Purpose-specific health data consent, receipts, and revocation propagation
Health data almost never has one use. A single blood-pressure reading might legitimately support clinical care, feed a research cohort, be licensed to a data broker, or fuel an ad-targeting model — and the reasonable answer for each of those can differ. Granular consent management treats each purpose as its own yes/no decision instead of one blanket "I agree."
Most consumer health platforms historically used a single, bundled consent screen: accept the Terms of Service and Privacy Policy together, or do not use the product. That model conflates fundamentally different processing purposes — treatment, research, product analytics, advertising, and resale — under one irrevocable click.
GDPR Article 7 and Recital 32 require that consent be a freely given, specific, informed and unambiguous indication of the data subject's wishes, given by a clear affirmative act. Bundling defeats "specific": a user cannot meaningfully consent to five distinct purposes with one checkbox, because withholding consent to any one of them (e.g., advertising) forces them to also lose the others (e.g., care). The EU's Article 29 Working Party (WP259, 2018) explicitly names purpose-bundling as a form of invalid consent.
Granular consent management decomposes the bundle into independently gettable and revocable grants — typically 4-8 named purposes per platform — each mapped to a specific legal basis, data category, and set of downstream recipients.
No single law governs consumer health data in the US the way HIPAA governs hospitals and insurers. HIPAA's Privacy Rule does not require patient authorization for treatment, payment, or healthcare operations, and — critically — it does not apply at all to most direct-to-consumer health apps (period trackers, symptom checkers, wellness wearables) because they are not "covered entities."
That gap has been filled unevenly: • Washington's My Health My Data Act (in force March 2024) defines "consumer health data" broadly (anything that could identify a person's physical or mental health status) and requires a separate, unambiguous opt-in consent — distinct from any other terms — before collection or sharing, plus a private right of action for violations. • California's CPRA (effective Jan 2023) created the California Privacy Protection Agency and requires businesses to honor Global Privacy Control opt-out signals as a valid do-not-sell/share request. • GINA (2008) bars health insurers and employers from using genetic information, but explicitly does not extend to life, disability, or long-term-care insurers — a gap genetic-testing companies routinely disclose in their consent flows. • EU data subjects additionally get purpose-limitation rights under GDPR Art. 5(1)(b): data collected for one purpose cannot later be repurposed without a fresh, compatible legal basis.
The FTC's 2023 enforcement actions against GoodRx ($1.5M, first-ever Health Breach Notification Rule case) and BetterHelp ($7.8M) both turned on exactly this failure mode: health data collected under a "for care" framing was quietly piped to Facebook, Google, Snapchat, Pinterest and Criteo for ad targeting — a purpose users never separately consented to.
A workable granular-consent system defines a small, closed set of purpose categories up front, each with its own legal basis and retention rule, for example:
• Clinical care & care coordination — legal basis: contract / vital interest; shared only with treating providers • Research (de-identified or identified cohort) — legal basis: explicit consent; shared with named research partners under a data use agreement • Product analytics & service improvement — legal basis: legitimate interest, narrowly scoped • Third-party sale or licensing to data brokers — legal basis: explicit opt-in only, never legitimate interest • Advertising & marketing (including "share" for cross-context behavioral ads under CPRA) — legal basis: explicit opt-in only
Each purpose is rendered as an independent, unchecked toggle at first use, satisfying the "no pre-ticked boxes" requirement that CJEU case law (Planet49, C-673/17, 2019) established for cookie-style consent and that regulators now apply by analogy to health-data consent screens.
A consent toggle that lives only in one company's database is a liability, not a record: it cannot be audited, exported, or verified by a second party. The consent receipt turns "the user clicked yes" into a portable, cryptographically verifiable artifact that travels with the data wherever it is legitimately shared.
