Mental-health information 'sold to advertisers'

https://www.bbc.co.uk/news/technology-49578500

by abhi3 • 7 years ago

250 135 7 years ago

bbc.co.uk

rhcom2• 7 years ago

Personally, it really sucks to get ads targeted at my mental health diagnoses.

hello_friendos• 7 years ago

Agree, I don't need a million ads for a useless text therapist app.

techntoke5• 7 years ago

You obviously need therapy if you don't want the advertisements. /s

techntoke5• 7 years ago

Could you imagine being diagnosed as being paranoid schizophrenic because you think there is some conspiracy to profile and target you with advertisements based on mental health? And your doctor must be in on it because instead of listening to you they just hand you drugs and tell you to take them.

anonymfus• 7 years ago

You just described Alex Jones's business model.

perl4ever7• 7 years ago

I've seen online ads that mention tardive dyskinesia, which is a drug side effect that is particularly associated with psychiatric drugs such as antipsychotics. Of course, there's no way to tell exactly what algorithm/data this is based on, and whether it's my data or the data of people that I'm connected with. Seems like somewhere there should be a HIPAA violation, but that's pretty hopeless.

I think it's safe to say that anyone who is diagnosed as a paranoid schizophrenic is being targeted, which makes it all the more difficult to suppress feelings of paranoia and distinguish actual tracking from coincidences. I doubt there are any people who are perfectly sane driven mad by advertising, but it's quite plausible that it has a negative effect on people trying to cope at the margins.

ghostbrainalpha2• 7 years ago

I am not excusing Google for this behavior but in case you didn't know, you can let Google know which types of Ads you don't want to see based on your profile.

(Not Joking) This was vital to me at work, because I share my screen most of the day and I started getting ads for a Vacation Cruise that was sexual in nature that were unbelievably embarrassing.

https://support.google.com/accounts/answer/2662856?co=GENIE....

I would suggest turning off ALL personalized ads on your Google profile, but in case you like getting ads about Pet products and just don't want your health information shared you can just deselect all the "health", "diet", and "medicine" categories.

It really sucks to target block ads this way and you might even need to stretch to blocking categories like "family and relationships", to get all the ads you don't like.

Nullabillity2• 7 years ago

Why not just get an ad blocker?

perl4ever7• 7 years ago

Sure, I did my best to turn off all personalized Google ads, and then every now and then I get something extremely specific, that has to be targeted at somebody. But is it based on my data, or something that correlated with me? Something not part of Google's data per se?

soared3• 7 years ago

Ads are not targeted at your diagnosis - that is absurd. Ads are targeted at your browsing habits, which may reflect your diagnosis. One is illegal, one is legal. If we want to have an open discussion about advertising making claims like that only hurt privacy advocates.

Ensorceled2• 7 years ago

It's absurd that you think advertisers can't generate this information:

1. Get addresses of mental care clinics and offices.

2. Geofence addresses

3. Correlate devices that visited geofence addresses (using LiveRamp data) with devices that saw your ads on Mental Health sites.

4. Bonus, look at the path on the pages to figure out what disease they were viewing when your ad was displayed if you weren't already targeting specific page content.

PeterisP• 7 years ago

It's not that clear-cut. If particular metrics of 'browsing habits' directly reflect health information, then it is not legal to collect and use these metrics unless very specific conditions are met (which generally can't be met in the generic third party advertiser case). Under GDPR, health data, among with some other categories, counts as especially protected data with much more stringent restrictions than the usual GDPR restrictions.

For example, if you place a cookie recording visits to a specific results page of a mental health test (e.g. a page saying "you got 14-18 points on this test which implies foobar" or get a https://www.hotjar.com/ recording of what the user typed in that test, then that would be blatantly illegal, violating GDPR article 9.1. I'm not even talking about using that data for targeting ads, the default position (if no exceptions are met) is that you're not allowed to collect and store that data.

Collecting user browsing habits is not (in EU) "legal by default" - it may be legal, but it may be not (e.g. if sensitive data are collected as in this case) and it's the duty of data controller to ensure that all the requirements are met - if it turns out that it's too difficult for you to automatically distinguish which browsing habits you are allowed to collect and which not, then the only legal option is to assume that you're not allowed to collect them.

