1. Introduction

The sale of inferred health traits by data brokers is a major issue in contemporary privacy, data-protection, consumer-protection and discrimination law. It occurs when a company collects information about individuals, analyses it to predict their health conditions or vulnerabilities, and sells or licenses those predictions to advertisers, insurers, employers, data analytics companies or other third parties.

Unlike medical records, inferred health traits may be created from seemingly ordinary information, including:

Online searches for symptoms, medicines or treatments.

Shopping histories involving supplements, pregnancy tests or medical products.

Location data showing visits to hospitals, fertility clinics or addiction-treatment facilities.

Fitness-tracker information, browsing behaviour and app usage.

Demographic, financial and behavioural profiles used to predict disease risk, pregnancy, depression or other health conditions.

The central legal question is whether a data broker may lawfully infer, disclose, sell or commercially exploit information about a person's health without that person's meaningful knowledge or consent.

The answer depends on the jurisdiction, the sensitivity of the inference, the source of the data, the purpose of processing, the legal basis for disclosure, and whether the sale creates risks of discrimination or other harm. Information does not necessarily cease to be sensitive merely because it is inferred rather than obtained from a doctor.

2. Meaning and scope of inferred health traits

A. What is an inferred health trait?

An inferred health trait is a prediction or classification about an individual's actual or possible health status derived from other information.

Examples include:

These are examples of possible predictions, not necessarily accurate medical conclusions. A broker's inference may be wrong, outdated or statistically unreliable, yet still expose an individual to stigma, manipulation or adverse decisions.

B. How the data-broker market operates

1. Data collection

Apps, websites, retailers, location services and public records

2. Profiling and inference

Algorithms estimate health conditions, risks or vulnerabilities

3. Commercial sale or licensing

Broker supplies audience segments, scores or individual-level profiles

4. Downstream use

Advertising, eligibility decisions, pricing, research or other profiling

At each stage, a different legal issue may arise. A company may have permission to collect information for one purpose but lack a lawful basis to infer a sensitive trait or sell it for a different purpose.

3. Legal framework in India

India is particularly relevant because the sale of inferred health profiles may implicate constitutional privacy, information-technology rules, consumer protection and the developing statutory data-protection framework.

A. Constitutional right to privacy

In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, the nine-judge Bench of the Supreme Court recognised privacy as a fundamental right protected under Article 21 and other freedoms in Part III of the Constitution. The judgment emphasised dignity, autonomy and informational privacy.

Indian Kanoon+1

Application to data brokers: The case did not specifically decide whether private data brokers may sell inferred health traits. However, its recognition of informational privacy provides an important constitutional foundation for challenging unlawful state interference and for developing legal protections against misuse of personal information by private entities.

A constitutional challenge generally requires a legally sufficient connection to state action; the judgment does not automatically make every private commercial data transaction a direct constitutional violation.

B. Information Technology Act, 2000 and SPDI Rules, 2011

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, are relevant to qualifying Indian body corporates handling sensitive personal data.

Rule 3 identifies categories including physical, physiological and mental health conditions, medical records and history. Rules 5 and 6 address collection, consent, use and disclosure, subject to their precise requirements and exceptions.

This raises two questions:

Does the inferred information reveal or concern a person's health condition or medical history?

Is the entity, processing activity and disclosure covered by the Rules?

A health-risk score derived from browsing history may present a stronger case for sensitive-data treatment than a generic advertising segment. The legal classification depends on the actual information and processing, not merely the broker's label.

Important limitation: The SPDI Rules do not operate as a universal, comprehensive data-broker law covering every possible business and transaction. Their scope and interaction with subsequent legislation must be assessed in the particular case.

C. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023, establishes a framework for processing digital personal data, including obligations relating to lawful purposes, notice, consent where required, security and individual rights. The official statutory text is available through India Code.

India Code

The DPDP Rules, 2025, were notified in November 2025, but commencement is staggered. As of 4 November 2026, the Act's principal substantive processing provisions are not yet in force; the notified timeline generally schedules them for 18 months after publication in November 2025. Therefore, the applicable commencement notification must be checked before treating those provisions as currently enforceable.

MeitY+2

Under the Act's framework, a data broker cannot assume that commercially useful information is freely saleable simply because it was generated by an algorithm. Once the relevant provisions are operative, the broker's collection, inference, disclosure and further use must be assessed against the Act's applicable requirements and exceptions.

One important distinction is that the DPDP Act does not establish the same separate statutory category for health data that the EU GDPR establishes for special-category data. That does not mean health information is unprotected; it means the applicable legal analysis differs.

