Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that Ro may use sensitive personal information including health treatment history, sexual orientation, and information about sex life to deliver targeted advertising, and that users have the right to opt out of this use by visiting the 'Your Privacy Choices' page.
This analysis describes what Ro's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes processing of health and sexual orientation data for advertising purposes, which may require opt-in consent rather than opt-out under certain state privacy laws including CPRA. The policy explicitly acknowledges that Ro does not use sensitive personal information for tailored advertising in Maryland, Washington, or Nevada, indicating that applicable law in those states constrains this practice.
Interpretive note: Whether the opt-out framework satisfies applicable state law opt-in requirements for sensitive data depends on jurisdictional enforcement interpretation, particularly under CPRA and analogous state statutes.
Under these terms, information about treatments you have requested or received, your sexual orientation, and related health information may be used to deliver targeted advertising to you and shared with Ro's advertising partners, unless you opt out via ro.co/do-not-sell/ or the Global Privacy Control. The agreement states that opting out means advertising may still be shown but will not be targeted based on this sensitive information.
Cross-platform context
See how other platforms handle Sensitive Health Data Used for Targeted Advertising and similar clauses.
Compare across platforms →Monitoring
Ro has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To provide you with more relevant online advertising regarding Ro's products and services, as described immediately above, we may use information about the treatments you have requested or received and similar information. This may include the processing of information that is considered 'sensitive data' or 'sensitive personal information' under applicable laws, such as health information and information about sex life and sexual orientation (collectively referred to herein as 'sensitive data'). You have a right to limit or opt out of our use of sensitive data for purposes other than to provide the services or goods you request or as otherwise permitted by law, including our and our partner's processing of sensitive data for tailored advertising purposes.Excerpt from Ro's Privacy Policy
REGULATORY LANDSCAPE: This provision implicates the California Consumer Privacy Act as amended by CPRA, which requires opt-in consent for use of sensitive personal information beyond defined permitted purposes; the Texas Data Privacy and Security Act and similar state frameworks with sensitive data restrictions; HHS guidance on HIPAA and marketing; and the FTC Act and FTC's health data enforcement posture. Enforcement authorities include the California Privacy Protection Agency, state attorneys general in the listed states, and the FTC. The provision's opt-out rather than opt-in framing may create tension with CPRA's sensitive data opt-in requirements depending on how Ro's affiliated medical entities are classified under HIPAA and CCPA. GOVERNANCE EXPOSURE: High. The use of health treatment information and sexual orientation for advertising purposes is a category of data processing that regulators including the FTC and state AGs have specifically identified as high-risk. The policy's acknowledgment that these practices are restricted in Maryland, Washington, and Nevada suggests awareness of state-law constraints, but the opt-out framework applied in other states may not satisfy opt-in requirements under CPRA for California residents. JURISDICTION FLAGS: California creates the highest exposure due to CPRA's opt-in requirement for sensitive personal information. Maryland, Washington, and Nevada are explicitly carved out in the policy. Texas residents receive a dedicated privacy section. EU and UK residents may have additional rights under GDPR's explicit consent requirement for special category data, though the policy does not clearly address international users. CONTRACT AND VENDOR IMPLICATIONS: Advertising partners and analytics providers receiving sensitive data must be assessed under HIPAA business associate requirements if the data originates from covered treatment contexts. Vendor contracts should include data use restrictions limiting advertising use to permitted purposes and prohibiting re-identification of de-identified data. The joint marketing partner category is disclosed separately and may involve data sharing without direct service provider restrictions. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the consent mechanism for sensitive data advertising satisfies opt-in requirements under CPRA for California users, verify that state-specific carve-outs for Maryland, Washington, and Nevada are implemented at the technical and operational level, review advertising partner agreements for data use restrictions, and assess whether HIPAA business associate agreements cover all entities receiving treatment-related information used for advertising.
This provision authorizes processing of health and sexual orientation data for advertising purposes, which may require opt-in consent rather than opt-out under certain state privacy laws including CPRA. The policy explicitly acknowledges that Ro does not use sensitive personal information for tailored advertising in Maryland, Washington, or Nevada, indicating that applicable law in those states constrains this practice.
Under these terms, information about treatments you have requested or received, your sexual orientation, and related health information may be used to deliver targeted advertising to you and shared with Ro's advertising partners, unless you opt out via ro.co/do-not-sell/ or the Global Privacy Control. The agreement states that opting out means advertising may still be shown but will not be …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ro.