Having your health data not be collected by random companies is an important inalienable right (e.g. privacy as one of the core rights in EU charter of human rights); while collecting and storing browsing habits of other people is a privilege, you're allowed to do that only if you can meet all the required conditions.

perl4ever7• 7 years ago

The thing is, what do you make of advertising that is very, very, specific and not aimed at a general audience...but also wrong? When someone is very certain and wrong, it means they think* they have inside information. The certainty points to it being overly intimate, yet misinterpreted.

*Please don't take this excessively literally.

afarrell• 7 years ago

I wish there was somewhere I could explicitly opt-in/sign-up for ads targeted at my mental health problems...or my problems in general.

As someone who hates shopping, I've been really disappointed with the quality of ad targeting for the past decade.

The ability to select categories of ads has improved things. But I wish I could just write some rule-based criteria and then take 3 hours, look through a bunch of ads, and give them ratings in order to train personalized machine learning models.

kerkeslager• 7 years ago

Why not use independent review sites? Those exist for a lot of categories of shopping.

I'm not sure one exists for prescription drugs or mental health services, though--that would be an interesting idea.

pkaye• 7 years ago

Don't know about ads but I know Google has this feature where when something new about a particular keyword comes up it will email you with the links. I use it to track new research on my own health issue.

michaelmrose• 7 years ago

You could get "targeted" in the sense of a prospective employer not employing you as well.

body125• 7 years ago

To avoid this: Firefox with uBlock Origin and resist fingerprinting setting on. Use private mode whenever you don't need logins. Bonus: Use a $3/mo VPN to dodge your ISP's tracking (xandr.com and weep) or just use Tor Browser for browsing, it's pretty fast these days.

aloknnikhil• 7 years ago

If you're using Firefox, give the Firefox containers a try. https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Gives you everything you seek from a private session

droithomme2• 7 years ago

it really sucks to get ads targeted at my mental health diagnoses

I am extremely cautious to never look up health info without using a VPN and to never discuss health in email exchanges.

After receiving a diagnosis from my doctor some years ago for a condition, a week later I received a targeted snail mail ad for the condition using my full legal name, which only the DMV, my doctor, and the property assessor use. All web stuff, purchases, email, use a nickname instead.

I discussed it with the doctor's office. They said they are HIPAA compliant and wouldn't say more other than referring me to their privacy policy. The privacy policy like ALL medical privacy statements these days contains vague information about "sharing" with third parties and partners in certain circumstances which as written don't appear to be selling private medical data for advertising, but clearly do.

Currently when seeing new doctors I use a fake name, pay cash, and give them a phone number to a phone separate from my normal one, which I bought with cash and never associate with my own name. Works for prescriptions for the most part too since I pay cash for that as well and id is only required for narcotics.

Since then, not so many targeted ads.

reaperducer• 7 years ago

a week later I received a targeted snail mail ad for the condition using my full legal name, which only the DMV, my doctor, and the property assessor use

I had something similar happen. When I told my doctor, he blamed the drug store chain (Walgreens in this case) for selling the information. I don't know if that's true, but my doctor believes it.

i_am_nomad2• 7 years ago

This kind of thing makes me want to start a small independent ISP that automatically blocks trackers, a la Pi-Hole, unless the customer specifically opts in for them. Though, I’m not sure if there are legal hurdles in the US for doing this.

akersten• 7 years ago

Net neutrality is gone, block all you want as an ISP!

techntoke5• 7 years ago

The legal hurdles are billions of dollars spent by corporate ISP conglomerates that have less morals than you do, and unfortunately that makes it more difficult to compete.

ropiwqefjnpoa2• 7 years ago

More like no morals. They only have "morals" when they might get sued, fined or just isn't profitable.

sjg007• 7 years ago

I mean offer a virtual ISP using VPN. Sell a preconfigured router.

fredley• 7 years ago

An ISP won't really cut it these days, since more and more internet use, particularly in developing countries, is mobile. You need to start a small independent mobile carrier.

jschwartzi2• 7 years ago

Someone needs to call John Legere and get T-Mobile working on this.

tenebrisalietum• 7 years ago

I was interested in Pi-Hole, but didn't really want to modify my existing DNS setup.