4. Comparative legal position

A. European Union: GDPR

The EU provides one of the clearest legal approaches to inferred health traits.

Article 9 GDPR generally prohibits processing personal data concerning health unless a specified exception applies. Article 6 separately requires a lawful basis for processing. Consequently, satisfying Article 6 alone does not necessarily permit the processing or sale of health-related inferences.

Legislation.gov.uk+1

The UK Information Commissioner's Office likewise explains that profiling which infers health status or health risks may involve special-category data, even where the inference is uncertain.

ICO+1

For a data broker, this means:

Inferring a health condition can itself constitute regulated processing.

Selling a health-risk classification can constitute a further disclosure or processing operation.

Consent to ordinary advertising is not automatically explicit consent to processing health data.

The broker must assess each applicable legal requirement and exception.

B. United States: FTC and state privacy laws

The United States does not have a single comprehensive federal law that prohibits every sale of inferred health information. Instead, several legal regimes may apply.

The Federal Trade Commission Act prohibits unfair or deceptive acts or practices in commerce. A broker or app may face enforcement where its conduct contradicts privacy representations, conceals material data-sharing practices, or creates legally actionable consumer harm.

HIPAA is not a universal health-privacy law for every company handling health-related data. Independent apps, advertising platforms and data brokers may fall outside HIPAA's coverage while remaining subject to other laws. The FTC expressly recognises that browsing, location and purchase information may reveal health information.

Federal Trade Commission+1

Some state laws provide additional protections. For example, Washington's My Health My Data Act regulates consumer health data and certain sales, with consent and other statutory requirements. Other states impose restrictions on sensitive personal data, targeted advertising, profiling or data-broker activities.

A transaction therefore requires a jurisdiction-specific analysis rather than the assumption that all American health-data sales are either permitted or prohibited.

5. Leading case laws and enforcement decisions

The following cases are particularly relevant. Some are binding judicial judgments; others are regulatory enforcement proceedings. That distinction matters because an FTC consent order, for example, is not equivalent to a Supreme Court precedent.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: A nine-judge Bench considered whether privacy is protected as a fundamental right under the Indian Constitution.

Decision: The Court unanimously recognised the fundamental right to privacy, including its connection with dignity, autonomy and informational privacy.

Indian Kanoon+1

Application to inferred health data: An individual's medical vulnerabilities, reproductive circumstances or mental-health risks can reveal deeply personal aspects of life. The principles of privacy and autonomy provide a foundation for evaluating intrusive profiling and disproportionate information disclosure.

Legal significance: The judgment supports a rights-based understanding of health privacy, but it does not itself create a blanket statutory prohibition against private data brokers selling health inferences.

Case 2: Meta Platforms Inc. v. Bundeskartellamt (2023)

Court of Justice of the European Union · Case C-252/21 · ECLI:EU:C:2023:537

Facts: The dispute concerned Meta's combination and use of information collected through its social network and users' activities on other websites and apps.

Issue: Whether data collection and combination that reveals special-category information can fall under Article 9 GDPR, and whether a competition authority may consider GDPR compliance when examining abuse of dominance.

Decision: The Court explained that processing can constitute special-category processing where the collected and linked information permits protected information to be revealed, even if the information concerns someone other than the platform user. It also confirmed that a competition authority may, subject to cooperation with data-protection authorities, assess GDPR consistency when necessary to establish an abuse of dominance.

EUR-Lex+1

Application to data brokers: This is one of the strongest authorities for the proposition that the effect of processing matters. A broker cannot necessarily avoid Article 9 by claiming that it collected ordinary browsing or purchase data rather than medical records.

If combining website visits, purchase histories and account identifiers reveals a person's likely medical condition, Article 9 may apply.

Legal principle: Data that reveals health information through combination or inference can be protected as special-category data; the analysis is not limited to information explicitly labelled “medical.”

Case 3: Federal Trade Commission v. Kochava, Inc.

United States · FTC enforcement proceedings

Facts: The FTC challenged Kochava's sale of sensitive mobile-location data that could be used to trace individuals visiting sensitive locations, including reproductive-health facilities and places of worship.

Legal issue: Whether commercial sale of sensitive location information can constitute an unfair practice under the FTC Act.

Significance: The case illustrates how information that is not itself a medical record can reveal highly sensitive personal circumstances. A broker's location datasets may permit inferences about pregnancy, reproductive-health treatment or other medical concerns.