The Kantara Initiative's Consent Receipt Specification (v1.1, 2018) — later folded into ISO/IEC 29184:2020 as an informative annex — defines a standard JSON structure so that any two systems can exchange proof of consent without a shared backend. A receipt typically carries:
• Receipt ID and issue timestamp (immutable, hash-anchored) • Data subject identifier (pseudonymous where possible) • Purpose ID(s) and human-readable purpose description, drawn from a controlled taxonomy such as the W3C Data Privacy Vocabulary (DPV, 2022) • Processing legal basis (consent, contract, legitimate interest, vital interest) • Data controller and any named third-party recipients or sub-processors • Data categories collected (e.g., "continuous glucose readings", "mental-health questionnaire responses") • Collection method and consent UI version, so a specific screen layout can later be reproduced for audit • Sensitive-data flag (health, genetic, and biometric data get heightened scrutiny under GDPR Art. 9) • Expiry / retention period and jurisdiction
Because the receipt is signed and hash-anchored at issuance, it becomes tamper-evident: neither the controller nor the user can later claim a different scope was agreed to.
Genomics research has run its own version of this for a decade: GA4GH's Data Use Ontology (DUO) encodes machine-readable consent restrictions — e.g. "general research use," "disease-specific research only," "no insurance use," "no methods development" — directly into the dataset's metadata, so any downstream researcher's query engine can automatically reject a request that falls outside the original consent scope.
Traditional research consent is static: sign once, at enrollment, for a study description that may not anticipate secondary uses discovered years later. "Dynamic consent" platforms — pioneered in genomics by projects like CTRL (Genetic Alliance) and used in biobanks such as the UK's 100,000 Genomes Project follow-on programs — instead give participants a live dashboard where they can grant, restrict, or revoke consent per study, per data category, and per requesting institution, at any time.
This matters specifically for health and genetic data because: • A single genome is relevant to relatives who never separately consented • New research questions (and new commercial uses) emerge continuously after collection • Re-contacting thousands of biobank participants by mail for every new sub-study is operationally impossible without a standing consent infrastructure
A dynamic-consent receipt is therefore versioned: each change (grant, narrow, revoke) issues a new receipt superseding the last, with the full chain retained for audit.
A proprietary "consent flag in a database column" is not a receipt — it cannot be verified by the patient, exported to a new provider, or checked automatically by a downstream processor's systems. Standardized, signed receipts solve three problems logging alone cannot:
1. Portability: when a patient switches providers, their consent history (not just their clinical record) can move with them, satisfying data-portability rights under GDPR Art. 20 and similar state laws. 2. Automated enforcement: a processor's ingestion pipeline can programmatically check a receipt's purpose ID before accepting a data feed, rather than trusting a bilateral contract clause that no software actually reads. 3. Independent audit: regulators (FTC, state AGs, EU DPAs) can request the receipt chain directly, rather than relying on the company's self-reported compliance narrative — which is exactly what FTC consent orders against GoodRx, BetterHelp and Flo Health now require as an ongoing condition of settlement.
A consent receipt is only meaningful if the systems moving data actually check it. Purpose-bound sharing turns consent from a legal promise into a technical gate: the API layer itself refuses to emit a data packet down a channel that has no matching, unexpired, unrevoked receipt.
In a purpose-bound architecture, every outbound data call carries a purpose tag, and the API gateway or data-sharing broker cross-checks that tag against the subject's current, unexpired consent receipt before the call is allowed to complete. If the "advertising" purpose has no valid receipt, the advertising SDK's request for that user's data is rejected at the gateway — not merely discouraged by a contract clause the ad network's engineers never read.
This matters because the FTC's recent health-privacy enforcement wave shows the promise-only model failing repeatedly and in nearly identical ways:
• GoodRx (Feb 2023): shared users' drug purchases and health conditions with Facebook, Google and Criteo for years while publicly promising never to share such information with advertisers — the first case brought under the 2009 Health Breach Notification Rule. • BetterHelp (March 2023): shared email addresses, IP addresses, and mental-health questionnaire answers with Facebook, Snapchat, Pinterest and Criteo for ad targeting, despite explicit promises of confidentiality; ordered to pay $7.8M to affected consumers. • Flo Health (2021 consent order): the period-tracking app told users their health data would stay private, then sent ovulation and pregnancy-intention data to Facebook Analytics and Google via embedded SDKs — a mismatch between the consent-facing promise and the actual telemetry pipeline that no purpose-check would have permitted.
In every one of these cases the underlying failure was architectural, not just contractual: the mobile SDK or analytics pipeline had no mechanism to ask "does this user have a valid advertising-purpose receipt?" before firing an event. Purpose-bound enforcement closes exactly that gap by making the check a precondition of the network call itself.
