Stage 5: Sensitive data: health and kids

The short answer

If your app touches health in any way, keep that data away from ad pixels and tracking tools, because regulators and juries now treat sending it to an ad platform as a breach or as illegal recording. If your app is aimed at children under 13, or you learn that a child under 13 uses it, the federal children's privacy rule applies to you at any size. Before launch, list every tool that receives data from your health screens, write down who your app is for, and if you ask for age, ask in a way that does not coach a child to lie.

Why this matters

These cases are about ordinary tools: an ad pixel, an analytics kit, a chat feature that was on by default. Each one has a source you can open.

• GoodRx. In February 2023, the FTC (the US Federal Trade Commission, the main consumer protection agency) brought its first case under the Health Breach Notification Rule. It says GoodRx shared drug and health-condition data with Facebook, Google, Criteo, Branch and Twilio, and uploaded emails, phone numbers and ad IDs to Facebook to target health ads. The proposed order carried a $1.5 million civil penalty (FTC).
• BetterHelp. In March 2023, the FTC said the online therapy company gave email addresses, IP addresses and answers to a health questionnaire to Facebook, Snapchat, Criteo and Pinterest for advertising, after it promised to keep them private. BetterHelp agreed to pay $7.8 million for partial refunds (FTC). In May 2024 the FTC said about 800,000 people would get refund notices (FTC refunds).
• Flo Health, twice. In 2021 the FTC settled with Flo, a period and fertility app, over claims that it told users their health data would stay private and then shared it with outside analytics companies (FTC case page). Then users sued. On 2025-08-01 a federal jury in San Francisco found Meta liable under a California recording law, for what its software kit collected from Flo users. Meta's own SEC filing says the plaintiffs seek $5,000 per class member for up to about 1.25 million people (Meta 10-Q). As of 2026-10-09 the damages are not final. Flo, Google and Flurry settled before the verdict (Burr and Forman, a law firm).
• Healthline. In July 2025, Healthline paid the California Attorney General $1.55 million. One of the problems: it shared the titles of articles people read, and those titles could imply a diagnosis (California Attorney General).
• Epic Games (Fortnite). In December 2022, Epic agreed to a $275 million penalty for breaking the children's privacy rule, which the FTC called the largest it had obtained for a rule violation, plus $245 million in refunds for separate claims, $520 million in total. The FTC said Epic collected data from children under 13 without telling parents or getting their consent, and that voice and text chat were on by default (FTC).
• Disney. A $10 million civil penalty for labeling YouTube videos made for kids as not "Made for Kids", approved by a federal judge in December 2025 (FTC).
• TikTok. On 2026-08-21 the US Department of Justice announced a $400 million children's privacy settlement with TikTok and ByteDance. The claims are allegations, not findings (DOJ).

None of these companies is small. The CCPA, used against Healthline, has size tests, but the children's privacy rule (COPPA) and the Health Breach Notification Rule have none. They apply to a solo founder with the same tools installed.

Core concepts

What counts as health data

Health data is information about a person's body or mind: a condition, a drug, a symptom, fertility, mood, mental health. It is not only a medical record. In the cases above it was a prescription search (GoodRx), the answers to an intake form (BetterHelp), cycle and pregnancy entries (Flo), and the title of an article someone read (Healthline).

HIPAA is the US health privacy law for health care providers, health insurers and the companies that work for them, which it calls covered entities and business associates. Most consumer apps are not covered by HIPAA. That does not mean they are free of rules. The FTC rule in the next section was written for exactly those apps. A 2024 court ruling that cut back the HIPAA tracking guidance does not change that, because it only concerned HIPAA (Hunton, a law firm).

A tracking pixel is a small piece of code from an ad platform that loads on your page and reports what the visitor does. An SDK (software development kit) is a library you add to a mobile app; ad and analytics SDKs report events the same way. Both send what they see, with identifiers that let the platform match the visitor to a person.

Worked example. You build a sleep and mood app. Your agent adds the Meta pixel to measure sign-ups, and analytics with automatic event names. Here is what leaves the app:

Together the rows tell an ad platform that a named person is anxious and cannot sleep. The fix is cheap: no ad pixels on health screens, neutral event names such as entry_saved, and no page titles or URLs in what you send.

