Skip to content

CDC Digital Media Channel Privacy Policy Notice

This is the first captured version of the CDC Digital Media Channel Privacy Policy, so the whole document is new rather than an edit to earlier terms. For a privacy policy it is on the consumer-friendly side: CDC says it does not collect personal information unless you volunteer it, does not use or sell your information for commercial purposes, and requires parental consent for children under 13. The parts worth knowing about are that CDC works with outside vendors to send location-triggered ("geofenced") messages and ads to phones, that comments and messages you send may be treated as public and published, that information may be shared with other government agencies for law enforcement or security reasons, and that records can be kept and released under federal records and FOIA rules.

Your phone's location can trigger CDC messages and adsCDC works with outside vendors to send messages, push notifications, or mobile ads to…

CDC works with outside vendors to send messages, push notifications, or mobile ads to devices that pass through a set area. This depends on your phone's GPS and only happens if you have certain apps and background location sharing turned on. CDC says the system does not track your movements or get your phone number, and you can opt out, so the exposure is limited.

“To receive a geofenced message from CDC, you must have certain apps downloaded and either have background location sharing enabled on your device or be actively using those apps while passing through a geofenced area.”

What you can do — If you don't want these messages, turn off background location sharing for apps you don't need it for, and use the opt-out option offered on CDC-sponsored messages and ads.

DATA COLLECTION
Comments you send may be published or given to the pressAnything you write to CDC through its website or official social media pages can be…

Anything you write to CDC through its website or official social media pages can be treated as public. CDC may publish groups of comments and hand them to national leaders or reporters. It says it tries to protect you, for example by leaving out last names, but you should assume what you write could be seen by others.

“[Information you choose to share with the CDC](https://www.cdc.gov/other/information-received.html) (directly and via third party sites) may be treated as public information.”

What you can do — Leave out health details, contact information, or anything else you would not want made public when you comment on CDC pages or social media.

DATA SHARING
Information can go to other government agenciesWhat you send CDC can be passed to other government agencies when there is a lawful law…

What you send CDC can be passed to other government agencies when there is a lawful law enforcement request or to protect the site from security threats. This is close to standard for a federal agency, but it means your information does not necessarily stay inside CDC.

“If you choose to share information with us, we may in some cases share that information (or automatically generated information) with other government agencies in response to lawful law enforcement requests or to protect CDC.gov from security threats.”
DATA SHARING
Records may be kept under federal law and released through public-records requestsCDC says it keeps what you send only as long as needed, but federal records rules control…

CDC says it keeps what you send only as long as needed, but federal records rules control the actual timeline, and your submission can be released in response to a Freedom of Information Act request, court order, or Congressional request. There is no personal delete-on-demand right described here.

“It may be subject to disclosure in certain cases (for example, if required by a Freedom of Information Act request, court order, or Congressional access request, or if authorized by a Privacy Act System of Records Notice (SORN)).”

What you can do — To find out how long a specific CDC system keeps your data, check that system's policy or its System of Records Notice at hhs.gov/foia/privacy/sorns.html, or call the CDC Privacy Office at 770-488-8660.

DATA RETENTION
CDC can update this policy on its ownCDC can revise the policy whenever it wants. The impact on you is small because it commits…

CDC can revise the policy whenever it wants. The impact on you is small because it commits to posting changes, updating the date, and giving advance notice such as a website banner or subscriber email before material changes take effect.

“We will revise or update this policy from time to time.”
UNILATERAL CHANGES
20230101_rev01 → 20260811_rev01COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED
1## CDC Digital Media Channel Privacy Policy Notice
2
3Privacy Policy
4
5The Centers for Disease Control and Prevention (CDC) is committed to maintaining your privacy and protecting your personal information when you visit CDC websites, use CDC's mobile applications, or receive public health information from CDC. With respect to the collection, use, and disclosure of personally identifiable information (PII), CDC complies with all applicable federal laws.
+ ADDEDFirst version of this policy on record

There is no earlier version to compare against, so everything below is new to our records, not a change CDC just made. The policy covers CDC websites, mobile apps, and official social media pages.

6
7Our privacy policy is clear:
8
9- CDC does not collect any personally identifiable information (PII) when you visit any of CDC's digital medial channels unless you choose to provide that information to us.
+ ADDEDNo personal info collected unless you give it

CDC says it does not gather personally identifiable information just because you visit. Giving your name, address, phone, or email is voluntary and is not needed to read the site.

