Two Swedish pharmacies' Meta Pixels leaked medicine purchases — €3.9M in fines

Sweden's data protection authority fined pharmacy retailers Apoteket and Apohem for transferring customers' sensitive personal data to Meta, announcing fines of 37 million kronor (€3.2 million) and 8 million kronor (€705,800) respectively in August 2024. Both had used Meta Pixels to optimise Facebook and Instagram marketing and unintentionally activated a new 'automatic advanced matching' feature, sharing more data than intended.

What moved to Meta included customers' over-the-counter medicine purchases — self-tests, treatments and sexual products — plus personally identifying information, in combinations that could reveal that a specific person had bought specific products. No prescription data was transferred. The investigation found Apoteket's feature ran from January 2020 to April 2022, affecting up to 930,000 customers, while Apohem's ran for a year and affected almost 15,000. Neither had routines to detect unintended changes, and the transfers were discovered only after an outside party told them.

The pharmacies argued buyers might not be the products' users, so sensitive data could not be established; the regulator held that GDPR's special protection extends to information indirectly revealing health, and that at least some purchases were likely for personal use. It weighed the pharmacy setting's high confidentiality expectations in the fines, alongside the fact that the data travelled in illegible format and was never publicly disclosed.

Apoteket fined 37 million kronor (€3.2M), Apohem 8 million kronor (€705,800); Apoteket's leak ran January 2020 to April 2022 and touched up to 930,000 customers.

The failure was organisational, not just technical: no routines existed to catch unintended changes to tracking systems.

The leaks ran for years — 27 months at Apoteket — before an outside party flagged them.

Indirect sensitivity counts: OTC purchases like self-tests and sexual products can reveal health even without prescriptions.

GDPR's special protection applies to inferred data, which the regulator read broadly against the pharmacies' argument.

A third-party pixel is a live data pipeline: default-on upgrades change what you send, so somebody must own change control and actually notice.

The authority framed the case as a GDPR security failure: failure to put appropriate measures in place for sensitive data in a setting where customers expect high confidentiality. Apoteket and Apohem did not respond to requests for comment. Sweden had fined Avanza Bank 15 million kronor (€1.3 million) in June 2024 over incorrect Meta pixel settings at the bank.