Condition and Ailment Audience Targeting: How It Works and Where the Privacy Lines Are

Condition audiences are one of the most bought and least understood products in DTC media. A segment called "Type 2 Diabetes Sufferers" might be built from a survey, from grocery purchases, from browsing, or from a statistical model, and those produce very different audiences. The privacy rules also differ by how the data was collected and how sensitive the condition is. This is part of the series that starts with the DTC pharma marketing guide.

How ailment audience targeting works

A condition audience is a list of identifiers (cookies, mobile IDs, hashed emails, CTV household IDs) tagged as likely to have, or be interested in, a health condition. The vendor builds it, a DSP or platform activates it, and your ads are served to those identifiers. The questions that matter are what made each identifier qualify, and how the data was consented.

Where condition audiences come from

Most commercial segments mix several of these. Ask the vendor for the share from each source, the recency window, and how the segment was validated against a truth set. The due-diligence checklist for DTC health audiences lists the full question set.

Where the privacy lines are

NAI rules on sensitive health targeting

The Network Advertising Initiative's code, which member companies agree to follow, treats certain health conditions as sensitive and generally requires opt-in consent before using data about them for ad targeting. Sensitive categories have typically included things like cancer, mental health conditions, and sexually transmitted infections, while some general wellness categories are treated less strictly. Check the current NAI code and guidance for the exact definitions, since they are updated.

State consumer health data laws

Washington's My Health My Data Act, in effect since 2024, regulates "consumer health data" broadly, including data that identifies someone's past, present, or future health status, and inferences about it. It requires consent for collection and separate consent for sharing, and it includes a private right of action. A few other states, including Nevada and Connecticut, have passed related rules. Comprehensive state privacy laws in many more states also treat health data as sensitive. The state view is in state consumer health data laws and pharma media.

HIPAA and the FTC

HIPAA applies to covered entities and their business associates, not to most ad tech vendors. Health data that has been de-identified under HHS standards is outside HIPAA, which is why many measurement and modeling products start there. But a model trained on de-identified data can still produce consumer health data inferences under state law. Companies outside HIPAA that handle health records may also be covered by the FTC Health Breach Notification Rule. None of this is legal advice.

Platform policies

Large platforms restrict health-based targeting independently of the law. Some do not allow advertisers to target based on health conditions at all, and others limit it to contextual or broad interest categories. Expect the options to differ by platform.

A practical sensitivity tiering

Teams that handle this well tier conditions before choosing audiences:

1. Tier 1, highly sensitive (mental health, oncology, HIV, reproductive health, substance use): contextual, endemic publishers, broad demographics, first-party only. No third-party condition audiences unless consent is verified and legal approves.
2. Tier 2, moderately sensitive (many chronic conditions): condition audiences possible with documented opt-in consent and vendor diligence; avoid activation in states where your legal team says no.
3. Tier 3, low sensitivity (general wellness, common OTC-adjacent topics): broader options, still with provenance checks.

The tier list is a judgment your privacy team owns. The examples above are common placements, not rules.

Contextual alternatives that actually work

Contextual targeting puts the ad next to relevant content without using data about the person. It avoids most consumer health data questions, scales better than people expect, and is not affected by identifier loss. Build segments from topic and page-level signals, not just keywords, and exclude content that could make the placement look exploitative (news about deaths, lawsuits). The comparison is covered in contextual vs. audience targeting for DTC pharma, and execution in programmatic is in DTC programmatic for pharma.

What usually goes wrong

• A segment is bought by name, without anyone asking what share is modeled.
• Retargeting is turned on for brand site visitors, which effectively builds a condition audience from site behavior without consent.
• Geo exclusions for restricted states are set at the campaign level but not the audience level, or vice versa.
• Audience performance is judged on click rate, which tends to reward broad, low-precision segments.

Practical takeaway

List every condition audience currently active on your brand, and for each one write down the data source mix, the consent basis, and the sensitivity tier. Pause anything you cannot fill in, and replace it with a contextual segment until the vendor answers.

Frequently asked questions

What is ailment audience targeting?

It is the practice of reaching consumers who are likely to have, or be interested in, a specific health condition, using data such as survey responses, purchase signals, content consumption, or models trained on de-identified health data. In pharma it is used to concentrate DTC spend on people more likely to be patients or caregivers.

Is it legal to target ads based on health conditions?

Often yes, but with conditions. Sensitive condition targeting generally requires opt-in consent under NAI rules, state laws such as Washington's My Health My Data Act require consent for collecting and sharing consumer health data, and platforms restrict health targeting on their own. Get privacy and legal review for each condition and data source.

What is the alternative to condition audiences?

Contextual targeting places ads next to content about the condition or related topics without using data about the individual. Broad demographic targeting and endemic health publishers are other options. Many brands use contextual as the default for sensitive conditions.

Sources

• Network Advertising Initiative
• Washington State Office of the Attorney General, Protecting Washingtonians' Personal Health Data and Privacy
• HHS, Guidance Regarding Methods for De-identification of PHI
• FTC, Health Breach Notification Rule: The Basics for Business

External guidance and platform documentation change. Links were current at publication; check them again before relying on them for a decision.

Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.