Privacy and Advertising Rules for Startup Marketers: What to Check Before You Launch

1. Blog
2. Ops, Teams & AI

By Saroj Jha · October 5, 2026 · 13 min read

Before a campaign goes live, check four things: whose data you are using, what those people agreed to, where they live, and whether every claim and testimonial is true. If patients’ data passes through your product, keep it out of your marketing tools completely, and keep every claim inside what the FDA cleared.

Privacy and advertising rules look like a wall of acronyms: GDPR, CCPA, HIPAA, CAN-SPAM. In practice, most ask the same few questions. In my view, they matter most in healthcare, where the data is about a patient and the buyer is a clinic. If you use AI in your product or your marketing, none of this changes: what a visitor types into an AI chat is still personal data, and an AI-written claim is still your claim. Below are the five checks I would work through with a founder.

This is not legal advice. It is general orientation; laws change and depend on your facts, so check your plans with a qualified lawyer.

Running case: Example Co. Fictional

Example Co. is a seed-stage MedTech startup. Its benchtop blood analyzer runs routine tests, such as HbA1c and a lipid panel, from a fingerstick sample in about 12 minutes; in this story it is FDA-cleared and CLIA-waived. Its first customers are independent primary-care practices with 3 to 10 clinicians; a clinic pays about $25,000 a year, and clinic staff see patients’ results in a results portal. This quarter it plans website ads with a cookie banner, a monthly email to practice owners, a waitlist that some clinic managers in Ireland have joined, and testimonials from practice owners. Example Co. and all its numbers are illustrative.

Step 1: Map your data and where your audience lives

Each rule switches on for a different reason, so start with a map of what data you collect, from whom, where they are, and what you will do with it. Include every AI feature and AI vendor that receives any of that data.

• GDPR (European Union). It can reach a company outside the EU when it offers goods or services to people in the EU (Article 3(2), GDPR^[1]). Every use of personal data needs a lawful basis, such as consent (Article 6). Direct marketing “may be regarded as carried out for a legitimate interest” (Recital 47), but people can still object (Step 4).
• CCPA/CPRA (California). It applies to businesses that meet one of three tests: annual revenue above a threshold, adjusted to $26,625,000 from January 2025^[2]; buying, selling or sharing the personal information of “100,000 or more California residents or households”; or deriving 50% or more of revenue from selling it^[4].
• HIPAA, FDA labeling rules, CAN-SPAM and the FTC’s advertising rules can each apply to a US healthcare startup, depending on whether it handles patient data for clinics, sells a device, sends marketing email or runs ads. Steps 2, 4 and 5.

The stakes are real: the most serious GDPR infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5))^[1],[5]. California’s fines run to $2,663 per violation, or $7,988 for intentional violations and those involving consumers known to be under 16^[2].

Example Co., step 1 Fictional

Its map has five rows: patients’ test results (inside the results portal); practice owners’ work emails; website visitors; questions typed into the AI chat assistant on its website; and the clinic managers in Ireland on the waitlist (GDPR can apply, because it offers them a service). It meets no CCPA threshold yet, but builds its consent tool as if it did, because its urgent care plan will reach California. All fictional.

Do this

Make a one-page data map: each type of data, whose it is, where they live, and where it flows.

Free template

Check every rule set before the campaign goes live

The free Marketing Compliance Checklist covers nine rule sets to check before a campaign, email or AI feature goes live, each with the regulator's own page.

Step 2: Keep patient data out of marketing, and keep claims inside the cleared use

For any product that touches patient information, I would put this first. HIPAA’s Privacy Rule defines marketing as “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”^[6]. A covered entity such as a clinic “must obtain an authorization for any use or disclosure of protected health information for marketing”^[7], and HHS says that, “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing”^[8].

A device maker is not automatically covered, but one that handles patient data for clinics may be a business associate: a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter”^[9]. Its contract “may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity”^[10]. My reading: patient data you hold for a clinic does not become your marketing list.

Ad tools are where this usually goes wrong. Meta’s Business Tools Terms bar advertisers from sending it health information and other categories of sensitive information^[11]. HHS’s bulletin on tracking technologies says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures”^[12]; a federal court vacated part of that bulletin in 2024, so check its current status.

AI tools raise the same question. A chat assistant on your website, or an AI writing tool your team pastes text into, sends that text to another company. Treat it like any other vendor: keep patient data out of it unless a lawyer has approved the setup, and tell visitors what happens to what they type. My post on making security a selling point covers how to write that data-use answer.

In Europe, health data gets extra protection. The GDPR defines “data concerning health” as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status” (Article 4(15)). Processing it “shall be prohibited” (Article 9(1)) unless an exception applies, such as the person’s “explicit consent” (Article 9(2)(a), GDPR^[1]).

