Healthcare remarketing strategies and Brazil's privacy law

An oncology clinic launches a campaign for people who visited the treatment page. Cost per appointment drops and the report looks good. Without anyone deciding it, the institution now keeps, inside an advertising platform, a list of people probably diagnosed with cancer.

That is the blind spot of healthcare remarketing. The problem is almost never the channel, the creative or the size of the budget: it is the criterion that forms the audience.

Lei 13.709/2018 does not forbid paid media in healthcare. It imposes a higher bar of authorisation when the processing involves data concerning health, and most sites' cookie banners do not meet that bar.

One caveat that applies to the whole article: this text guides a media decision, it does not replace legal advice. Validate it with the data protection officer (DPO) and with your institution's legal team before it becomes a campaign.

Why is health data sensitive personal data?

Health data is sensitive personal data because the law classifies it that way. Article 5, II of Lei 13.709/2018 defines sensitive personal data as data on racial or ethnic origin, religious conviction, political opinion, union membership, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.

Caption: in healthcare remarketing, the law changes regime when the audience criterion reveals the patient's condition

Ordinary data runs under article 7; sensitive data under article 11, which is far more restrictive. Article 11, I authorises processing when the data subject or their legal guardian consents, specifically and prominently, for specific purposes.

Notice what is not on that list. Legitimate interest, set out in article 7, IX and detailed in the ANPD guidance (Autoridade Nacional de Proteção de Dados, Brazil's data protection authority), does not appear in article 11. The legal basis that sustains most Brazilian digital advertising becomes unavailable when the data reveals health.

There is also a paragraph that widens the article's reach and rarely enters the conversation. Article 11, § 1 states that the article applies to any processing of personal data that reveals sensitive personal data and that may cause harm to the data subject, except where specific legislation provides otherwise.

The decisive word is “reveals”. You do not have to store a diagnosis to fall under article 11: it is enough that the processing reveals the condition, on the same logic as CRM compliance with privacy law, where a field's label matters less than what it allows you to infer.

Why doesn't a generic cookie banner solve healthcare remarketing?

A generic banner does not solve it because the law demands two attributes it lacks: specificity and prominence. Article 8, § 4 states that generic authorisations for processing personal data are void. Void consent does not sustain a campaign.

Add to that the “specifically and prominently” of article 11, I. The text calls for a separate act of authorisation, over a named purpose, not a single accept covering analytics, personalisation and advertising in the same click.

The ANPD has already taken a position on that design. Its guidance on cookies and personal data protection, version 1.0, from October 2022, states that consent may be considered a more appropriate legal basis for advertising cookies.

The same document settles three points that tend to be argued internally. It does not accept consent that is inferred or obtained tacitly, it requires the data subject to have an effective possibility of accepting or refusing cookies with no negative consequences, and it recommends that consent-based cookies be disabled by default.

On a healthcare site's screen, that is blunt: a banner with “accept all” prominent and refusal hidden on a second level is already fragile for ordinary data, and nowhere near enough for sensitive data.

Valid consent for this would have to say, with uncomfortable clarity, “I authorise the use of my browsing on specialty pages to show me ads”.

That finding is useful, not discouraging. The route is not to perfect the banner until it authorises a clinical audience: it is to change the audience, with the same determined-purpose reasoning that appears in running an AI SDR under the privacy law.

What is the real risk of page-based remarketing in healthcare?

The real risk of remarketing by visited page is turning a paid media list into an informal patient registry. When the entry criterion is “visited the psychiatry page”, the list stops describing commercial interest and starts describing the probable health condition of identifiable people.

The condition escapes through four points in the operation, all fixable:

• Pixel parameters: many implementations send the full URL (Uniform Resource Locator, the page address) as an event property, and a clinical page's URL carries the specialty in the path itself.
• Audience and campaign names: ad panels keep those labels, and an audience called “oncology visitors 30 days” documents the inference in writing.
• Sharing with the platform: article 11, § 4 prohibits the communication or shared use between controllers of sensitive personal data concerning health for the purpose of obtaining an economic advantage.
• Creative: even with a clean audience, the ad can deliver the inference by asking about or asserting the viewer's condition.

The exceptions in § 4 are specific and do not cover media. They concern the provision of health services, pharmaceutical assistance and healthcare, including portability requested by the data subject and the financial and administrative transactions resulting from those services. The conservative reading, which usually prevails in risk analysis, is that sending a clinical audience to a media platform finds no shelter there.

On the creative side, the boundary is already written by the platform. Meta's advertising standards prohibit ads that assert or imply the audience's own personal attributes, and list physical or mental health conditions, including medical ones, among them.

The policy's own examples show where the line sits. “Do you have diabetes?” and “Is depression getting you down?” appear as prohibited, while “New diabetes treatment available” and “Depression counselling available” appear as allowed. The rule Meta states is the same one: ads should focus on the benefits of the product or service, not on the attributes of whoever is watching.

Video: the balance of media and content that healthcare remarketing needs once the clinical audience is off the table, on the mkt4edu channel (in Portuguese)

The platforms also close the door on the audience side. Google's personalised advertising policy lists Health among its sensitive interest categories and records that advertisers in those categories cannot use advertiser-curated audiences.

The restriction is broad and worth reading item by item. It covers customer list targeting, the advertiser's own data segments, audience expansion and similar segments, while Google's predefined audiences stay available, because they are configured without sensitive user signals.