The FTC's published case materials describe proceedings and a 2026 order concerning restrictions on sensitive-location data sales.

Federal Trade Commission

Application: A health-inference broker faces comparable concerns if its products allow purchasers to identify individuals based on visits to clinics or to construct profiles revealing medical vulnerabilities.

Qualification: The case concerns sensitive location data rather than establishing a universal judicial rule that every inferred health trait is unlawful to sell. Its precise legal effect depends on the operative order and applicable facts.

Case 4: Federal Trade Commission v. GoodRx Holdings, Inc. (2023)

United States · FTC enforcement

Facts: GoodRx, a digital health and prescription-discount company, faced FTC action over allegations that it disclosed users' health information to advertising platforms despite representations concerning privacy.

Legal issues: Deceptive privacy practices, disclosure of sensitive health information and compliance with the FTC's Health Breach Notification Rule.

Outcome: The FTC announced a proposed order in February 2023 that included restrictions on sharing health information for advertising, requirements concerning deletion and affirmative consent for certain sharing, and a civil penalty related to the Health Breach Notification Rule. The matter proceeded through an administrative order process.

Application to brokers: A company cannot necessarily justify commercial disclosure by arguing that users accepted general website terms. Privacy representations, the actual data flow and the sensitivity of the information are all relevant.

Legal principle: Misrepresenting how sensitive health information is shared can create FTC Act liability, and the Health Breach Notification Rule may apply to qualifying non-HIPAA entities. See the FTC guidance on consumer health information.

Federal Trade Commission+1

Case 5: Federal Trade Commission v. BetterHelp, Inc. (2023)

United States · FTC enforcement

Facts: BetterHelp, an online mental-health service, faced allegations that it shared sensitive information about consumers with advertising platforms contrary to its privacy representations.

Legal issues: Whether a digital health service's disclosure of sensitive information for advertising was unfair or deceptive, and whether consumers had meaningfully authorised that disclosure.

Outcome: The FTC issued a final order in 2023 prohibiting certain disclosures of health information for advertising and requiring other protective measures, including restrictions on the use and disclosure of such information.

Application to inferred health traits: Even if a company does not sell a formal diagnosis, sharing account identifiers and information associated with mental-health services can reveal a user's likely psychological circumstances. Such disclosures can raise substantial privacy concerns.

Legal principle: Sensitive health information can remain protected in an advertising ecosystem even when disclosure takes place through tracking technologies or advertising platforms rather than through the direct sale of a medical record.

The GoodRx and BetterHelp proceedings are especially instructive because they demonstrate the importance of actual data flows, not just the wording of a privacy policy.

Case 6: Vyriausioji tarnybinės etikos komisija (2022)

Court of Justice of the European Union · Case C-184/20

Principle: The Court considered the interpretation of special-category personal data where information could indirectly reveal protected personal characteristics.

Application: Although this case concerned data capable of revealing sexual orientation rather than health conditions, its reasoning is relevant to indirect disclosure. A dataset need not expressly record a sensitive characteristic if its content or combination permits that characteristic to be revealed.

For a broker, the broader lesson is that the legal assessment must examine what a dataset discloses or enables others to infer, rather than relying solely on the labels assigned to individual fields.

This case should be used by analogy, not represented as a direct ruling on the sale of inferred medical conditions.

6. The principal legal tests for determining legality

A court or regulator assessing a broker's sale of inferred health traits should consider the following questions.

Test 1: Is the inference personal and health-related?

Determine whether the data identifies or can reasonably be linked to a person and whether it reveals a condition, health risk, treatment, reproductive circumstance or other health-related information.

Test 2: Is there a valid legal basis?

Identify the lawful basis for collection, inference, disclosure and downstream use. In jurisdictions with special-category rules, an additional condition may be required.

Test 3: Was consent meaningful and sufficiently specific?

Review whether the individual understood the sensitive nature of the processing, the intended recipients, and the commercial purpose. Generic acceptance of terms may be inadequate under stricter legal regimes.

Test 4: Is the sale compatible with the original purpose?

A person who supplies information for fitness tracking or symptom management may not reasonably expect that information to be converted into a profile for sale to insurers or advertisers.

Test 5: Does the transaction create discrimination or other unlawful harm?

Examine whether the profile is used to deny employment, alter insurance eligibility, target vulnerable consumers, manipulate purchasing decisions or expose confidential circumstances.

These are analytical questions, not a universal statutory test. The precise elements and defences vary by jurisdiction.

