It isn't illegal to target based on a medical condition. I am not making any value judgement about it, just providing factual clarification. Unless HIPAA rules were violated, there's no problem. For example, at iCouch, if they were to take diagnostic information stored on their server by their practitioner and then send out emails to the patient based on the Protected Health Information, that would be illegal. But someone visiting a depression website and then targeting depression treatment ads based on that -- that would not be illegal. Don't would depend on where the information came from that was used to do the targeting. The targeting itself wouldn't be illegal, but the use of the data to do targeting could be illegal if that data were Protected Health Information covered by HIPAA or the Hi Tech Act. Of course, I am only speaking in a US context here..