The second rule is about claims. The FDA’s labeling page quotes an appellate court: “Most, if not all advertising, is labeling”^[13]. A device’s intended use “may, for example, be shown by labeling claims, advertising matter, or oral or written statements by such persons or their representatives”^[14], and a 510(k) clearance “does not in any way denote official approval of the device”^[15]. The FTC says health claims need “competent and reliable scientific evidence”, and its guidance covers “diagnostic tests”^[16].

Example Co., step 2 Fictional

The results portal has no pixel, no ad SDK and no link to any ad platform. Patients’ results are used only to run the service for the clinic, and no event or audience name mentions a test or a condition. Practice contacts join marketing lists only through a separate website sign-up. Ad copy is checked against the cleared labeling before it runs. The AI chat assistant on its website asks visitors not to enter patient details, and its transcripts never reach an ad platform. This design is fictional; a real company should take legal advice.

What the FTC’s GoodRx order shows

In February 2023 the FTC took action against GoodRx, a telehealth and prescription discount provider, “for failing to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google, and other companies”^[17]. The FTC’s complaint said GoodRx violated the FTC Act “by sharing sensitive personal health information for years with advertising companies and platforms”.

The FTC said GoodRx compiled lists of users who had bought particular medications and “uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook so it could identify their profiles”, then targeted them with health-related ads. It also said GoodRx displayed a seal “falsely suggesting to consumers that it complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA)”.

In the proposed order, filed by the Department of Justice on the FTC’s behalf, “GoodRx will be permanently prohibited from disclosing user health information with applicable third parties for advertising purposes”, and it “has agreed to pay a $1.5 million civil penalty for violating the rule”. The order had to be approved by a federal court to take effect, and the court entered it on 17 February 2023^[18].

These are the FTC’s allegations and proposed-order terms, not an account of how GoodRx decided internally. The FTC’s case rested on the FTC Act and its Health Breach Notification Rule, not on HIPAA, so it shows the ad-platform risk rather than the HIPAA rule. HHS has enforced the marketing rule directly: in December 2010 it entered a resolution agreement, with a $35,000 payment, with Management Services Organization Washington, Inc., relating to its “disclosure of electronic protected health information to Washington Practice Management, LLC, owned by MSO, which used the information for marketing purposes”^[19].

Do this

List every screen and service that shows patient information, and confirm that none of it sends data to an ad platform or a marketing list.

Step 3: Get consent right for cookies and tracking

In the EU, the ePrivacy Directive allows storing or reading information on a user’s device “only on condition that the subscriber or user concerned has given his or her consent”. The exception is storage “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service” (Article 5(3), Directive 2002/58/EC^[20]). An ad tag is hard to call necessary for the service a visitor asked for, so ask first.

Consent must be “freely given, specific, informed and unambiguous” (GDPR Article 4(11)). The EDPB adds that “scrolling or swiping through a webpage” will “not under any circumstances” count as a clear affirmative action, and that access to services “must not be made conditional on the consent of a user” to cookies^[21].

California works the other way round: people opt out rather than in. Consumers have “the right to opt-out of the sale or sharing of their personal information”, and the Global Privacy Control browser signal “must be honored by covered businesses as a valid consumer request”^[4].

Example Co., step 3 Fictional

EU visitors see equally clear “Accept” and “Reject” buttons, and ad and analytics tags wait for a yes. US visitors get an opt-out link, and a Global Privacy Control signal counts as an opt-out. Nothing loads in the results portal. All fictional.

Do this

Open your site in a fresh browser, reject everything, and use the browser’s developer tools to check that no ad tag fires.

Step 4: Follow the email rules in each market

In the US, CAN-SPAM covers all commercial email: “The law makes no exception for business-to-business email.” Each message needs honest headers and subject lines, must identify itself as an ad, and “must include your valid physical postal address.” It must tell people how to opt out, and “you must honor a recipient’s opt-out request within 10 business days.” Each violating email can cost “up to $53,088”^[3].

In the EU, marketing email to individuals starts from consent. The ePrivacy Directive allows email for direct marketing “only in respect of subscribers or users who have given their prior consent” (Article 13(1)), with a narrow exception for existing customers and “similar products or services” (Article 13(2)). Under the GDPR, once a person objects to direct marketing, a company “may no longer process their personal data for such purposes”, and people must be told they have “a right to object free of charge”^[22].

Example Co., step 4 Fictional

The email to US practice owners carries a postal address and a one-click unsubscribe that takes effect at once. The clinic managers in Ireland get emails only because they ticked a box asking for updates, and every email offers a way to object. All fictional.

Do this

Send yourself your next campaign and check it against the CAN-SPAM list above before it goes to anyone else.