The hard engineering constraint is that blocking must be purpose-specific, not data-specific — the same glucose reading that cannot flow to an ad network must still flow instantly to the treating clinician, because clinical-care sharing typically rests on a different legal basis (contract or vital interest) that does not require the same opt-in consent GDPR demands for advertising.
A purpose-bound gateway therefore maintains, per data subject, a small matrix of {purpose × recipient × expiry}, checked on every call:
• Clinical care channel: always open while an active care relationship exists, regardless of marketing consent state • Research channel: open only while a specific study's receipt is valid and only to the named research partner in that receipt • Third-party sale / licensing channel: closed by default; requires an explicit, separately dated opt-in receipt with no auto-renewal • Advertising channel: closed by default; a revoked or expired receipt immediately drops the channel on the next call, with no grace period for pending SDK batches
Purpose-bound sharing also has to reckon with a subtler risk: data a user legitimately consented to share can still become a liability when the sharing mechanism itself is compromised. In October 2023, 23andMe disclosed that attackers used credential stuffing (reused passwords from other breaches) to access roughly 14,000 accounts directly — but because those users had opted into the "DNA Relatives" feature, the attackers could also view profile data belonging to the relatives those users were connected to, ultimately exposing information tied to about 6.9 million accounts.
The consents involved (family-matching, relative visibility) were legitimately granted and purpose-specific by design — the failure was in account-security controls (no mandatory multi-factor authentication at the time), not in the consent model itself. It illustrates a general principle for granular consent systems: purpose scoping limits what a legitimate request can see, but it does not substitute for authentication and access-control hardening around the accounts holding the consent grants.
GDPR Article 7(3) requires that withdrawing consent be "as easy as" giving it — but the harder engineering problem is what happens after the click. A single revocation event has to reach every downstream processor and sub-processor that received data under the old grant, within a bounded time window, and trigger cessation or deletion at each hop.
Flipping a "consent = false" bit in the controller's own database is trivial and, on its own, close to meaningless. The data the user is revoking access to may already sit in a research partner's data warehouse, an ad network's audience segment, a data broker's resale inventory, and that broker's downstream buyers. A defensible revocation system has to model this as a directed graph — controller → processor → sub-processor → sub-sub-processor — and propagate the revocation event along every edge the original consent receipt authorized.
CPRA and GDPR both address this by contract: businesses must flow down the same restrictions to every service provider and sub-processor they share data with, and those downstream parties are contractually obligated to honor deletion and cessation requests forwarded to them. But contractual obligation and technical propagation are different things — a downstream partner's ad-serving cache may keep using stale audience data for days or weeks unless the revocation signal is actually pushed to their systems, not just logged as fulfilled on the controller's side.
GDPR Article 7(3) and Recital 42 establish a specific asymmetry regulators actively enforce: if consent takes one click to grant, it cannot take a phone call, a mailed form, or a multi-step "are you sure, here's what you'll lose" flow to withdraw. The UK ICO and several EU DPAs have issued guidance and enforcement specifically against "friction asymmetry" — cookie banners with a one-click "Accept All" but a five-click path to "Reject All" are the most litigated example, and the same logic now extends to health-app consent screens.
A compliant revocation flow needs: • A single control surface (toggle, not a support ticket) mirroring the original grant UI • Immediate effect on new data flows (checked at the gateway, as in Stage 3) • A bounded propagation SLA to existing downstream copies — GDPR's Art. 17 erasure right sets "without undue delay," generally operationalized as 30 days, though technical best practice pushes for same-day cessation of active use even where full downstream deletion takes longer • A receipt of the revocation itself, so the user has proof the request was made and when
Clearview AI was fined €20M by Italy's Garante in 2022 (and separately by France, Greece, and the UK) specifically for lacking any valid consent basis for scraping and processing biometric data — with no functioning mechanism for individuals to have their data removed at all. It is the sharpest illustration of what a revocation system with no real downstream reach looks like from a regulator's side: technically "requestable," practically unenforceable.
Health data revocation is rarely all-or-nothing. A patient may revoke advertising and third-party-sale consent while keeping research and clinical-care consent active — and some retained data cannot legally be deleted even after full revocation. Completed clinical records are typically subject to independent retention mandates (state medical-record laws commonly require 7-10 years regardless of the patient's current consent preferences), and data already anonymized beyond re-identification for a completed research analysis generally falls outside GDPR's erasure right entirely (Recital 26).
