rule.

State consumer-health privacy legislation.

State comprehensive privacy statutes.

State unfair-trade-practices legislation.

The FTC's amended Health Breach Notification Rule, effective from 29 July 2024, expressly addresses certain health applications and similar technologies. The FTC explains that sharing identifiable medical information and mobile identifiers with an advertising network without consent can fall within the Rule's breach framework.

Federal Trade Commission+2

C. Australia – Privacy Act 1988

Australia regulates health information as sensitive information under its privacy framework.

Particularly important are:

APP 3: Collection of solicited personal information.

APP 5: Notification of collection.

APP 6: Use or disclosure of personal information.

APP 7: Direct marketing.

APP 11: Security of personal information.

The 2026 Monash IVF and Medmate determinations demonstrate the practical application of these requirements to tracking pixels and targeted advertising.

7. Restrictions on Particular Categories of Health Signals

Different health signals create different legal risks.

The most important point is that legal protection may arise from what information reveals, rather than simply from how the information was originally labelled.

8. Major Legal Doctrines

A. Contextual Integrity Doctrine

Contextual integrity concerns whether information flows are appropriate to the social context in which information is collected.

For example, a person may disclose reproductive-health information to obtain fertility treatment.

That disclosure does not necessarily create a reasonable expectation that the information will subsequently be shared with advertising companies.

Cross-context targeting can violate contextual expectations even where the organisation technically possesses the information.

B. Purpose Limitation Doctrine

Information should not be repurposed incompatibly with its original collection purpose.

A hospital's diagnostic database should not automatically become a commercial marketing database.

C. Data Minimisation Doctrine

Organisations should collect and process only the information necessary for the stated purpose.

Collecting complete medical histories to generate ordinary commercial recommendations may be excessive.

D. Inference-Based Privacy Doctrine

Privacy protection should extend to sensitive characteristics inferred through seemingly non-sensitive information.

For example, a combination of:

Frequent visits to fertility websites.

Purchase of pregnancy-related products.

Menstrual-cycle tracking.

Searches concerning reproductive treatment.

may reveal sensitive reproductive-health information even without an explicit medical diagnosis.

The Meta Platforms judgment is particularly important for this doctrine.

E. Autonomy and Non-Manipulation Doctrine

Health information can reveal vulnerabilities.

Targeting a person who is experiencing depression, infertility, chronic illness or anxiety may create opportunities for manipulation.

The law should distinguish legitimate informational advertising from exploitative behavioural influence.

F. Privacy by Design Doctrine

Organisations should incorporate privacy safeguards into the architecture of digital health systems.

Examples include:

Disabling unnecessary third-party tracking pixels.

Preventing advertising SDKs from receiving health-related events.

Separating clinical databases from marketing databases.

Using privacy-preserving analytics.

Restricting access to sensitive information.

Testing algorithmic inference risks.

9. Legal Liability of Different Participants

Cross-context targeting often involves several independent participants.

Liability is not automatic merely because an organisation participates in the data ecosystem. It depends on its legal role, actual conduct, contractual responsibilities, applicable statutory obligations and causal connection to the violation.

10. Regulatory Restrictions and Compliance Requirements

A legally compliant organisation should establish the following safeguards.

1. Separate consent mechanisms

Consent for healthcare services should be separated from consent for unrelated behavioural advertising where consent is the applicable legal basis.

2. Explicit disclosure of tracking

Privacy notices should explain the use of cookies, pixels, advertising SDKs and third-party analytics.

3. Prohibition of unauthorised health-data transfers

Sensitive health information should not be transferred to advertising platforms without a valid legal basis and compliance with applicable special-category restrictions.

4. Restriction on inferred health profiles

Organisations should assess whether seemingly ordinary browsing or purchasing information reveals protected health characteristics.

5. Data protection impact assessments

High-risk processing should undergo appropriate impact assessment before deployment.

6. Algorithmic accountability

Organisations should document the purposes, inputs, outputs and foreseeable discriminatory consequences of health-related profiling systems.

7. Retention limitations

Health signals should not be retained indefinitely for advertising or commercial prediction.