I have a server running BIND that has forwarders set to external DNS and has views setup so I can reach servers within my network with the same DNS names as externally.

I found this - https://www.pitt-pladdy.com/blog/_20170407-105402_0100_DNS_F... - and it takes the same blocklists Pi-Hole uses and generates BIND RPZ files. It accomplishes the same thing but integrated nicely into my setup. I have it updating weekly.

I mention this to say that I would consider using my ISP's DNS servers if they were Pi-Hole RPZ enabled. And since you can use any DNS you want I can't see why that would create legal issues.

ummonk• 7 years ago

Can't you just offer a DNS service that does that?

i_am_nomad2• 7 years ago

Sure, that would be more cost effective, but less user-friendly. Most people don’t even know what DNS is, and it would be a nightmare walking every single customer through their router’s DHCP settings. Plus, if they cancel their subscription to my DNS, now they have to change it back.

ropiwqefjnpoa2• 7 years ago

When I read things like this, any quams I have about using ad/tracking blockers melt away.

cryoshon• 7 years ago

this is exactly why i view surveillance and advertising as attacks on my personal autonomy. advertisers will use anything and everything against me, whether or not i ever consented to anyone knowing or using any of my information.

if i'm surveilled, anything i do can be monetized and that monetization directly and seriously harms me and exposes me to risk that i did not opt into. if an advertiser knows that i am mentally ill on the basis of my search queries or other data which they illegitimately procure without my consent and against my active objections, they can target me for exploitation with an arsenal of dirty psychological tricks designed to get me to buy their products. if i am like most people, in the long run, they will win because i will buy at least one product which they have forced onto me.

in other words, if i am forced against my will to view a targeted advertisements, it is an inexcusable and unprovoked attack on my right to refrain from economic activity that i do not wish to undertake. it is an attempt at coercion using weaponized persuasion. it is not an attempt in good faith to improve my life or to help me.

this remains true whether that advertisement targets an area where people are explicitly exceptionally vulnerable, such as in the case of mental health, or something more mundane, like my love of fast cars and nice wine. however, in the case of mental health, it may be such that the act of targeting someone with a relevant advertisement genuinely makes their condition worse. so, as we all knew all along, these advertisements are actively, maliciously, and viciously harming people for the sake of a few clicks.

the bottom line here is that advertisers and advertiser-enablers are long overdue for their comeuppance. i'd support a ban on targeted advertisements, but that won't happen legislatively. GDPR and similar laws are a start, but they don't go nearly far enough to punish transgressors. i'd be more satisfied with criminal liability for advertisements exploiting protected classes of PII, but we'll see how things evolve.

RL_Quine3• 7 years ago

I have a rather specific condition that I’ve seen YouTube advertisements for the drugs for, despite not even searching for the details of it except through an anonymizer. I’ve always wondered what the cost per click for an advertisement for a $100,000/yr drugs is.

globuous• 7 years ago

That’s so messed up. What do you think of advertisements for drugs in general? Have they been helpful finding treatment for your condition ? They are illegal where i’m from i believe (i’ve never seen one myself except in the us).

Btw, this reminds of this absolutely hilarious story i think i first heard of here on HN: https://ghostinfluence.com/the-ultimate-retaliation-pranking...

RL_Quine3• 7 years ago

There’s basically one treatment, and one only that any specialist would recommend at this point, so it’s effectively moot other than the question of it being covered by whatever healthcare or insurance you can muster up.

The alternative and older drugs tend to have some rather horrific side effects (detaching your retinas, making your skin detach in some cases) but are very cheap, nobody would choose them if they had the better option.