The FTC Health Breach Notification Rule

The Health Breach Notification Rule is an FTC rule that makes apps and services holding health records tell people when that data gets out. The FTC changed it in 2024 (announced 2024-04-26, on a 3-2 vote). The changes took effect on 2024-07-29 (FTC, Federal Register).

Two changes matter to you:

1. The rule now clearly covers health apps and similar tools that HIPAA does not cover.
2. A breach now includes an unauthorized disclosure, not only a hack. If your app sends health data to an ad platform without the user's permission, that counts as a breach, and the notices are owed.

GoodRx was the first case brought under this rule. Its problem was not a hacker. It was its own ad setup.

Worked example. Your period tracker adds an analytics SDK. Your privacy policy says health entries never leave the device, but the SDK sends an event each time a user logs a symptom. No one broke in. Under the amended rule, you may still owe breach notices to every affected user, and your policy is now false. The rule sets out who you must notify and how fast, so add it to your Stage 1 breach plan.

State laws: Washington and California

Two state laws reach health data even when federal law does not.

Washington's My Health My Data Act was signed on 2023-04-27. It took effect on 2024-03-31, and on 2024-06-30 for small businesses. The Act says a violation is an unfair or deceptive act under Washington's Consumer Protection Act (RCW 19.373.090). Law firms read that as letting individuals sue, with no period to fix the problem first. The first suit, Maxwell v. Amazon, was filed on 2025-02-10. It claims an SDK in other companies' apps collected location data that implies health information, without consent (Orrick). I found no ruling yet. Law firms describe "consumer health data" as broad, able to include guesses drawn from location or purchases. I did not read the exact definition in the statute, so check it with a lawyer if you have Washington users.

California's Invasion of Privacy Act lets a person sue for $5,000 per violation, or three times actual damages if more (Penal Code 637.2, mirror copy). That link is a copy on FindLaw, because the official California site blocked my research tool. One section bans recording a confidential conversation without the consent of every party. The Flo jury used that section against Meta.

The governor signed SB 690 on 2026-09-30, and it takes effect on 2027-01-01. It removes private suits for one theory only, the "pen register" claim about pixels that collect IP addresses. It does not touch the recording section that decided Flo (WilmerHale). Stage 4 covers this law in detail.

COPPA: who it covers

COPPA is the Children's Online Privacy Protection Act, a US law, and the FTC's COPPA Rule carries it out (FTC compliance plan, 16 CFR Part 312). A child under COPPA is a person under 13. The rule covers you in any of three cases:

1. Your site or app is directed to children under 13 and collects personal information from them.
2. Your app is for a general audience, but you have actual knowledge that you collect personal information from a child under 13.
3. You run an ad network or plug-in and have actual knowledge that you collect from users of a child-directed service.

Personal information under COPPA is wider than a name. It includes a persistent identifier that can recognize a user over time and across sites or apps, such as a cookie number, an IP address or a device ID. The 2025 changes added biometric identifiers, such as fingerprints, voiceprints and faceprints, and government-issued IDs (eCFR 312.2). The voiceprint item is about voice data used to recognize a person automatically. Plain speech-to-text is a different use, so do not assume either way without advice.

Actual knowledge can come from places you do not expect. The FTC's staff FAQ says it can arise when a parent tells you their child uses the service, or when your staff see a post that reveals a user's age. Once you know a user is under 13, get a parent's consent or delete the data (FTC COPPA FAQ).

Worked example. You run a homework helper for "students of all ages", with an analytics SDK. A parent emails support: "My 11-year-old loves this." You now have actual knowledge about that account, and the SDK has been sending its device ID, which is personal information under COPPA. Delete that child's data or get verifiable parental consent, and log what you did.

The amended COPPA Rule, and what it costs

The FTC rewrote the COPPA Rule in 2025 (Federal Register, FTC):

Every deadline has passed, so the amended rule is fully enforceable now. The main changes:

• Separate parental consent before you share a child's data with third parties, for example for targeted ads. Verifiable parental consent means a method that gives you real reason to believe the person agreeing is the parent.
• Keep children's data only as long as needed.
• A written security program and a written retention policy.
• The wider definition of personal information above.