8. Third-party vendor controls

Contracts with advertising networks and analytics providers should specify permitted purposes, security obligations, retention limits and restrictions on onward disclosure.

9. Individual rights

Individuals should have access to applicable rights concerning information, correction, erasure, objection or withdrawal of consent, depending on the governing law.

10. Breach response

Organisations should establish procedures for investigating unauthorised disclosure and making notifications required by applicable law.

11. Emerging Legal Challenges

Several emerging issues require further legislative and judicial attention.

A. Predictive health advertising

Artificial intelligence can predict potential medical conditions before an individual receives a formal diagnosis. The use of such predictions for advertising raises questions concerning accuracy, consent and discriminatory treatment.

B. Cross-device health tracking

A person's smartwatch, smartphone, healthcare application and social-media account may collectively generate a detailed health profile. Determining responsibility among the organisations involved becomes difficult.

C. Genetic and reproductive profiling

Genetic information and reproductive-health signals can reveal intimate characteristics. Their use for insurance marketing, employment-related profiling or commercial targeting creates serious privacy and discrimination concerns.

D. Mental-health vulnerability targeting

Advertising systems may identify individuals experiencing anxiety, depression or emotional distress and direct products or services towards them.

This raises concerns about manipulation, exploitation and meaningful autonomy.

E. International transfers

Health information may travel between jurisdictions with different privacy protections. Organisations must assess international transfer requirements and the responsibilities of overseas recipients.

F. Algorithmic discrimination

Health-based predictions may result in discriminatory insurance offers, exclusion from services, personalised pricing or other adverse treatment.

The law must distinguish legitimate health-related personalisation from unfair or discriminatory profiling.

12. Critical Analysis: India Compared With Other Jurisdictions

India's framework is important because it establishes general data-protection obligations without adopting the GDPR's separate special-category classification for health information.

This does not mean that health information is unprotected in India. It means that its protection must be assessed through the general DPDP framework, constitutional privacy principles and other applicable laws.

The Australian 2026 determinations and the CJEU's 2023 Meta Platforms judgment provide particularly useful comparative material for developing Indian regulatory standards.

13. Conclusion

Cross-context behavioural targeting using health signals presents a significant challenge to contemporary data-protection law.

The traditional distinction between medical information and ordinary consumer information is increasingly difficult to maintain because modern algorithms can infer health characteristics from browsing behaviour, location, wearable devices, purchasing patterns and digital interactions.

The legal framework must therefore address not only the collection of medical records but also the generation, aggregation, transfer and commercial exploitation of inferred health information.

Three authorities are especially important:

Meta Platforms v Bundeskartellamt (2023) establishes that combining off-platform information can amount to special-category data processing when protected information is revealed.

Justice K.S. Puttaswamy v Union of India (2017) establishes the constitutional foundation of informational privacy and individual autonomy in India.

Monash IVF and Medmate (2026) demonstrate that tracking pixels used for health-related targeted advertising can violate privacy obligations.

The central legal principle is that collecting health information for one legitimate purpose does not create unrestricted permission to use that information for behavioural manipulation or unrelated commercial targeting.

The future regulatory approach should combine purpose limitation, meaningful consent, restrictions on sensitive-data inference, algorithmic accountability, privacy by design and effective remedies for affected individuals.

14. Important Legal Authorities and Research Materials

Primary research sources:

CJEU – Official judgment in Meta Platforms, Case C-252/21.

Supreme Court of India – Puttaswamy judgment.

Australian Privacy Commissioner – 2026 tracking-pixel determinations.

Digital Personal Data Protection Rules, 2025.

FTC – Health information, HIPAA and consumer protection guidance.

Research qualification: The Indian Supreme Court cases discussed above establish general constitutional principles rather than a direct judicial prohibition on health-based behavioural advertising. Similarly, the Australian 2026 matters are Privacy Commissioner determinations, while the GoodRx and BetterHelp matters are FTC enforcement proceedings, not conventional court judgments.

This distinction is important when using these authorities in a dissertation, law journal article or judicial submission.