Case study: when app data sharing contradicted the privacy promise

Based entirely on public reporting. This is not a Patterns Lab client. We have not audited these companies. Every figure below comes from the cited public source; we added no numbers of our own.

The pattern

A consumer health app tells users their health data stays private. Its app and website also ship third-party advertising and analytics SDKs. Those SDKs receive identifiers and health-related events. Years later, a regulator documents the gap between the promise and the data flow.

Public case 1 — GoodRx (FTC, February 1, 2023)

• Civil penalty: USD 1.5 million; first enforcement action under the FTC Health Breach Notification Rule.
• Data shared with Facebook, Google, Criteo, Branch and Twilio, according to the FTC complaint.
• More than 55 million consumers visited or used GoodRx's website or apps since January 2017.
• Order: permanent ban on sharing health data for advertising, affirmative consent for other sharing, deletion requests to third parties, a mandated privacy program.

Source: FTC press release, ftc.gov, 2023-02-01.

Public case 2 — BetterHelp (FTC, March 2, 2023)

• USD 7.8 million to provide partial refunds to consumers who paid between August 1, 2017 and December 31, 2020.
• Email addresses, IP addresses and health questionnaire information shared with Facebook, Snapchat, Criteo and Pinterest for advertising, according to the FTC complaint.
• Order: ban on sharing health data for advertising; each future order violation can bring a civil penalty of up to USD 50,120.

Source: FTC press release, ftc.gov, 2023-03-02.

The App Store side

Since spring 2024, Apple requires privacy manifests for commonly used third-party SDKs added in new app submissions or updates, and approved reasons for "required reason" APIs in order to upload to App Store Connect. The developer is responsible for all code an SDK includes in the app.

Source: Apple Developer News, "Privacy updates for App Store submissions", 2023-12-07.

What an endpoint-level check would have surfaced

Both public cases hinge on one question: which third parties does the shipped app actually send data to, and does that match what users were told? That is a testable, technical question. A data-flow review captures every network endpoint a build contacts and compares it with the App Store privacy label, the privacy policy and SDK configuration. We make no claim about what outcome a review would have changed in these cases.

Next steps

• Run the free ios-privacy-label-check on a HAR capture of your app.
• Estimate your own exposure with the ROI calculator.
• Request the free 15-minute check · Standard audit USD 9,000 fixed, 50% upfront.

Patterns Lab · SILENCE.OBJECTS · audit@patternslab.work
Technical review only. Not a certification, not a penetration test, not legal advice.