The Evidence Behind Digital Health Advertising and What is at Stake in How We Regulate It
A woman sees a PSA about maternal warning signs while scrolling on her phone. Weeks later, she checks in for a prenatal appointment on a tablet in the waiting room and sees a version of the same message. Then she mentions it to her doctor.
That sequence—a message reaching someone in daily life, then again at the moment they’re most ready to act—is what digital health advertising makes possible at the scale of the U.S. population. The NAI published Benefits of Digital Health Advertising, a paper documenting how digital health advertising works, what the research shows about its impact, and what policymakers should consider as they write the next generation of privacy laws.
Understanding digital health advertising.
The paper organizes its evidence around two distinct contexts in which Americans encounter health information.
In their everyday lives. In most cases, both historically and today, Americans encounter health advertising in a passive setting: ads served across television, streaming services, social media, and online platforms. Alongside companies in the healthcare sector, federal agencies, leading nonprofits, and medical associations regularly build and deploy public health communication efforts through these channels because of their proven ability to deliver relevant health messages at scale. Particularly for younger and harder-to-reach audiences who have migrated away from traditional broadcast media, digital health advertising is a necessary tool to inform individuals and improve health outcomes. This advertising is increasingly data-driven—an essential component of these campaigns’ reach and effectiveness—and is usually targeted using demographic and other consumer data that is non-sensitive under U.S. privacy laws.
At the point of care. When patients receive care in a doctor’s office, hospital, pharmacy, or telehealth platform, they are likely to interact with Point-of-Care media: educational information about their health, delivered with the goal of facilitating a discussion with their provider. Often encountered in waiting rooms, digital check-in devices, and patient portals, POC media reaches people at the precise moment they are most engaged with their own health, often immediately before a conversation with a clinician. Here the data used to tailor health information is often considered sensitive under U.S. privacy laws, because it relates directly to an individual’s health. Using it for these purposes requires consumer authorization, along with strong data minimization and retention standards and effective use of pseudonymized data where practical.
These two contexts reinforce one another, and the strongest evidence of impact tends to come from campaigns that operate in both.
What the research shows.
The paper draws on peer-reviewed studies, randomized field experiments, and published campaign evaluations across a wide range of public health priorities—tobacco cessation and youth vaping prevention, maternal and cardiovascular health, the overdose crisis, prediabetes, cancer screening and HPV vaccination, infectious disease, dementia, mental health, and prescription drug advertising.
A few of the documented outcomes:
Awareness campaigns operate alongside clinical care, community programs, policy interventions, and individual decision-making, and their effects are usually visible at the population level rather than in any single patient encounter. Digital advertising does not solve these public health challenges on its own. What the evidence consistently supports is narrower and still significant: tailored communication reaches people more effectively than untargeted alternatives, and that reach translates into better-informed patients and more productive conversations with their providers.
Why the policy conversation matters now.
None of this is an argument against regulating health data. It is an argument that data-driven health advertising should be performed in a way that also protects individual privacy and reduces the risk of harm to consumers—and that both industry and policymakers play a critical role in striking that balance.
Currently, the United States lacks a single, comprehensive national law governing the use of consumer data. Instead, collection and processing are managed by a constantly changing and often contradictory array of federal and state laws. This patchwork provides protections to only certain consumers while requiring businesses to comply with diverse and often conflicting requirements. It makes compliance difficult, and it risks unnecessarily restricting beneficial uses of health advertising without offering proportional consumer protections or benefits.
Section III of this paper sets out the NAI’s own work here—the NAI Framework and Privacy Review Program, the Factor Analysis for Health-Related Sensitive Personal Information, and the Demographic Health Advertising Best Practices—and offers four recommendations for policymakers:
- Define sensitive personal information by risk of harm. Frameworks that sweep in virtually all data related to health or the human body restrict valuable uses of data that is neither inherently sensitive nor generates significant risk of harm. A definition of SPI should focus on uses of personal information that pose specific, heightened risks.
- Promote de-identification and anonymization where possible. De-identification is widely recognized as effective for safeguarding privacy while enabling innovative advertising and data analysis, but standards outside HIPAA are fragmented. Policymakers should embrace a clear, consistent standard.
- Promote balanced data minimization. Minimization policies must be carefully scoped — maximizing transparency and setting clear, enforceable limits on processing purposes, while avoiding overly restrictive limits such as blanket prohibitions on data sharing.
- Promote effective consent models. Consent language should be easy for consumers to read and understand, avoiding double negatives, misleading statements, and deceptive framing. Models requiring authorization beyond traditional informed consent are impractical and overly burdensome.
To be clear, effective consumer privacy frameworks cannot rely on any one of these as the sole mechanism for privacy protection. It is when these ideas work together that consumers can enjoy the benefits of digital health advertising while their privacy is appropriately safeguarded.
We invite policymakers, regulators, civil society organizations, and our partners in the public health community to read the paper and engage with us on it.