Novartis sued for allegedly leaking data on breast cancer patient to Google, Contentsquare
A breast cancer patient in Vermont has filed a class action lawsuit against Swiss pharmaceutical giant Novartis, alleging the company shared personal health information with tech companies through the use of web activity trackers.
According to a complaint, Novartis shared data with Google and others for the purpose of commercial advertising, with the sharing conducted via tracking cookies and other tools embedded into the drug company’s website.
The plaintiff, identified only as “P.M.,” filed her formal complaint with a U.S. District Court in New Jersey, asking the court to grant the lawsuit class action status, which would allow anyone who used the Novartis website during the same time period to sign on as a potential claimant once the case is resolved.
Bloomberg Law was the first to report the news. The case centers around Kisqali, a drug manufactured by Novartis to treat certain types of breast cancers. P.M., the primary plaintiff, alleges that she began taking the medication in late 2024, at which time she began visiting Novartis’s website to obtain more information and possibly enroll in a prescription savings program.
Unbeknownst to P.M., the website used common tracking tools that capture data on users to create advertising profiles. According to the lawsuit, these technologies captured personal information on users—something P.M. became aware of when she visited other websites, only to see “targeted online advertisements for products and services related to her medical condition.”
The complaint mentions that the ads could have been served up by Google, but it’s also common for Meta, Microsoft, Amazon and others to use tracking cookies for the purpose of customized advertising.
The lawsuit also claims that these companies, in surreptitiously tracking user activity in the background, are ultimately guilty of “identifying new market segments to exploit.”
Data on diagnoses and more possibly leaked
As for what information was taken, it’s not clear. However, it’s common for tracking applications to log IP addresses, browser information, search results, visited websites—and any data submitted to web forms, which could include highly sensitive health information if names, diagnoses, and financial data are being exchanged on a website.
Filed with the court are screenshots for the Novartis website that allegedly shows this type of sensitive data is being shared on the back end with Google and Contentsquare.
Regardless, P.M. says in the complaint that she wasn’t actively notified that her data would be used for advertising. She is seeking damages for her violation of privacy, accusing Novartis of unjust enrichment and negligence. The amount being sought was not revealed.
For now, the case, which was filed on March 19, has yet to move forward.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.