I’m sort of confused in general what advertising for these sort of drugs actually achieves. It’s not like the patient really has a deciding ability (other than live or die if they can’t afford it), so all it does is act as a constant reminder of how financially screwed you are.

merpnderp• 7 years ago

I’m betting these advertisements are for healthcare providers.

thfuran• 7 years ago

There's basically some segment of the population who will demand $SOME_DRUG_THEY_SAW_ADS_FOR and will change doctors repeatedly until they can get a prescription for it, even if there are better alternatives that were recommended by the previous doctors. Eliminating direct advertisement won't completely avoid that since there will always be blogs full of crazy nonsense or whatever, but I don't think there's any reason that consumers should be getting targeted for ads for things they can't even legally buy.

jiveturkey2• 7 years ago

I’ve always wondered what the cost per click for an advertisement for a $100,000/yr drugs is.

I doubt it's very much. The reason the price of the drug is so high is that there's zero competition. CPC in auction-style ads is driven upwards by competitive pressure.

lalos4• 7 years ago

Here are some ideas:

- If you have a call with your doctor that probably is specialized in that specific condition, that metadata would be good enough to guess that condition.

- Some doctors send appointment reminders via email, if you use gmail that would explain the youtube ad

- If you use the wifi/gps at that doctor office, and some other patient also uses the wifi/gps and they use google to search for those conditions, that would be enough to link you with them. This could be any website making the link and tying all those people as similar.

- Close friends and family that research about your condition, would also point to you having that condition. Would probably use google to research, that would explain ads on youtube. They would also see ads for that and actually even might click on them because they would be interested on it.

bduerst5• 7 years ago

Some doctors send appointment reminders via email, if you use gmail that would explain the youtube ad

Google stopped mining Gmail for ad targeting years ago: https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

everdrive• 7 years ago

Those are all very plausible, but I'm surprised you didn't guess the most obvious:

His healthcare information was not transmitted through technical means. His insurer and/or doctor sold the information.

godelski2• 7 years ago

None of these sound reasonably ethical to me. I think we all agree that medical information shouldn't be sold. If you disagree then what do we do about HIPPA? Get rid of it? I feel like the things you listed above basically skirt around HIPPA. Legal, but definitely violates the spirit of the law.

patmcguire• 7 years ago

Are there any alternatives? It often gets very weird at the high end of drug prices, but usually in a way that inverts normal economic logic - this story from a few years ago blew my mind https://news.ycombinator.com/item?id=13995249#13996448

amelius• 7 years ago

And many used Hotjar, a company that provides software that allows everything users type or click on to be logged and played back.

Er, what?

tiborsaas• 7 years ago

It even records the mouse movements, generate hotmaps, etc. You have to do extra efforts to filter out certain input fields, like passwords or credit card details.

https://help.hotjar.com/hc/en-us/articles/115012439167-How-t...

coldcode• 7 years ago

IBM had something like this once, forget the name, something like TeaLeaf. We were forced to use it in our mobile apps until it became obvious it was terribly broken.

body125• 7 years ago

Yes, every mouse movement, unsubmitted form input, scroll, highlight, and so on. This stuff can also be used to fingerprint you. LiveSession, Inspectlet, UXCam are competitors. uBlock Origin on Firefox can be configured to block these.

jschwartzi2• 7 years ago

I was on the fence about installing an ad blocker until this.

pimterry2• 7 years ago

One of the team behind this research posted an interesting walk-through of the traffic from one of the worst offenders: https://twitter.com/Bendineliot/status/1169259912184115206

maxk42• 7 years ago

As much as I value privacy and think America needs a new constitutional amendment enshrining it in our rights, this title is clickbait and the entire article is designed to whip you into a panic. Here's the crux:

"Privacy International (PI) investigated more than 100 mental health websites in France, Germany and the UK.

It found many shared user data with third parties, including advertisers and large technology companies."

Yes. Mental health websites use third-party ads just like everyone else. Case closed.

They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies.

This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.

gchamonlive• 7 years ago

They're just ordinary websites with ads and other tracking cookies.

This is an interesting take. It means that for information to be sold to third parties it must be explicitly negotiated and delivered, through contractual means, as if it were a product sold with invoices emitted.

What actually happens is virtually the same, minus the explicit negotiation and invoice. Information gets sent to third parties, who cross reference browser information and the location from which the info was sent, effectively identifying and tying the user to the mental health related website. That is, in my opinion no different than explicitly selling mental health information to ad companies and should be treated as such.

lithos• 7 years ago

If a hospital said “we can’t give you patient data, but we’ll give you your own booth to record faces, names, and let you follow patients around", people would be right to be angry.

msbarnett8• 7 years ago

They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies
This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.