Google's rule changes the argument. It is not only the law that blocks this: the contract with the platform does too, and breaching it can cost the ad account before any administrative sanction arrives.

What is still possible in healthcare remarketing?

Plenty remains possible, and this is where the conversation stops being defensive. What leaves the table is one specific criterion, the visited clinical page. Institutional interaction, non-clinical services, aggregated audiences and a base with its own consent are all still available.

The separation gets clearer when the audience criterion is examined item by item, with the basis alongside:

Table: audience criteria in healthcare remarketing and the legal provision or platform policy supporting each reading

Notice the middle column almost never says “advertising prohibited”. It says “do not use this criterion”, and that difference separates an unworkable vertical from one that simply needs segmentation discipline.

How do you build institutional and aggregated audiences in healthcare?

An institutional audience is one whose entry criterion describes a person's relationship with the institution, not their condition. They visited the home page, checked the list of locations, looked at accepted insurance, viewed the careers page. None of those signals reveals a diagnosis.

That first route covers the top of the funnel comfortably: a hospital network or health plan usually has enough institutional volume to sustain an entire campaign without touching a specialty page.

The second route is the aggregated audience. Instead of recovering individuals, Paid Media speaks to a region, an age band and a broad interest, using the platform's predefined segments, which are exactly what Google's policy keeps available for sensitive categories.

Another effective alternative is contextual media, where ad delivery is guided by the page's topic rather than the reader's browsing history. Although it lost ground when paid traffic prioritised individual targeting, the strategy becomes highly relevant again in healthcare.

The fourth route is first-party consent, managed in the CRM (Customer Relationship Management, the system that centralises patient relationships). When a person authorises, specifically and prominently, receiving communication about a named service, there is a basis for processing that data for that purpose, with a record of date, text shown and version.

The care here is operational. Lead segmentation in the CRM has to keep the consent marker attached to the contact, so no ad list leaves without that filter.

A fifth technique helps more than it seems: use exclusion instead of inclusion. Excluding people who already booked is an operation on conversion, not on condition, and it saves budget without building a clinical audience.

It is worth clearing up a common confusion about list size. Google documents a minimum of 100 active visitors or users within the last 30 days for Search, Display and YouTube, and the same page records that any list uploaded before 1 February 2024 still has to meet the previous requirement of 1,000 matched users.

That is why HubSpot's knowledge base still records 1,000 users for Search and YouTube, and 100 for Display and Gmail. These are not conflicting rules: it is the old threshold living alongside the new one, and it is worth planning for the larger figure whenever the list is old or not refreshed often.

The deeper point is a different one: a list of a hundred people who visited the page of a rare specialty is more sensitive, not less, than a list of a thousand. No platform minimum works as a safeguard.

Video: generating opportunities from first-party data, the route healthcare remarketing favours, on the mkt4edu channel (in Portuguese)

What do you bring to legal and the DPO before launching?

Bring documents, not intentions. The meeting with the data protection officer usually stalls because marketing arrives describing the campaign's objective, while legal needs to assess the processing: which data enters, for what purpose, under which legal basis and who receives it.

Five deliverables settle most of that conversation:

• A tag map by page: the list of URLs where the pixel fires and the list of clinical pages where it does not.
• A legal basis per audience: one line per active audience, saying whether it sits under article 7 or article 11, and why.
• An event sample: the real payload of an event, proving the URL and specialty name are not sent as parameters.
• Roles in the contracts: agency and tooling act as processors in some activities, and the media platform as a controller in others.
• A data subject rights flow: article 18 guarantees deletion of data processed with consent and withdrawal of consent, and the flow has to reach ad lists, not just the CRM.

An audience with no declared legal basis should not be live. The logic is the same one that organises any contact base inside the HubSpot CRM: knowing where the data came from and why it can be used.

Repeating the caveat, because it is the most important point in this section: nothing here is legal advice. The reading on audiences that reveal a health condition is an interpretation grounded in the text of the law, and it needs confirmation from your DPO and legal team before becoming internal policy.

Which compliance checklist should a healthcare campaign use?

A useful checklist does not ask whether the campaign is compliant. It asks for the evidence proving each answer, because that is what the data protection officer files and what sustains the decision if the authority or the patient raises a question.

Ten checks cover the essentials before launch:

Table: minimum compliance checks for healthcare remarketing and the matching evidence that supports each one

The value of that checklist shows up on the second campaign. Once the tag map and the naming convention exist, every new healthcare campaign is born compliant, and legal approval leaves the critical path.

Frequently asked questions about healthcare remarketing and the law

What is possible in healthcare remarketing?

In healthcare remarketing, it is possible to stay present with people who engaged with the institution, rather than recovering those who showed clinical interest. That is the change of premise: an audience built on relationship and documented legal basis, less precise on paper and sustainable in practice.

The competitive advantage in this vertical is the barrier itself. The typical competitor either stops advertising out of fear of legal or keeps a clinical audience without noticing the problem, and whoever documents the legal basis of each audience finds the middle ground empty.

One last time, because it is the line that closes the subject: this article organises a reading of the law and a paid media decision, but it does not replace legal advice. Validate it with your data protection officer and legal team before applying any recommendation here.

If the bottleneck today is operational rather than interpretative, you can structure page-level tracking, consent records and list segmentation inside a HubSpot CRM configured for the sector.

The record is what sustains the decision later. Keeping legal basis, purpose and collection date alongside each contact is CRM compliance work, and it is what lets you reconstruct why an audience existed when an audit or the data subject asks.