A well-designed revocation cascade therefore distinguishes: • Purposes that stop immediately and delete on request (advertising, resale) • Purposes that stop new collection but retain existing records under independent legal mandate (clinical records) • Data already irreversibly de-identified, where the right to erasure does not apply because the data is no longer "personal data" under the regulation
Surfacing this distinction to the user — rather than silently doing partial deletion behind a "Done!" confirmation — is itself part of what separates a genuinely informed consent system from a reassuring-looking but misleading one.
Every mechanism above — granular purposes, signed receipts, gateway enforcement, cascading revocation — can be technically flawless and still fail its purpose if the interface talks users into clicking "agree" without understanding what they agreed to. Dark-pattern audits evaluate the consent screen itself, not just the plumbing behind it.
The FTC's September 2022 staff report "Bringing Dark Patterns to Light" and the EU's Digital Services Act (Article 25, in force since February 2024) both catalog recurring manipulative design patterns found in consent flows, including:
• Pre-ticked boxes: opt-in purposes (research sharing, marketing) defaulted to "on," relying on inattention rather than affirmative choice — invalidated for cookie consent by the CJEU in Planet49 (2019) and treated the same way for broader consent under GDPR guidance since • Confirmshaming: framing decline options with guilt-inducing language ("No thanks, I don't care about my health") designed to shame users into accepting • Asymmetric friction: one-click "Accept All" against a multi-screen, multi-click path to decline or customize • Interface interference: visually de-emphasizing the "reject" or "customize" option (small gray text) while the "accept" button is large, high-contrast, and centered • Nagging: repeatedly re-prompting for consent after a decline, hoping the user eventually accepts out of fatigue • Obstruction (roach motel): easy to grant consent, deliberately difficult to find the revocation control later
Each of these can coexist with a technically valid receipt and a working revocation API — the standards infrastructure from Stages 2-4 does not, by itself, guarantee the moment of choice was fair.
An auditable, non-manipulative consent screen for health data sharing generally exhibits:
• Symmetric visual weight: "Accept," "Decline," and "Customize" rendered with equal size, contrast and prominence — no color or size cue nudging toward acceptance • Unticked-by-default toggles for every purpose beyond what is strictly necessary for the service to function • Layered disclosure: a short, plain-language summary of what data goes where and why, with a clearly linked "see full detail" expansion — not a single 2,500-word policy as the only option • No forced choice: users can decline optional purposes and continue using the core service, satisfying GDPR's prohibition on "consent or coercion" bundling (Recital 43 explicitly disfavors consent as valid where there is a clear imbalance, including take-it-or-leave-it bundling) • A revocation control in the same place, same number of clicks, as the original grant — directly implementing Art. 7(3) • A visible receipt or confirmation the user can independently verify later, rather than a fire-and-forget "Thanks!" toast
The Washington My Health My Data Act (effective March 2024) is the first US state law to explicitly prohibit the use of dark patterns to obtain consumer health data consent, defining a "dark pattern" by direct reference to FTC guidance and pairing that ban with a private right of action — meaning individual consumers, not just state regulators, can sue over a manipulative health-consent flow.
Mature organizations increasingly treat consent-screen design the way they treat authentication flows: something to be red-teamed, versioned, and regression-tested, not shipped once and forgotten. A structured audit typically scores each consent surface against:
1. Default state — is anything opt-out that legally requires opt-in? 2. Visual symmetry — measured contrast ratio and tap-target size between accept and decline 3. Language — presence of shaming, urgency, or scarcity framing in decline copy 4. Click-depth parity — number of taps to grant vs. number of taps to revoke the same purpose 5. Comprehension — plain-language readability score (e.g., Flesch-Kincaid grade level) of the purpose descriptions actually shown at the moment of choice, not buried in a linked policy
Because the consent receipt from Stage 2 already records which UI version a given grant was collected under, a UX audit can be run retroactively against real user cohorts — comparing conversion, subsequent revocation rate, and complaint volume across screen versions to show, empirically, which designs a regulator would call informed and which would not survive an FTC deceptive-practices review.