10- Any PII that you choose to provide is fully protected.
11- Non-PII information related to your visit to our websites may be automatically collected and temporarily stored.
12
13Here is how we handle information about your visit to our website and users who receive CDC information through CDC or other digital media channels:
14
15- [Contact Privacy Office]()
16- [Data Retention]()
17- [Digital Outreach through Geofencing Technologies]()
18- [How Information is used]()
19- [Interaction with Children on CDC Digital Media Channels]()
20- [Security]()
21- [Sharing of this Information]()
22- [Updates to This Privacy Policy]()
23
24If you have any questions regarding CDC's privacy policy or need further information, please contact CDC Privacy Office at [mailto:privacy@cdc.gov](mailto:privacy@cdc.gov), or call 770-488-8660.
25
26Submitting personal information (name, address, telephone number, email address, etc.) is voluntary and is not required to access information on our website. However, if you choose to provide CDC with personally identifiable information - for example by completing a form, leaving a comment, sending email, or completing a survey - we may use that information to respond to your message and/or help us get you the information or services you requested.
27
28We retain the information only for as long as necessary to respond to your question or request. Information submitted electronically is maintained and destroyed as required by the Federal Records Act and records schedules of the National Archives and Records Administration. It may be subject to disclosure in certain cases (for example, if required by a Freedom of Information Act request, court order, or Congressional access request, or if authorized by a Privacy Act System of Records Notice (SORN)). It is subject to the Privacy Act if maintained in a Privacy Act system of record.
+ ADDEDHow long information is kept

CDC says it keeps what you send only as long as needed to answer you, but records are handled under federal records law and may be released in response to a FOIA request, court order, or Congressional request. Retention rules differ system by system.

29
30For more information, see:
31
32- [HHS/CDC System of Records Notices](http://www.hhs.gov/foia/privacy/sorns.html)
33
34As data retention policies vary from system to system, please check that system's policy or their individual SORN for more detailed information.
35
36CDC may work through third-party vendors to use geofencing technologies to reach individuals with critical health information at a specific place and time. These technologies can be particularly useful during a public health emergency. Geofencing technologies are location-based services in which an application (app) or other software program uses a mobile device's global positioning system (GPS) to prompt a specific message, push notification or mobile advertisement (e.g., on web browsers or apps) when that device enters or exits a defined "geofence" or shortly thereafter. A _geofence_ is a virtual perimeter around a real-world geographic area, which could include an airport or land border, school, shopping mall, stadium, or other geographic area.
+ ADDEDLocation-based (geofenced) messages and ads

CDC can work with outside vendors to send health messages, push notifications, or mobile ads to phones that enter a specific area, like an airport, school, or stadium. This only reaches you if you have certain apps installed and background location turned on, or you are actively using those apps in the area. CDC says the geofence does not track where you go or your phone number, and you can always opt out.

37
38To receive a geofenced message from CDC, you must have certain apps downloaded and either have background location sharing enabled on your device or be actively using those apps while passing through a geofenced area. A geofence does not track your location or your phone number; it is solely used to detect devices that may enter a specific geographic area at a point in time so they can receive a CDC-sponsored message. Messages may be delivered multiple times within a few days after crossing through a geofenced area, though CDC will limit the number of times an individual would receive a message. Additionally, CDC requires that individuals always have the option to opt-out of messaging, including any ads that are delivered in real-time and shortly thereafter.
39
40CDC may get aggregated data from third-party vendors about the number of times a message is shown, the number of people who see the message, and the number of comments, likes, shares, and clicks a message receives. CDC may also receive aggregated data about the basic demographic groups reached by messages, such as the distribution of ages and gender ranges. CDC does not receive any personally identifiable information (PII) about individuals reached through geotargeted health messages.
+ ADDEDWhat CDC gets back from ad vendors

CDC receives only grouped, anonymous numbers from vendors, such as how many people saw a message and rough age and gender breakdowns, not information about you personally.

41
42If you choose to [provide us with information](https://www.cdc.gov/Other/information-received.html), we may use that information to contact you, respond to your message, or provide you the information or services you requested. In order to serve you better, we may analyze multiple sources of data you have provided (for example, to look up whether you previously contacted the CDC about the same topic so that we do not send you a duplicative response). We may also use messages or comments collected through CDC.gov sites, Apps, or official social media profiles for our own purposes, such as to inform policy decisions or in public advocacy.
43
44We may use data you provide and automatically generated data for statistical analysis to assess, for example, what information is of interest to users, technical design specifications, and system performance. This allows us to make general improvements to our site as well as to offer tailored content to email subscribers (e.g., a follow-up message to subscribers interested in a specific topic based on information they have provided or automatically generated data).
45
46We believe in the importance of protecting the privacy of children online. As such, we will take all reasonable steps to protect the privacy and safety of any child from whom information is collected as required by the [Children's Online Privacy Protection Act (COPPA)](https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa). A child's parent or guardian is required to provide consent before CDC collects, uses, or shares personal information from a child under age 13.
+ ADDEDProtections for children under 13

A parent or guardian must consent before CDC collects, uses, or shares a child's personal information, and information from a child is deleted once its purpose is done or as soon as it is discovered if given by accident.