I’d suggest instead that your post is the kind of “silly half-truth” that people shouldn’t fall for.

As the article points out (and which you neglected to mention):

And in the case of particularly sensitive data, such as health information, this consent must be explicit.
But the PI investigation found many cookies were installed on people's devices before any consent had been given.

Contrary to your “it’s just an ordinary website, and ordinary websites use cookies, nothing to see here” narrative, these are websites that specialize in giving health advice. The knowledge that a person is seeking advice and tests for indicators re: depression is absolutely sensitive health information (insurance companies and potential employers would happily weaponize that information given half a chance), and the law therefore required explicit consent before using those cookies and forwarding those depression indicator survey answers to third-party marketing data-aggregation affiliates, which these websites did not seek.

This is a clear-cut violation.

TeMPOraL2• 7 years ago

Indeed.

I'd also add that:

half-truths that were used to put cookie warnings on nearly every site on the internet

The half-truth here is that half-truths were used. Cookie warnings are "this site spies on you" warnings (you don't need them if you only use cookies for making the site work), which were introduced as a strong suggestion for the industry to get its act together. It didn't, so now we have GDPR.

pimterry2• 7 years ago

What? The data that you've visited a mental health support website plus your IP easily takes you into GDPR sensitive data territory, and the rules around this are super strict: https://gdpr-info.eu/art-9-gdpr/.

You absolutely should not be handing that information about people to random marketing companies without consent, let alone with informing users. In France, Germany & the UK I would expect that this is a clear & major breach of GDPR and who knows what else.

If you read the report, there's also sites where you fill in a quiz about your mental health & depression, and they forward that data to services like qualifio.com ('The leading Interactive Marketing &Data Collection Platform').

That's definitely concerning. There's no way this is reasonable behaviour, and we shouldn't accept it as such.

body125• 7 years ago

How are precise reading logs of websites that help people learn about and treat mental health conditions not "mental-health information"?

"Subject A traveled from a house (maybe not his house, you see, it's de-identified!) went to the library, selected a book on depression and another on cognitive behavorial therapy, read two chapters in the book on depression, made notes about 4 chapters from the CBT book, went back and re-read one chapter from the first book. Subject took quiz from first book which indicated a severity of 22 on the PHQ-9 depression score (it's not PHI because maybe he made up all the answers!) Subject appeared to move slowly with a sad affect through the library and while reading. Subject appeared to be interested in the 2nd chapter of the first book. Subject's other interests include 2000s romantic comedies and RPG video games. Subject's income is approximately 60k/yr and lives in a household with size 1."

brianpgordon• 7 years ago

This is indeed just business as usual on the web, but I'm not sure that should be an acceptable excuse. Clickbait or not, the article isn't wrong to describe in vivid terms how huge companies traffic in very private personal data so that they can more effectively put ads in your face. Given how willing people seem to be to trade their privacy for a few pennies in free services, maybe plain-language articles like this are what we need to communicate the consequences of where that kind of attitude can lead.

ineedasername• 7 years ago

If it's gathering health information and outputting guidance then they are legally no longer "just an ordinary websites with ads and other tracking cookies". Something like a survey that may offer guidance to, say, a suicide hotline if the survey results point that way crosses a border between passive information dissemination and active health advice. I think it's unlikely US courts would rule that such systematic gathering of health information doesn't make it a "covered entity". But that's just the US. The article focused on the EU, and there the GDPR automatically elevates the level of opt-in permission required.

seamyb882• 7 years ago

Show HN: A boat for servers to keep your tech company on international waters post-digital civil rights.

jetrink• 7 years ago

Patent US7525207B2 - Water-based data center (Google LLC)

https://patents.google.com/patent/US7525207B2/en

Google's [...] floating data centers off US coasts (2013)

https://www.theguardian.com/technology/2013/oct/30/google-se...

colpabar• 7 years ago

Jesus, imagine Google's data handling practices in international waters.

bduerst5• 7 years ago

Why waste money on floating the servers when you can sink them?

