> ## Content Index > Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt > Use this file to discover other available public pages before exploring further. # When “Aggregated” Isn’t Anonymous: The New York Attorney General Pushes the Boundaries of App Data Disclosures - URL: https://www.thedelatorrereview.com/when-aggregated-isnt-anonymous-the-new-york-attorney-general-pushes-the-boundaries-of-app-data-disclosures/ - Published: 2019-05-14T03:44:00.000Z - Updated: 2026-08-24T03:54:39.000Z - Description: The New York Attorney General’s Matis case shows that “aggregated” data is not necessarily anonymous. If a third party can de-aggregate and re-identify individuals, the sharing should be disclosed—and contracts should expressly prohibit re-identification. - Author: Lydia - Tags: Privacy Notice, Attorneys General (AGs), New York, Anonymization, Mobile Privacy, Aggregated Data, Transparency, Advertising, Regulatory Enforcement > **Key points** > > The New York Attorney General (NY AG) has taken the position that:A mobile app’s privacy notice may need to disclose the sharing of personal data even when the data is provided to third parties in an aggregated, purportedly non-identifiable form—particularly if a third party could combine it with other information to re-identify individual users.When anonymized or aggregated data is shared with third parties, contractual restrictions should prohibit those parties from attempting to re-identify individuals. --- Matis Ltd. was an Israel-based company that offered *My Baby’s Beat*, an app downloaded hundreds of thousands of times. The app was designed to detect fetal heartbeat sounds using only a smartphone’s microphone and to isolate and amplify those sounds. In 2017, the New York Attorney General (NY AG) initiated an enforcement action against Matis. The NY AG raised concerns about both the app’s privacy disclosures and the company’s advertising practices. ## The App’s Privacy Disclosures Were Inadequate The app’s privacy policy did not inform users that Matis collected and stored: - A globally unique identifier associated with the user’s device; - An internal numerical score reflecting the user’s level of engagement with the app; - User feedback, including ratings and emails; and - Recordings shared by users through the app. Matis stated that it would not sell or otherwise transfer data collected from consumers to third parties, although it reserved the right to disclose aggregated data. The company represented that this aggregated data did not contain information capable of identifying individual users. According to the NY AG, however, these disclosures failed to address the possibility that a third party could combine the aggregated data with information from other sources to re-identify users and associate them with sensitive health information. The enforcement action illustrates an important limitation of relying on aggregation alone: data may not be truly anonymous if a recipient can reasonably combine it with other information to identify individuals. ## Matis’s Advertising Claims Were Misleading The NY AG also alleged that Matis falsely advertised the app in violation of New York consumer-protection laws. Matis had taken some precautions to limit potential false-advertising liability. For example, *My Baby’s Beat—Baby Heart Monitor App* included disclaimers and advised users to seek professional assistance with medical questions or concerns. Nevertheless, the NY AG concluded that the company’s marketing conveyed the message that the app could transform a smartphone into a fetal heart monitor. The app was not an FDA-approved fetal heart monitor, and, in the NY AG’s view, Matis lacked adequate substantiation for its claim that the app played the sound of a fetal heartbeat rather than another sound, such as the mother’s heartbeat. ## Settlement Requirements Matis did not admit the NY AG’s findings but cooperated fully with the investigation. Under the settlement, the company agreed to: - Pay a $20,000 civil penalty. - Enhance its privacy disclosures and obtain users’ affirmative consent to its privacy notice. - Disclose that it collected: - An internal numerical score reflecting the user’s level of engagement with the app; - User feedback, including ratings and emails; and - Recordings shared by users through the app. - Stop collecting globally unique device identifiers. - Limit the disclosure of aggregated data to third parties providing storage, security, and internal analytics services to Matis. - Remove references suggesting that the app functioned as a medical device. - Display the following disclaimer: > “This app is NOT a medical device, has not been reviewed by the FDA, and is NOT intended as a replacement for medical advice of any kind. For any medical questions or concerns regarding your pregnancy or your baby’s health, please consult your doctor or midwife.” ## Why This Enforcement Action Matters State enforcement actions such as this one demonstrate that digital health companies may be subject to multiple overlapping regulatory regimes. App developers must consider not only applicable federal requirements but also independent state consumer-protection and privacy laws. The action also underscores that describing data as “aggregated” or “anonymous” does not necessarily eliminate privacy risk. Companies should evaluate whether the data could be re-identified when combined with other information, clearly disclose relevant sharing practices, and impose contractual restrictions prohibiting recipients from attempting to re-identify individuals. ### Resources - [A.G. Schneiderman Announces Settlements With Three Mobile Health Application Developers for Misleading Marketing and Privacy Practices](https://ag.ny.gov/press-release/ag-schneiderman-announces-settlements-three-mobile-health-application-developers?ref=thedelatorrereview.com) (March 2017) - [Assurance of Discontinuance, *In the Matter of Matis Ltd.*](https://ag.ny.gov/sites/default/files/matis%5Faod%5Fexecuted.pdf?ref=thedelatorrereview.com), No. 16-101 (Feb. 13, 2017) ![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/08/Screenshot-2026-07-04-at-4.45.19---PM-21.jpeg)