How data brokers trade your health information without permission

Your health information can be bought and sold without anyone asking you a direct question about your medical history. A data broker may never see a hospital file or open a My Health Record account. Instead, it can assemble clues from shopping activity, app permissions, online searches, loyalty programmes, location trails and publicly available information, then sell an inferred profile to advertisers, insurers, lenders or other businesses.

The result is a shadow health record. It might suggest that someone is pregnant, managing diabetes, experiencing depression, recovering from addiction or looking for fertility treatment. These conclusions may be wrong, yet they can still influence the advertising a person receives, the products offered to them and the assumptions made about their financial or personal circumstances.

Australian privacy law provides important protections, but the system is difficult to see and harder to control. Information collected for a supermarket discount, a fitness challenge or a free symptom checker can move through several companies before a person realises that a sensitive conclusion has been drawn about them.

What data brokers actually collect

Data brokers specialise in gathering, matching and licensing information. Some purchase customer databases directly, while others obtain records through advertising exchanges, mobile applications, retailers, public registers and data analytics firms. The health-related material is often not a formal diagnosis. It may be a search for migraine medication, repeated visits to a cancer information page or purchases associated with pregnancy.

A broker can combine these fragments with age, postcode, income estimates, household composition and browsing behaviour. Someone living in western Sydney who repeatedly searches for sleep clinics, buys a blood pressure monitor and receives advertisements for low-sodium foods may be placed in a cardiovascular or wellness segment. The individual may never have agreed to that classification, and may never know it exists.

Data brokers also trade in “propensity” scores. These are predictions about what a person might do or need, such as seeking counselling, joining a weight-loss programme or purchasing a medication. Because the label is presented as an advertising category rather than medical advice, it can avoid the scrutiny normally applied to clinical records. The commercial effect can still be personal and intrusive.

How consent disappears in ordinary online life

Consent is often buried inside a long privacy policy or bundled into the use of a service. A person may agree to an app processing information to provide a step counter, while a separate analytics company receives device identifiers, location data and activity patterns. The wording may refer to “partners”, “service providers” or “relevant offers”, leaving the onward sale difficult to understand.

Cookies and advertising identifiers make this chain more efficient. A visit to a pharmacy website can be connected to activity on unrelated sites, even when the health-related visit was brief. The debate described in Europe’s cookie law shows how consent mechanisms can become a ritual of clicking rather than a meaningful choice. Australia has its own version of this problem, with banners and terms that can obscure who receives the information.

Free services create another route. A symptom checker, meditation app or period tracker may appear to cost nothing because the business earns revenue from targeted advertising, research partnerships or audience measurement. The user may technically accept the arrangement, but consent is weak when refusing means losing access to basic functionality or when the true data recipients are not named clearly.

The Australian privacy gap

Australia’s Privacy Act and the Australian Privacy Principles place stronger obligations on organisations handling sensitive information, including health information. Yet the rules do not automatically cover every inference made from ordinary consumer data. A retailer may collect purchase history under a commercial purpose and later use analytics to predict a health interest without holding a doctor’s note or pathology result.

The distinction between collected health information and inferred health information matters. A clinic record is plainly sensitive. A loyalty profile that predicts pregnancy or treatment for anxiety may sit in a less clearly regulated category, especially when several companies contribute small pieces of information. Privacy reform proposals have sought to strengthen protections and regulate targeted advertising, but the practical reach of future rules depends on the final legislation and enforcement.

Australian consumers also encounter a mixture of federal and state systems. Public hospitals, private providers, pharmacies and technology platforms can have different privacy obligations. My Health Record is a national health information system with its own safeguards, but it is only one part of the data environment. Information outside it can still reveal intimate facts through browsing, purchasing and location patterns.

The Office of the Australian Information Commissioner can investigate privacy complaints and issue guidance, but an individual may not know which organisation to complain about. The first company visible to a consumer may have collected the data from another firm, while the broker that created the profile remains hidden behind a chain of contracts.

Where the signals come from

Retail loyalty programmes are a major source of behavioural data. Everyday Rewards, supermarket accounts and pharmacy memberships can connect purchases with names, addresses and household patterns. Buying nicotine-replacement products, ovulation tests, continence products or mental-health books does not prove a medical condition, yet repeated purchases can become valuable signals for a marketing model.

Location data adds context. A phone that regularly appears near an oncology centre in Melbourne, a fertility clinic in Brisbane or a rehabilitation service in Perth can generate a sensitive inference. The person might be visiting a relative, working nearby or using public transport, but an automated system usually sees coordinates rather than explanations.