Microsoft is already piloting it:

https://www.bbc.com/news/technology-44368813

inlined• 7 years ago

Never heard of one being implemented. Maybe that’s because you can’t store a googol in a floating point?

I’ll see myself out.

jiveturkey2• 7 years ago

That doesn't protect you from GDPR, specifically cited in TFA. The companies studied were located in France, Germany and UK and presumably dealt with EU residents' Personal Data.

So a boat in international waters (seasteading) won't help you. However, simply locating in China is probably adequate.

Obviously your comment is tongue-in-cheek, but being inaccurate it is also misinformation. You've already attracted a serious comment.

zawerf• 7 years ago

Microsoft has an actual underwater data center for energy efficiency purposes: https://news.ycombinator.com/item?id=17244525

seamyb882• 7 years ago

If this is how I get rich I'll be happy and sad at the same time.

pier252• 7 years ago

Or a satellite...

AWildC182• 7 years ago

Ever tried keeping a server cool on a satellite? It's not fun.

If underwater cooling is way better than air cooling, air cooling is absurdly better than vacuum cooling in a sun oven...

mediathrowaway• 7 years ago

I worked for a major DSP / advertising platform and I was asked to setup a campaign to advertise some particular drug to bi-polar people in a manner that would specifically target that population.

I declined to do so and I was later fired. They were within their rights to fire me and I was within my rights to decline. That is all.

Spooky23• 7 years ago

Companies have practices for opioid abuse surveillance and prevention that highlight how available this data is. Example

https://www2.deloitte.com/us/en/pages/public-sector/solution...

They use insurer datasets to model at-risk populations, especially populations with high costs, to identify intervention opportunities. I saw one model where they could identify all pregnant women in a state with 98% accuracy and score them for risk of opioid dependency.

You can layer that type of data with online advertising from vendors like Google and identify opportunities to target behavior factors that combined with medical risk factors present opportunities. For example, a blue collar worker with back pain treated opioid treatment has a baseline risk of abuse. If her address changes or behaviors like online gambling happen, that increases the risk of abuse.

Similar tech has been developed to combat extremist behavior.

http://chicagopolicyreview.org/2019/04/18/can-online-ads-hel...

In short, your health data is not meaningfully private.

body125• 7 years ago

We need to start thinking ahead about who is going to run the federal agencies and "tobacco truth" type organizations funded by the billions of damages from the inevitable settlements, to avoid regulatory capture.

dangrover• 7 years ago

I can't separate what actually happened from the sensationalizing in the article.

It says the websites had Google cookies and others. OK, anybody using Google Analytics has Google cookies. Anyone using FB plugins has FB cookies. Yes, websites certainly have a lot of cookies these days, and the information inferred by use of these can be in a generic fashion to target and rank ads. That's worthy of scrutiny -- but this isn't what the article is about. What is the evidence of "mental health" being treated in some scary specific way?

The only substantial thing in the article supporting the headline is one charge that a site sent quiz answers to Player.qualifo.com -- which appears to be an unregistered domain.

OK, so what information was sold? When did money change hands? Is there any hard evidence that mental health information was "sold to advertisers", as is claimed in the headline? Or is this just bullshit they made up to get clicks?

For that matter, even if you wanted to do some evil psychographic ad thing, why would anyone sell that info to advertisers? What are they gonna do with it? Like, why hand them the literal data, when you could allow them to just bid on ads that may be targeted/ranked using your painstakingly collected psychographic data (a la Cambridge Analytica)? Why sell cow when you can sell the milk?

The fearmongering and disinformation around adtech and privacy numbs us to legitimately scary things being done that should be covered more.

Makes me think of this Blake Ross rant: https://medium.com/@blakeross/don-t-outsource-your-thinking-...

SomeOldThrow3• 7 years ago

A greater problem is the divorce of collection of data and consent.

umvi6• 7 years ago

That's because not everyone agrees that observational data is something that can (or should) be owned by a person.

