Diagnosed by the Data Broker: When Algorithms Infer What You Never Disclosed

There is a story, well documented in reporting on targeted advertising, of a father who learned his teenage daughter was pregnant from a mailer of maternity coupons — sent because a retail algorithm had inferred the pregnancy from shifts in her shopping habits before her family knew. The story became famous as a marketing anecdote. It should be remembered as a privacy warning.

Because here is the uncomfortable truth about American privacy law: the data that revealed her secret was almost certainly not protected at all.

The Inference Loophole

The Health Insurance Portability and Accountability Act — HIPAA, the law most Americans believe guards their medical privacy — applies only to covered entities: hospitals, insurers, and their business associates. It says nothing about fitness apps, search engines, retailers, or the data brokers who aggregate their signals.

Into that vacuum flows a torrent of behavioral exhaust: search queries about symptoms, purchases of unscented lotion and prenatal vitamins, sleep disruption logged by a wrist-worn tracker, a sudden halt in gym check-ins. Individually, each data point is trivial. Together, machine-learning models can infer pregnancy status, mental health episodes, chronic conditions, even likely medication adherence — all without a single piece of protected health information changing hands.

The law protects what you disclose. It largely ignores what can be deduced. That is the loophole.

Why This Is a Scam Artist's Dream

At HydraWatch we cover phishing and fraud for a living, and the connection here is direct. Inferred health profiles are not merely used to sell diapers.

Consider the targeting potential. Elderly users inferred to be experiencing cognitive decline — flagged by repetitive searches, repeated purchases of the same item, or erratic browsing — are prime audiences for investment fraud and the AI voice-cloning grandparent scams that have emptied retirement accounts across the country. Desperate patients, inferred from searches for expensive treatments, are the exact population steered toward counterfeit pharmacies and miracle-cure cons. People inferred to be in early pregnancy are flooded with aggressive and sometimes fraudulent 'medical billing' and insurance schemes timed to their due date.

The scam industry does not need your diagnosis. It needs your vulnerability, and inference engines deliver vulnerability with a confidence score attached.

What Real Reform Would Look Like

The patchwork response — state laws in California, Washington's My Health My Data Act, and a handful of others — shows the direction but not the destination. Meaningful reform would require three things:

1. Regulate the inference, not just the source. If data can be used to derive health status, it should carry the same legal weight as the health record itself. The trigger should be the conclusion, not the input.
2. Ban the trade in inferred health segments. Data brokers currently sell audiences labeled by condition. That marketplace should not exist in a civilized regulatory system.
3. Meaningful enforcement with individual remedy. Privacy laws without teeth are press releases. Consumers need the ability to sue when their inferred conditions are sold to the highest bidder.

Until Then, Assume You're Being Read

Americans should operate under the assumption that their devices are, in effect, taking notes. Limiting health-related searches to logged-out or privacy-focused browsers, auditing app permissions for fitness and period-tracking tools, and opting out of data broker listings are imperfect but real defenses.

But individual vigilance is not a substitute for law. Your body produces data whether you consent or not. The least we should demand is that the conclusions drawn from it are treated with the same dignity as anything you would tell your doctor — because right now, they're being treated as advertising inventory.