Fitness trackers and wellness platforms collect heart-rate patterns, exercise routines, sleep estimates and device identifiers. Some data is shared for analytics or advertising under broad contractual language. Even when an app claims to provide anonymous or aggregated information, a persistent identifier, unusual routine or small geographic area can make reidentification easier.

Online gambling offers another illustration of how behavioural profiling can become commercially valuable. A report on gambling site tracking is relevant to the wider issue because gambling activity can intersect with financial stress, addiction indicators and targeted advertising. A broker does not need a clinical diagnosis to classify someone as vulnerable or highly engaged.

Who buys the resulting profiles

Advertisers purchase health-related audiences to promote supplements, private clinics, weight-management products, fertility services and insurance-related offers. Some campaigns are relatively harmless, while others exploit fear, shame or urgency. A person searching for help with depression may receive aggressive promotions for unproven treatments rather than neutral information from a health professional.

Insurers and employers create more serious concerns. Australian private health insurers operate within specific legal boundaries, and employers generally should not receive a worker’s confidential medical information simply because a data company has made a prediction. Still, algorithmic profiling can affect which offers appear, how a customer is categorised or whether a person is subjected to additional scrutiny.

Financial firms, landlords and lead-generation companies may also value health-adjacent signals. A broker might sell an audience interested in expensive medical treatment, disability support or debt relief. The buyer may not receive a diagnosis; it may receive a list of people likely to respond to a certain advertisement. That distinction can make harmful discrimination difficult to prove.

The wider legal landscape is fragmented, which is why resources such as this privacy law resource can help explain how principles differ between jurisdictions. A company operating in Australia may rely on overseas analytics providers, cloud services or advertising platforms, creating uncertainty about which regulator, contract or privacy rule applies when information crosses borders.

Why “anonymous” data can still identify you

Removing a name does not necessarily remove identity. Data becomes easier to recognise when it contains a stable device identifier, a precise location trail, a detailed timestamp or a rare combination of activities. In a small town, a person visiting a particular clinic every Tuesday afternoon may be identifiable even if the dataset contains no address.

Reidentification can happen through linkage. A broker may join an anonymised health-interest segment with a public social media profile, a customer account or a separate marketing list. The more sources involved, the more distinctive the pattern becomes. Information that looks harmless in isolation can reveal a highly personal story when arranged chronologically.

Inferences can also be inaccurate. A person buying prenatal vitamins may be supporting a friend, while someone reading addiction-recovery material may be studying social work. Automated systems rarely provide a clear process for correcting these errors. Yet an inaccurate label can remain in a marketing database, circulate to other companies and shape future decisions.

Australia’s Privacy Act includes concepts around sensitive information and reasonable expectations, but enforcement must keep pace with technical practices. The central problem is visibility: people cannot challenge a profile they cannot see, and they cannot withdraw consent from a data flow they were never told about.

Practical ways to reduce exposure

Start with the accounts that reveal the most about daily life. Review permissions for health, fitness, shopping and finance apps, and disable access to location, contacts or advertising identifiers when those permissions are not necessary. On an iPhone or Android device, reset the advertising ID and limit personalised advertising, recognising that this reduces one tracking method rather than ending profiling altogether.

Use loyalty programmes selectively. A discount at a supermarket in Adelaide may be useful, but the account can connect purchases over years. Consider whether a separate email address, minimal profile information or occasional non-member purchases better suits the sensitivity of the products involved. Do not enter medical details into a retail account merely to receive a generic promotion.

Read privacy policies for data-sharing language, especially references to affiliates, marketing partners, targeted advertising, data enrichment and overseas recipients. Request access to personal information held by a business and ask how it was collected, used and disclosed. If the response is inadequate, complain to the organisation first and then consider the OAIC process.

People who want a deeper look at tracking practices can also consult these privacy notes, particularly when auditing browser settings and online accounts. Use separate browser profiles for sensitive research, block third-party cookies where possible, and avoid logging into a major platform while searching for highly personal medical information.

A private browser cannot prevent every form of commercial surveillance, and deleting an app does not erase data already sold or shared. The goal is to reduce unnecessary collection, identify accountable organisations and avoid giving one company a complete map of your habits.

Health privacy is no longer limited to what a doctor writes in a file. Shopping patterns, phone locations, search terms and app activity can create a persuasive commercial portrait without explicit disclosure. In Australia, the most useful practical rule is to treat every “free” digital service and loyalty account as a potential data transaction: share the minimum information required, refuse unnecessary permissions, and regularly request access to the profile businesses hold about you.