Step 5: Keep claims, reviews and testimonials honest

The FTC’s Endorsement Guides say: “Endorsements must reflect the honest opinions, findings, beliefs, or experience of the endorser.” If a testimonial implies typical results and you cannot prove it, “the advertisement should clearly and conspicuously disclose the generally expected performance in the depicted circumstances.” Advertisers are liable “for failing to disclose unexpected material connections” with endorsers^[23]. For health products, the FTC’s guidance adds that advertisers “should not make claims through consumer testimonials or expert endorsements that would be deceptive or couldn’t be substantiated if the advertiser made them directly”^[16].

A 2024 FTC rule bans fake reviews, including those “by someone who does not exist, such as AI-generated fake reviews”, and incentives “conditioned on the writing of consumer reviews expressing a particular sentiment”, and lets the FTC seek civil penalties against knowing violators^[24].

AI claims face the same test. In February 2025 the FTC finalized an order against DoNotPay, which had called its service “the world’s first robot lawyer”. The FTC said the company “did not test whether its ‘AI lawyer’ operated to the level of a human lawyer”; the order bars such claims without evidence and required $193,000 in monetary relief^[25]. In August 2025 it finalized an order against Workado, which had described its AI content detector as built from “a wide range of material, including blog posts and Wikipedia entries”; the FTC said the model was “trained or fine-tuned to effectively classify only academic content”. Workado may now make effectiveness claims only with “competent and reliable evidence to support the claim at the time it is made”^[26]. These are the FTC’s descriptions, not an account of how either company decided internally. The lesson for any AI feature: an accuracy claim on your site needs a test behind it, run on the kind of data your customers will use.

Example Co., step 5 Fictional

A practice owner’s quote comes from a recorded call she approved. A line claiming earlier diagnosis is cut, because it goes beyond the cleared use and no data shows it. She had three free months, so the page says so. The ad copy was drafted with an AI assistant, and a person checked every line against the cleared labeling before it ran. The product is described as a point-of-care analyzer that returns HbA1c and lipid results from a fingerstick in about 12 minutes, as in its cleared labeling (fictional). All fictional.

Do this

For every testimonial and claim on your site, write down the evidence behind it and any connection to the person quoted.

What must a patient's HIPAA authorization for a testimonial include?

If a patient testimonial involves using or disclosing protected health information for marketing, a HIPAA covered entity "must obtain an authorization", except for face-to-face communications and promotional gifts of nominal value^[7]. Marketing means "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service"^[6].

Who obtains it. HHS says covered entities, including health care providers such as clinics that transmit health information electronically in standard transactions, must comply with HIPAA, and business associates "are directly liable for compliance with certain provisions"^[27]. The marketing rule binds the covered entity; where that is the clinic, the clinic obtains it, not the device startup.

Core elements, at a minimum^[7]:

1. a description that "identifies the information in a specific and meaningful fashion";
2. who may make the use or disclosure;
3. to whom it may be made;
4. "A description of each purpose of the requested use or disclosure";
5. "An expiration date or an expiration event";
6. the patient's signature and date (and, if a representative signs, their authority).

Required statements ^[7]: "The individual's right to revoke the authorization in writing", with how to revoke and the exceptions (or a reference to the privacy notice); "The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization"; and that the recipient could redisclose the information, which may then "no longer be protected by this subpart".

Other requirements ^[7]: "The authorization must be written in plain language." The covered entity seeking it must give the patient "a copy of the signed authorization" and "document and retain" it. A patient may revoke "at any time, provided that the revocation is in writing", with limited exceptions (for example, action already taken in reliance on it). If the marketing involves financial remuneration to the covered entity from a third party, "the authorization must state that such remuneration is involved". This is general information, not legal or regulatory advice. You are responsible for checking the legal and regulatory consequences for your product and market with a qualified professional before you act on it.

How I would run it.

• Ask the clinic to obtain it on its own plain-language form, naming your company as a recipient and each use (website, ads).
• Log where each testimonial appears, and agree with the clinic how you will remove it if the patient revokes.
• If your counsel advises it, get a separate release for the patient's name or image.

What changes by stage?

• Pre-seed — Draw the data map, keep ad tags away from anything that shows patient information, and build one CAN-SPAM-ready email template.
• Seed — Add a consent tool that honors Global Privacy Control, keep consent records, start an evidence file for claims and testimonials, and get a lawyer’s review before paid campaigns or performance claims.
• Series A–B — Name a privacy owner, review every vendor that touches personal data, audit tags each quarter, and expect health-system buyers to bring their own privacy and security terms.

What mistakes should I avoid?

• Ad pixels on pages that show patient information. Keep product and marketing stacks apart.
• Treating patient data as a marketing list. HIPAA generally requires the patient’s authorization, with limited exceptions.
• “By scrolling you agree” banners. In the EU, scrolling is not consent.
• Assuming B2B email is exempt. CAN-SPAM covers it.
• Untypical results, “approved” or hidden perks in testimonials. Disclose perks, and keep claims inside the cleared use.
• Handing compliance to someone else. Agencies and vendors cannot carry your duties.