As regulations tighten, cleanroom technology offers a sustainable, compliant path forward for health advertising.

The advertising technology ecosystem is at a crossroads. Eighty percent of consumers are concerned and confused about how their data is being used, and regulations like Washington’s My Health My Data Act and New York’s S929 are redefining the rules for the entire industry. The use of sensitive health data now demands a complete transformation. 

For those of us who design the systems behind audience creation, activation, and targeting, the message is clear: it’s time to fundamentally rethink our approach. 

After a decade developing probabilistic, ID-less solutions for DSPs, targeting, and attribution, I can confidently state: the way we handle real-world health data needs to change. The risks from a legal, reputational, and ethical standpoint, are simply too great. Specifically, health data must never be linked to persistent identifiers, such as advertising IDs, which expose consumers to privacy violations and companies to regulatory consequences. 

The answer lies in cleanroom technologies. By offering a secure, collaborative space for data analysis, cleanrooms ensure privacy, compliance, and a sustainable foundation for health-related audience-building technologies. This is the path forward. 

Why Persistent Identifiers No Longer Work 

Regulators and legal scholars now agree: linking health data to persistent identifiers like advertising IDs, IP addresses, or cookie IDs, is no longer legally permissible without explicit consent. Even de-identified data, when combined with real-time bidding signals, can lead to inadvertent re-identification, violating state regulations. For example, even when health data is de-identified, combining it with RTB signals can inadvertently re-identify individuals, violating the MHMD Act. Washington’s MHMD Act now defines personal health information broadly, closing the loopholes of pseudonymization practices long used in advertising.   

This shift directly impacts legacy health audience techniques. The practice of using health data to enhance advertising IDs for targeting purposes is no longer viable and regulators, including the FTC, have shown they will hold companies accountable even when violations occur via third-party partners. 

Building a Privacy-First Foundation 

The solution involves two core strategies: 1.) eliminating persistent identifiers from audience creation workflows and 2.) housing all data within a cleanroom.  

Removing identifiers ensures that individuals cannot be traced across datasets, while cleanrooms enable secure, statistical analysis that outputs only de-identified, aggregated insights. When correctly implemented, cleanrooms prevent re-identification by outputting only de-identified, aggregated insights and statistics. 

This two-pronged privacy-first approach complies with emerging laws while preserving the ability to create and activate meaningful health audiences. It offers a clear, operationally sound alternative to outdated targeting models. 

The Path Forward 

We must move beyond pseudonymous identifiers toward privacy-secure methodologies. By prioritizing compliance now, the industry can innovate responsibly by developing smarter, safer, and more effective tools that earn public trust. 

Health data is too sensitive to mishandle and the stakes are too high to ignore. It’s time to build a future where ethical technology underpins every aspect of health advertising. 

Want to find out how BranchLab can help you future-proof your strategy? Get in touch