How a Doctor Visit Becomes Ad Targeting Material
A routine oncology appointment can leave a digital trail long after the visit ends. Phone location data, combined with other consumer records, can reveal when someone has entered a cancer center, an abortion clinic, or a recovery meeting in a church basement — then feed that information into advertising systems built to sell products, services, and sometimes outright fraud.
For patients, the harm is not abstract. Chris McQueen, who completed leukemia treatment a year and a half ago, kept seeing ads for juice cleanses, “natural” cancer remedies, and clinics in Mexico promising recovery with little chemotherapy while he was still attending oncologist visits and monthly bloodwork. The ads arrived on the same device that had helped carry him through treatment.
The result is a market that transforms intimate medical movement into commercial insight. Once location patterns are linked with health-related browsing, app behavior, and other data points, advertisers can infer illness, fertility care, substance use treatment, pregnancy-related services, or mental health needs without ever seeing a medical chart.
What the Privacy Gap Leaves Exposed
HIPAA protects medical records held by healthcare providers, health plans, and their business associates. It does not broadly govern the location data emitted by smartphones when people walk into a hospital, an Alcoholics Anonymous meeting, or a reproductive health clinic.
That gap matters because location data can be more revealing than people expect. A single visit may be ambiguous, but repeated trips to the same site, clustered around specialist appointments or treatment schedules, create a behavioral pattern that is hard to misread. Inferences drawn from those patterns can be sold and resold, often beyond the consumer’s awareness or meaningful control.
Consumer sentiment appears far ahead of the law. More than 92% of patients in a 2022 American Medical Association survey said their health data should not be available for purchase. Yet the commercial machinery collecting and packaging that information remains active across much of the digital advertising industry.
A Business Model Built on Reuse
Data brokers and advertisers argue that location data is not inherently sensitive. Privacy advocates reject that framing, pointing out that sensitivity emerges from scale, continuity, and combination. A single coordinate may be harmless. A month of coordinates can identify a clinic, a pattern of care, or a private crisis.
The economics explain why the industry is so persistent. Digital services often appear free because personal data helps fund them. In practice, that means users may exchange privacy for convenience without appreciating how widely the resulting data can circulate. Once a broker has built collection systems, the same information can be sold repeatedly with minimal additional cost, including to companies training artificial intelligence systems.
That business model has attracted scrutiny from federal regulators. The Federal Trade Commission warned retailers against using private consumer data to raise prices. It also reached a settlement with Kochava, an Idaho-based data broker, after allegations that the company sold location data from hundreds of millions of mobile devices that could be used to trace visits to hospitals, churches, abortion clinics, and other sensitive sites.
One settlement does not end an industry. It restrains one company under one set of terms while leaving the broader market intact.
The Reach Is Wider Than Most Patients Realize
Privacy Rights Clearinghouse and the Electronic Frontier Foundation identified 750 data brokers operating in the United States as of last year. Many have not registered with state governments, and many do not make it easy for consumers to inspect, correct, or delete their files.
Consumer Reports has also documented how inaccurate those files can be. In one case, a volunteer’s profile included four different ages, conflicting sex assignments, three very different income estimates, and jobs ranging from farmer to homemaker to self-employed white collar worker. Bad data does not make the system safer; it makes it less accountable while still capable of shaping ad targeting and risk scoring.
The danger extends beyond embarrassment. Location profiles can reveal visits to reproductive health facilities, political rallies, addiction services, or other places where privacy is not a luxury but a necessity. A breach of that information can expose someone’s habits, beliefs, or medical status in ways that are difficult to reverse.
Why Fake-Cure Ads Keep Finding Sick Patients
The health consequences are immediate. Julien Cavanagh, a neurologist in Atlanta, now asks patients whether they are taking supplements bought online when they arrive with unexplained neurological symptoms. Some of the products being pushed through targeted ads can be toxic, produce vitamin or micronutrient deficiencies, or interfere with prescribed drugs.
That is the clinical danger hiding inside a marketing funnel. A person under stress, facing a new diagnosis or a difficult recovery, sees an ad tailored by location and behavior. The ad offers certainty, speed, or a “natural” alternative to conventional care. For some patients, especially those already wary of treatment burdens, that message can be persuasive enough to alter medical decisions.
McQueen’s experience captures the bedside consequence. The ad ecosystem does not just follow patients around; it can amplify fear, exploit vulnerability, and steer them toward treatments that lack evidence and may cost them precious time.
State Limits and Federal Inaction
States have taken uneven steps to curb the sale of precise geolocation data. Connecticut, Delaware, Maryland, New Jersey, Oregon, and Virginia have already banned those sales. California lawmakers pushed for tighter restrictions as well, but Gov. Gavin Newsom vetoed a bill that would have blocked the sale and sharing of location and other sensitive personal data, saying it went too far.
Even where privacy laws exist, enforcement is thin. A Stanford University study found that only 9% of data brokers were adhering to a California privacy law that gives consumers the right to delete data, correct personal information, and learn what records are being sold. That compliance gap leaves consumers with rights on paper and little practical leverage.
Consumer Reports has proposed model legislation to give states a clearer framework for limiting geolocation sales. The Advertising industry has pushed back, arguing that targeted ads support free services and help consumers find products efficiently. The tension is straightforward: one side sees data monetization as a necessary economic engine, while the other sees it as a system of surveillance with health-related fallout.
What Patients Can Do Now
People can reduce some of the tracking risk by limiting app location permissions, turning off ad tracking on phones, or using airplane mode before entering sensitive settings. California residents can use a centralized opt-out portal for data broker deletion requests, while residents in other states may need to file requests with each broker separately.
Those steps help at the margins, but they do not solve the structural problem. As long as mobile location data can be bought, combined, and resold with little meaningful oversight, patients will keep carrying a device that can reveal their most private medical movements to businesses that know how to monetize them.