47
48When a CDC Web site needs to collect information about a child under 13 years old, COPPA required information and instructions will be provided by the specific Web page that collects information about the child. The Web page will specify exactly what the information will be used for, who will see it, and how long it will be kept.
49
50Personal information about children under 13 years of age may be needed to respond to his/her communication to us. Personal information about your child will be destroyed immediately upon completion of its intended purpose. On rare occasions, it may be determined that a communication from a child under 13 years old should be maintained for historical purposes. Should such an occasion occur, CDC will obtain the necessary consent from the child's parent.
51
52Finally, we provide many on-line tools and services in support of CDC's mission. A child under 13 years old may inadvertently provide personal information to one of these services. If this should happen, the information about the child will be deleted immediately upon discovery.
53
54Our digital media channels are not intended to solicit information of any kind from children under age 13. If you believe that we have received information from or about children under age 13, please contact the CDC Privacy Office (see [Contact information](https://www.cdc.gov/other/privacy.html) here).
55
56All CDC digital media offerings, including the CDC.gov site, are maintained by the U.S. Government and protected by various provisions of Title 18 of the U.S. Code. Violations of Title 18 are subject to criminal prosecution in Federal court.
57
58At CDC, reasonable precautions are taken to protect CDC's digital platforms, including information automatically collected by or voluntarily submitted to CDC.gov or an official CDC page on a third-party site. For example, we restrict access to personally identifiable information to employees, contractors, and vendors who require access to this information in order to perform their official duties, and exercise controls to limit what data they can view based on the specific needs of their position. Access to official CDC accounts on third-party sites is limited to the individuals who administer those accounts, and all official CDC accounts are clearly labeled.
59
60Also, commonly used practices and technical controls are utilized to protect the information in our possession or control, along with CDC.gov itself. These practices and controls include, but are not limited to: encrypting the transfer of personal information over the internet via secure sockets protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL) etc., using high-strength firewalls and intrusion detection systems (IDS) to safeguard personal information, and maintaining strict technical controls and procedures to ensure the integrity of all data on CDC.gov.
61
62We periodically review our processes and systems to verify compliance with industry best practices and to ensure the highest level of security for CDC's all digital platforms.
63
64[Information you choose to share with the CDC](https://www.cdc.gov/other/information-received.html) (directly and via third party sites) may be treated as public information. We may, for example, publish compilations of messages or comments collected through CDC.gov or official social media pages and provide them to national leaders, members of the press, or other individuals outside of the Federal Government. However, we exercise discretion to limit such disclosures to protect your privacy (for example, we generally do not publish last names of commenters).
+ ADDEDYour comments may be made public

Messages and comments you send to CDC, including through social media, may be treated as public. CDC may publish collections of them and share them with reporters, national leaders, or others outside the government, though it says it usually leaves out last names.

65
66The CDC uses a third-party analytics provider (for current provider please see [current third-party tools/pages list](https://www.cdc.gov/other/third-party-pages.html) to collect and summarize this information in conjunction with cookies. The third-party analytics provider does not receive personally identifiable information through these cookies and is prohibited from combining, matching, or cross-referencing CDC.gov information with any other information.
+ ADDEDAnalytics cookies with limits on the vendor

An outside analytics company uses cookies to summarize site usage. That company is not supposed to get personal information and is barred from matching CDC data with any other data it holds.

67
68Within the CDC, we restrict access to personally identifiable information to only those employees, contractors, and/or vendors who require access to this information in order to perform their official duties and exercise controls to limit what data they can view based on the specific needs of their position. If you choose to share information with us, we may in some cases share that information (or automatically generated information) with other government agencies in response to lawful law enforcement requests or to protect CDC.gov from security threats.
+ ADDEDSharing with other government agencies

If you share information with CDC, it may pass that on to other government agencies when there is a lawful law enforcement request or to defend the site against security threats.

69
70We do not use or share your information for commercial purposes and, except as described above, we do not exchange or otherwise disclose this information.
+ ADDEDNo commercial use or sale of your data

CDC states plainly that it does not use or share your information for commercial purposes and does not otherwise disclose it beyond what the policy describes.

71
72We will revise or update this policy from time to time. If we make significant changes to how we handle personal information, we will post changes to the policy on our site and change the date at the bottom. We will provide additional notice in advance (e.g., a disclaimer on our website or an email to subscribers) if material changes are being made.
+ ADDEDPolicy can be updated, with notice for big changes

CDC can revise the policy over time. It promises to post changes and update the date, and to give advance notice, such as a site banner or email to subscribers, before material changes take effect.