Thursday, March 26, 2026

US class action targets Novartis over data sharing on branded drug websites

Novartis is facing a class-action lawsuit in the US. The complaint alleges that consumer-facing branded medicine websites collected personal identifiers and sensitive health-related data from visitors and shared the information with third parties without consent.

The case was filed in US District Court in New Jersey. The lead plaintiff is a breast cancer patient identified in the filing only by initials.

Allegations tied to Kisqali site visits and a savings program

According to the complaint, after being prescribed Kisqali, the plaintiff began visiting the product website in late 2024 to learn more about the medicine and to enroll in a savings program. The lawsuit claims that tracking technologies such as cookies and pixels were used to capture data from those visits and transmit it to third parties, including Google and Contentsquare.

The filing argues that such data can be used for consumer analytics and ad personalization. The plaintiff states that after visiting the Kisqali website, she started encountering online ads related to her medical condition.

Technical evidence and questions around consent notices

The complaint includes what it describes as backend screenshots from multiple Novartis branded drug sites. These are presented as evidence that information tied to site activity and health-related context was automatically sent to the named third-party services.

The Kisqali website currently features a “Cookie Preference Center” that describes the use of optional cookies and similar technologies for purposes such as targeted advertising and analytics. It remains unclear how prominent or accessible these disclosures were at the time of the alleged visits described in the lawsuit.

Claims, potential damages and scale

The plaintiffs allege they did not authorize Novartis to disclose their personal and medical information to third parties. The filing cites alleged harms including intrusions into medical privacy, emotional distress and reduced trust in sensitive communications. It suggests the affected US patient group could include at least 100,000 people.

The lawsuit brings claims including invasion of privacy, negligence, unjust enrichment, alleged violations of the federal Electronic Communications Privacy Act (ECPA), and alleged breaches of confidence, fiduciary duty and implied contract. It seeks damages in an unspecified amount. The complaint also notes that each ECPA violation could carry statutory damages of up to $10,000.

Why the case could matter beyond the US

While the litigation is US-based, it may resonate in Europe as well. Debates over tracking technologies, consent management and data flows on health and medicine websites are already closely watched by regulators in the European market. A high-profile US case involving a global pharma company could therefore inform how European lawmakers and authorities assess potential updates to rules governing digital pharma marketing and data handling.

Novartis did not provide an immediate public response to the allegations.