COPPA violations are treated as violations of an FTC rule (15 U.S.C. 6502). The FTC's maximum civil penalty for that kind of violation is $53,088 per violation, set on 2025-01-17. There is no 2026 increase. An FTC notice says the amounts "will remain unchanged during 2026", because the federal budget office (OMB) cancelled the 2026 inflation update (FTC notice). I did not find one FTC sentence that ties this exact figure to COPPA, but it is the standard reading.

If your app sells in the App Store's Kids Category, Apple adds its own rule: Kids Category apps may not send personal or device information to third parties, and should not include third-party analytics or advertising, with limited exceptions (Apple guideline 1.3).

Asking for age the neutral way

A general-audience app does not have to ask for age, and does not have to investigate (FTC COPPA FAQ). If you do ask, the FAQ says to ask neutrally. You may also block under-13 users completely.

An age gate is the screen that asks for age. A neutral age gate does not hint at the answer that gets a child in.

Worked example. Your agent writes a sign-up form with a checkbox, "I confirm I am 13 or older", ticked by default. That fails three ways: it tells a child the right answer, it is a checkbox, and it has a default. A neutral version asks "What is your date of birth?" with empty fields, and on a "too young" answer it saves a cookie, shows a polite message, and stores no other data.

State app-store age laws

A new kind of state law asks app stores to verify ages. These laws move fast:

• Texas passed the App Store Accountability Act (SB 2420). A federal court blocked it on 2025-12-23. The Fifth Circuit paused that block on 2026-05-28. On 2026-07-06 the US Supreme Court refused emergency requests to stop the law, without ruling on the merits. A law firm reads this as: the law can be enforced now, while the appeal goes on (InfoLawGroup).
• Utah amended its law in March 2026. The duties now start on 2027-05-06, the Attorney General no longer enforces it, and private parties can sue instead. An industry lawsuit was dismissed on 2026-04-21 (Loeb and Loeb).

Other states are passing similar laws. I did not read what these laws ask of developers, as opposed to stores, so check the current text before you ship a mobile app to these states.

Key terms

The checklist

• Write down whether your app collects any health information, including symptoms, medications, fertility, mood or mental health, and keep the answer with your other launch notes.Must doSource: FTC Health Breach Notification Rule, FTC on GoodRx
• Remove ad pixels and ad SDKs from every screen and page where users enter or read health information.If it appliesSource: FTC on GoodRx, FTC on BetterHelp
• Rename the events, page titles and URLs you send to analytics and ad tools so that none of them names a condition, a drug or a diagnosis.If it appliesSource: California AG on Healthline, FTC on GoodRx
• Never upload emails, phone numbers or ad IDs from a health app to an ad platform for targeting.If it appliesSource: FTC on GoodRx, FTC on BetterHelp
• Check that your privacy policy names every place health data goes, and that the app does exactly what the policy says.If it appliesSource: FTC Flo Health case, FTC on BetterHelp
• Add health data to your breach plan, and treat data sent to a third party without permission as a breach that needs notices.If it appliesSource: FTC Health Breach Notification Rule, Federal Register, 2024 amendments
• Do not let a third-party SDK or recording tool capture health entries or private messages, because California's recording law needs every party's consent.If it appliesSource: Meta 10-Q on the Flo verdict, Penal Code 637.2 (mirror)
• If you have users in Washington and handle anything that could reveal health, have a lawyer check your app against the My Health My Data Act.If it appliesSource: RCW 19.373.090, Orrick on the first lawsuit
• Write down who your app is for, and if it is for a general audience, do not market it to children under 13.Must doSource: FTC COPPA compliance plan, FTC COPPA FAQ
• When you learn that a user is under 13, for example from a parent's email, get a parent's consent or delete that user's data, and log what you did.Must doSource: FTC COPPA FAQ
• If you ask for age, use a neutral age gate: empty birth date fields, no default, no "over 12" checkbox, and a cookie so the answer cannot be changed.If it appliesSource: FTC COPPA FAQ
• If your app is directed to children, get verifiable parental consent before you collect personal information, and separate consent before you share it with third parties.If it appliesSource: FTC COPPA compliance plan, Federal Register, 2025 COPPA Rule
• Get verifiable parental consent before analytics or ad SDKs collect persistent identifiers in any part aimed at children, and remove them if you list in the App Store Kids Category.If it appliesSource: eCFR 16 CFR 312.2, Apple guideline 1.3 (Kids Category)
• If children use your app, write a security program and a retention policy, and delete children's data when you no longer need it.If it appliesSource: Federal Register, 2025 COPPA Rule, FTC announcement
• Before you ship a mobile app to users in Texas or Utah, check the current state of their app-store age laws.If it appliesSource: InfoLawGroup on Texas, Loeb and Loeb on Utah

