Doctissimo ran health quizzes with no consent and MD5 passwords — CNIL fined it €380K

Doctissimo is one of France's most-visited health sites, known for its medical articles and busy forums. In June 2020 the activist group Privacy International complained that its data practices were 'particularly grave and systemic'. The CNIL investigated, acted as lead authority for concerned EU regulators, and on 17 May 2023 fined the site — by then owned by Reworld Media — €380,000: €280,000 for GDPR breaches and €100,000 for cookies.

The core problem was the site's interactive quizzes on subjects like colon cancer and endometriosis. On roughly 5 percent of them, users' health answers were collected with no warning and no consent mechanism, although health data is 'particularly sensitive' under the GDPR. The 24-month retention of quiz answers was judged excessive and unjustified, and accounts inactive for three years were still kept without anonymization.

The anonymization itself was illusory. Doctissimo asked its hosting subcontractor to anonymize quiz data, and the provider 'anonymized' IP addresses by hashing them with SHA-256 — without any hashing key. The CNIL held that a bare hash is not anonymization at all. Security fared no better: the site still served pages over unencrypted HTTP, and stored passwords hashed with MD5, an algorithm the regulator noted has been obsolete since 2004 and proscribed for security use.

Each failure traces to the same decision: treating a health-media brand as an advertising machine first and a data controller second. Cookies were dropped on the homepage with no way to refuse — months after the CNIL's April 2021 deadline for refuse buttons — and consent for the most intimate quiz answers was simply never engineered. The fine was modest, but the deliberation became a benchmark: unsalted hashes do not anonymize, and health features need health-grade consent flows.

€380,000 fine (€280K GDPR + €100K cookies); health answers from about 5% of quizzes collected with no consent; passwords stored in MD5

Quiz products were built for reach, not compliance: health answers were harvested on about 5% of tests with no consent mechanism, though the GDPR ranks health data as particularly sensitive.

Retention was set generously and never revisited: 24 months for quiz answers was 'excessive and unjustified', and dormant accounts were kept without anonymization.

Pseudonymization was mistaken for anonymization: the subcontractor hashed IPs with unsalted SHA-256, which the CNIL ruled does not make data anonymous.

Security debt was visible and cheap to fix: unencrypted HTTP navigation and MD5 password hashing — obsolete since 2004 — persisted on a site handling sensitive data.

The cookie wall ignored a known deadline: two cookies were dropped on arrival with no refuse option, months after the CNIL's 1 April 2021 compliance date.

Health content is health data: a quiz about cancer is sensitive-data processing, not a traffic driver. And 'hashed' is not 'anonymous' — an unsalted hash is a pseudonym a regulator will see through.

The fine and the published deliberation landed on 17 May 2023, with the CNIL acting as lead supervisory authority for other EU regulators whose residents used the site. Privacy International welcomed the decision and pressed medical sites to be fully transparent about sensitive data and to give users control over sharing. Doctissimo remains in operation under Reworld Media, but the deliberation outlived the headline: it is now a standard French-language reference for why unsalted hashes are not anonymization and why health features demand health-grade consent design.