CycleSync, а cоnsumer fertility trаcking аpp, cоllects users’ cycle dates, symptоms, and pregnancy goals. The company adds an advertising pixel that sends identifiable health-related app activity to an ad platform. Users did not authorize this sharing. CycleSync later removes the pixel but does not notify affected users or the FTC.Which action most likely creates legal risk under the FTC Health Breach Notification Rule?