Do Not Track Non-Response Disclosure

What it is

The Policy discloses that UnitedHealthcare does not honor web browser Do Not Track signals, citing the absence of a common definition and industry-accepted standards for such signals.

Why it matters (compliance & governance perspective)

This provision discloses the company's non-compliance with browser-level Do Not Track signals in the context of a platform that collects health, financial, and behavioral data. Several US state privacy laws, including California's, require disclosure of Do Not Track response practices, which this provision satisfies as a disclosure obligation. The Global Privacy Control signal, which some states require platforms to honor as an opt-out of sale or sharing mechanism, is not addressed in this provision.

Consumer impact (what this means for users)

This clause discloses that UnitedHealthcare does not respond to browser Do Not Track signals, meaning browser-level privacy settings using this mechanism will not affect data collection on the Online Services. Users seeking to limit behavioral tracking may use the opt-out mechanisms described in the Policy, including adjusting browser cookie settings or using the advertising network opt-out links provided.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: California's Online Privacy Protection Act requires disclosure of Do Not Track response practices, which this provision satisfies. The California Consumer Privacy Act and California Privacy Rights Act establish requirements regarding the Global Privacy Control signal as a valid opt-out of sale or sharing mechanism; the Policy's silence on GPC response may require evaluation under current CCPA enforcement guidance from the California Privacy Protection Agency. 2. GOVERNANCE EXPOSURE: Medium. The non-response to Do Not Track signals is a standard disclosure in current industry practice. However, the absence of any reference to Global Privacy Control signal response, which the California Privacy Protection Agency has treated as a required opt-out mechanism for covered businesses under CPRA, creates a potential compliance gap for California users that is distinct from the Do Not Track disclosure addressed here. 3. JURISDICTION FLAGS: California's CPRA framework and CPPA enforcement guidance on GPC signals creates specific exposure for California-resident users. Colorado, Connecticut, and other state comprehensive privacy statutes may similarly require recognition of universal opt-out signals that are not addressed by the Do Not Track disclosure in this provision. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party analytics and advertising vendors operating on the platform should be assessed for their own GPC and Do Not Track signal handling practices, as the company's stated non-response to Do Not Track does not necessarily extend to or bind those vendors' independent data collection activities. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the company's Online Services are required to honor Global Privacy Control signals under CPRA for California residents, and if so, whether the current technical implementation and Policy disclosures address that requirement. The Do Not Track disclosure in this provision should be reviewed for adequacy under current multi-state privacy law requirements.

Applicable agencies

Provision details

Other risks in this policy

• Combination of Online and Offline Information high
• Company May Change Policy at Any Time high
• Company Right to Remove or Edit Social Media Content high
• Consent to US Data Transfer Processing high
• Continued Use Constitutes Consent to Policy Changes high
• Do Not Track Signals Not Honored high