Your Doctor Didn’t Share Your Diagnosis. Your Phone’s Location Did

A patient sits in an oncologist’s waiting room. Her phone, which has location services switched on for a weather app and a shopping app, reports its position many times an hour. A few days later the same phone starts showing ads for juice cleanses that promise to cure cancer and clinics abroad offering treatment “with little chemotherapy.” No doctor shared anything. The visit itself was the signal.

That pattern is at the center of a new round of calls from privacy advocates, doctors and legal experts for states or Congress to stop advertisers and data brokers from tracking people’s phones to sensitive places. A KFF Health News investigation published with The Washington Post on October 28 describes a San Diego leukemia survivor who kept seeing ads for unproven cures during routine oncology visits and monthly bloodwork. “It makes me feel sick to my stomach,” he said.

Why HIPAA does not cover this

Most people assume their health information is protected by the Health Insurance Portability and Accountability Act. HIPAA, however, applies to health care providers, health plans, clearinghouses and their business associates. It does not apply to the app developer whose software logs a phone’s location outside a hospital, or to the broker that buys that log and sells an inference about why the person was there.

The result is a gap between what patients expect and what the law provides. In a 2022 American Medical Association survey, more than 92 percent of patients said their health data should not be available for purchase. Yet location data from a phone in a clinic, an abortion provider or a church basement hosting an Alcoholics Anonymous meeting can be collected and sold outside HIPAA entirely.

How a location becomes a health inference

Brokers rarely need a diagnosis. They need a pattern. The chain usually looks like this:

1. Collection. An app with location permission gathers precise coordinates, often through a third-party software development kit.
2. Aggregation. A broker buys or receives location feeds and links them with an advertising ID, other app data and purchased profiles.
3. Inference. Repeated visits to an oncology center, a fertility clinic or a recovery meeting are turned into audience segments such as “likely cancer patient.”
4. Activation. Advertisers buy those segments to target people, sometimes with products that doctors say can do harm.

Stripping sensitive sites out of the data does not fully fix it. The Electronic Frontier Foundation has warned that if a person is tracked right up to the edge of a medical building and picked up again when they leave, the destination is easy to infer. “It’s the comprehensive collection of location data that reveals sensitive things,” said EFF senior staff attorney F. Mario Trujillo.

The inferences are not always accurate, which creates a second harm. Consumer Reports found in September that broker files built about volunteers were often riddled with errors, including one profile that listed four different ages and both sexes for the same man.

The state of the law

The rules are fragmented. According to the KFF Health News report, Connecticut, Delaware, Maryland, New Jersey, Oregon and Virginia have banned the sale of precise geolocation data. California Gov. Gavin Newsom vetoed a bill on September 27 that would have blocked the sale and sharing of location and other sensitive data, saying it went “a step too far.” Consumer Reports released model legislation in January to help states ban or limit geolocation sales, while digital advertisers have lobbied against such limits.

At the federal level, enforcement has been case by case. In May, the FTC barred Kochava and a subsidiary from selling, sharing or disclosing sensitive location data without consumer consent. Advocates point out that a settlement binds only the companies that sign it. Legislation to extend HIPAA-style protections to consumer health data has advanced in committee but is not law.

The advertising industry argues for balance. “A national privacy law should protect consumers from harmful or unexpected uses of data without preventing businesses from providing the services consumers request and expect,” said Jim Potter, executive director of 4As Health, part of the American Association of Advertising Agencies. Trade groups say targeted ads lower search costs and keep apps free.

What this means for advertisers, publishers and health brands

Companies do not have to be data brokers to be exposed. A hospital that runs location-targeted campaigns, a pharmacy app that embeds an ad SDK, or a publisher that passes precise location into the bid stream may all be part of the chain. Questions worth asking:

• Do any of our apps or SDKs collect precise location, and is it passed to third parties?
• Do we buy audience segments built from visits to health facilities or other sensitive places?
• Would our consent flows let a user refuse location sharing without losing the service, or are they the all-or-nothing choice critics describe?
• In states that treat precise geolocation as sensitive data, do we have opt-in consent where required, and do we honor opt-outs?

Knowing when data becomes sensitive is not always obvious. The NAI’s five-factor test for health data is a useful starting point, and the stakes are highest for reproductive health data, where several states have added their own safeguards.

Where consent management fits

A consent banner is not proof that tracking is blocked. What matters is whether the location SDK, the pixel or the ad tag actually stops firing when a user says no. Captain Compliance’s cookie consent manager and consent platform cover web, mobile and connected TV, and our cookie scanner and live scanning tools detect the trackers that run on a site and flag consent failures. Our data mapping tools help record which vendors receive location data and for what purpose. None of this guarantees compliance with any state’s sensitive data rules, but it gives teams evidence of what their properties actually do.

Consumers are also pushing back. Many use opt-out forms, though our look at why broker opt-out forms often fail shows the limits of that route. California’s centralized DROP portal lets residents send one deletion request to registered brokers, and at least 20 states give residents some right to demand deletion.

Frequently asked questions

Is location data health data?

Not by itself in most laws. But several state laws treat precise geolocation as sensitive data, and location combined with visits to health facilities can be used to infer health conditions.

Does HIPAA stop apps from sharing location near hospitals?

No. HIPAA covers health care providers, health plans, clearinghouses and their business associates, not app developers or data brokers acting independently.

Which states ban the sale of precise geolocation data?

The KFF Health News report lists Connecticut, Delaware, Maryland, New Jersey, Oregon and Virginia. Check each statute’s definitions and effective dates before relying on that list.

Did California pass a location data ban?

No. Gov. Newsom vetoed the bill on September 27, 2026.

What can individuals do?

Limit which apps can access location, delete or reset the advertising ID, and use deletion rights where available, including California’s DROP portal.

The waiting room problem

Doctors are now cleaning up after the ads. An Atlanta neurologist told reporters he asks patients with unexplained symptoms whether they are taking supplements bought online. Until lawmakers decide whether a visit to the doctor can be sold, the most reliable protection is the one each company controls: whether its own code is reporting where patients go.