7. When is the sale likely to be unlawful?

The following hypothetical examples illustrate how the legal tests may operate.

The key distinction is between the commercial use of genuinely anonymous statistics and the commercial exploitation of identifiable or linkable health profiles.

Removing a person's name is not necessarily sufficient to anonymise information. A profile may remain identifiable through device identifiers, precise locations, account-linking or combinations of other datasets.

8. Defences available to a data broker

A broker accused of unlawful sale may raise several arguments, although none guarantees that the transaction is lawful.

First, consent or another lawful basis. The broker may establish that the processing was specifically authorised or falls within an applicable statutory exception. The requirements for explicit consent to special-category processing under the GDPR are stricter than ordinary consent to general data processing.

Second, genuine anonymisation. The broker may demonstrate that the information cannot reasonably be linked to an identifiable individual. Pseudonymisation alone generally does not remove personal-data obligations under the GDPR.

Third, a legitimate and limited purpose. Certain research, public-health, statistical or other uses may benefit from legal exceptions, provided the precise statutory conditions are met. A commercial label such as “research” is not sufficient by itself.

Fourth, lack of coverage or jurisdiction. The broker may argue that a particular statute does not apply to its business, processing activity or transaction. This can be important in the United States, where protections differ across federal and state laws.

Fifth, absence of the alleged unfair or deceptive conduct. Under the FTC Act, the regulator must establish the relevant statutory elements. A transaction is not automatically unlawful merely because the information is sensitive.

These defences must be supported by evidence, including data-flow records, consent records, contracts, retention practices and the technical effectiveness of anonymisation.

9. Remedies and enforcement

Depending on the applicable law and facts, potential remedies may include:

Regulatory orders prohibiting particular sales or disclosures.

Deletion of unlawfully obtained or improperly used profiles.

Correction of inaccurate health-related inferences where the relevant law provides for it.

Restrictions on targeted advertising or sensitive-data processing.

Statutory penalties or administrative fines.

Compensation or other civil remedies where legally available.

Injunctions, complaints to data-protection authorities or consumer-protection proceedings.

In India, a claimant should distinguish between a constitutional claim involving state action, a statutory claim under an applicable data-protection regime, a complaint concerning a covered entity's handling of sensitive information, and a contractual or consumer-protection claim. The available forum and remedy will depend on the facts and the provisions in force at the relevant time.

In the EU and UK, complaints to the relevant data-protection authority may be appropriate. In the United States, the FTC and relevant state regulators may have enforcement authority, while private rights of action depend on the particular statute.

10. Compliance framework for data brokers

A broker seeking to reduce legal exposure should adopt the following controls.

Map the data lifecycle. Record the original source, inferred traits, recipients, purposes and onward transfers.

Classify health inferences. Treat identifiable predictions about conditions or vulnerabilities as potentially sensitive even when they are probabilistic.

Establish legal authority. Document the lawful basis for collection, inference, sale and downstream processing separately where required.

Provide transparent notices. Explain what is inferred, how the information is used, and whether it is sold or licensed.

Restrict onward disclosure. Use contractual and technical controls to prevent unauthorised resale, re-identification and incompatible uses.

Assess discrimination risks. Examine whether profiles could be used for unlawful insurance, employment, housing or consumer discrimination.

Maintain governance and security. Apply access controls, retention limits, audit trails, incident response procedures and appropriate assessments of inference accuracy.

11. Conclusion

The legality of selling inferred health traits turns on more than whether a broker possesses an actual medical record. An inference derived from browsing, purchases, location or behavioural data can reveal information about a person's health and may therefore trigger significant privacy and consumer-protection obligations.

Three authorities provide particularly useful starting points:

India: K.S. Puttaswamy v. Union of India establishes the constitutional importance of privacy and informational autonomy.

European Union: Meta Platforms v. Bundeskartellamt, C-252/21, confirms that processing may fall within GDPR special-category protections when it reveals protected information through linked data.

United States: The FTC's GoodRx, BetterHelp and Kochava proceedings demonstrate how sensitive-data disclosures and commercial profiling can attract regulatory scrutiny under applicable federal law.

The ultimate conclusion is jurisdiction-dependent. A sale may be lawful under a properly applicable legal basis and suitable safeguards, but a broker cannot assume that inferred health information is unrestricted merely because it was generated algorithmically, obtained indirectly or described as marketing data.

This is a general legal research overview, not a jurisdiction-specific legal opinion. For a litigation-ready analysis, the relevant country, the data broker's role, the precise health inference and the date of the transaction should be established.