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. It reads your code and your tracking setup, and it changes nothing.

Audit this project for Stage 5 of a launch checklist: health data and children's data.
Do not change any code, config, tracking setup, or copy until I approve a plan.

For each item below, report PASS, FAIL, or UNKNOWN, with the file and line that
proves it. If you cannot prove an item from the code, report UNKNOWN. Never report
PASS without evidence.

1. List every field that holds health information (symptoms, medications,
   fertility, mood, mental health, diagnoses) and the file that stores it.
2. List every ad pixel, ad SDK, analytics tool, session recorder and chat widget,
   and the screens where each loads. Flag any on a health screen.
3. List every event name, page URL or page title sent to a third party. Flag any
   that name a condition, drug, symptom or diagnosis.
4. Does any code send emails, phone numbers or ad IDs to an ad platform?
5. Quote any privacy policy sentence that items 1 to 4 contradict.
6. Does a written breach plan treat sharing health data without permission as a
   breach?
7. Quote the terms, policy and marketing copy that state who the app is for.
8. Quote any age question. Flag a checkbox, a default answer, a year list that
   stops at age 13, a hint that young users are blocked, or no saved answer.
9. Can support mark an account as under 13 and delete its data?
10. In any part aimed at children, list each SDK that collects a cookie ID, IP
    address, device ID, voice or face data.
11. Is there a written retention policy and a written security program?

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

Item 2 is the one to check yourself. Open your app with the browser's developer tools on a health screen, look at the Network tab, and see which outside hosts receive requests. If one of them is an ad platform, you have your first fix.

Common mistakes

• Thinking "we are not a hospital, so HIPAA does not apply, so there is no rule". The FTC rule was written for apps outside HIPAA.
• Installing the ad pixel site-wide to measure sign-ups, so it also loads on symptom, mood or result pages.
• Naming events after what the user did, such as logged_migraine, and sending them to every connected tool.
• Saying "we are for adults" in the terms while the marketing shows cartoons and school themes.
• Ignoring a parent's email that says a child uses the app. That email can be actual knowledge.
• An age gate with "I am 13 or older" ticked by default.

Check yourself

Resources

• FTC: Health Breach Notification Rule changesGuidanceFree

  What changed in 2024 and why health apps outside HIPAA are covered.

• FTC: the GoodRx caseGuidanceFree

  The first case under the rule, with the list of what was shared.

• FTC: the BetterHelp caseGuidanceFree

  How intake answers reached ad platforms.

• Meta 10-Q, June 2026ResearchFree

  Meta's own account of the Flo verdict and what the plaintiffs seek.

• Washington RCW 19.373.090LawFree

  How the My Health My Data Act is enforced.

• FTC: COPPA six-step compliance planGuidanceFree

  The best first read on whether COPPA covers you.

• FTC: Complying with COPPA, FAQGuidanceFree

  Staff answers on age gates, actual knowledge and general-audience apps.

• Federal Register: 2025 COPPA RuleLawFree

  The amended rule, its dates and the new duties.

• FTC: the Epic Games settlementGuidanceFree

  Why chat that is on by default became a children's privacy problem.

Next stage

You know which data needs the most care. Stage 6 checks whether everyone can use your app at all: people who use a keyboard, a screen reader or larger text, and the accessibility suits that target apps that ignore them.