When a human looks at another person, are they "collecting data without consent"? Most would say no. So at what point do you "own" observational data about yourself? When it's observed by a machine? So then CCTV should be illegal too then, and indeed any sort of security system that records audio/video without consent.

msbarnett8• 7 years ago

It says the websites had Google cookies and others. OK, anybody using Google Analytics has Google cookies. Anyone using FB plugins has FB cookies.

It's not that complicated: certain websites, dealing in certain kinds of sensitive information, may be legally required to seek explicit user consent before even using Google Analytics or Facebook Plugins.

Yes, Google Analytics use is damn near ubiquitous right now. That does not mean it is unambiguously OK to slap it on ever website under the sun.

What is the evidence of "mental health" being treated in some scary specific way?

No evidence is required. The law is clear. That someone subject to GDPR regulations has the information that they were seeking information related to depression transmitted to google and facebook in the form of a Google Analytics and Facebook scripts on page, without their explicit consent to that, is in and of itself a violation of the law.

kodablah2• 7 years ago

I'm not sure it's clear that generic page analytics necessarily means that ones presence on certain pages is any more sensitive than Google maps knowing that you zoomed in on a depression clinic. I can understand this is easy with third party analytics on specific-subject pages, but the waters may appear muddier on web server logs, dns lookups/caches, browser history, search results etc where generic approaches may only be illegal depending on what's visited or looked up. What if the analytics scripts promised not to collect URL or page content (not saying that's the case here)?

If not already clarified somewhere (pardon my ignorance on the bodies/law involved), I think these common cases should be listed as clearly illegal not in canon, but as a helper to these services. Keeping a list containing things like "it's illegal for sites remotely related to health to use third party analytics of any kind sans prior consent" (or "it's illegal for sites remotely related to health to let the URL or content of the page be known to third parties sans prior consent") could help.

I too struggled w/ some of the sensationalizing in the article, because I read:

Sensitive personal information about mental health is routinely being traded to advertisers around the web

as a bold headline, only to read:

This was problematic because sensitive information could be broadcast to all of those bidding, PI said

I couldn't really tell what was really being sold routinely, personal info or ad space. And I couldn't separate what "could be broadcast" vs what was.

elorant• 7 years ago

Because you don't have the platform. Not every company in data brokerage out there owns an advertising platform so that advertisers/ad networks can bid on ads. Furthermore, data isn't only about direct advertising. You can also analyze trends. See what influences purchases. Correlate purchase habits with news events or various other sociopolitical indices. Make your product better. Make new products. Find out which area is hip so you can open your new shop there, or buy some real estate. And the list goes on. Advertising is just the tip of the iceberg. You can exploit such data in myriads of ways.

godelski2• 7 years ago

Why sell cow when you can sell the milk?

Because you want to sell beef and not milk? This analogy breaks down for a lot of the same reasons people in real life sell cows and not just milk.

TeMPOraL2• 7 years ago

Indeed. In particular, neither people selling beef nor people selling milk necessarily breed their own cows. Professional specialization is a thing.

tripzilch• 7 years ago

Why sell cow when you can sell the milk?

Because according to medical tracking data, they are lactose-intolerant? :)

SCAQTony• 7 years ago

The question that should be asked is what technology companies bought that information and was that info sold to human resources departments?

droithomme2• 7 years ago

Always use a VPN and incognito mode when accessing any sites for which your interest has value to others that could harm you.

It's not surprising at all that web sites covering medical issues are also tracking interest in those issues, correlating them with identities, and selling them to third parties, perhaps including life and health insurance companies, potential employers, etc.

jimbob45• 7 years ago

Oh awesome. So does that mean we can finally do away with the gigantic money sink that is HIPAA? Because if we're gonna have our health information leaked, then there's no reason to keep up this charade.

djsumdog• 7 years ago

I get the feeling these are just general websites with mental health information, articles and little tests, but not actual health providers. If it's just a directory and not your health insurance company or doctor, they don't fall under HIPAA. HIPAA only applies to the US. EU laws and the GDPR, which this article are discussing, are very different.

inflatableDodo• 7 years ago

Unfortunately, if you have the clout and money and a facile excuse, you can also get data on patients straight from the NHS itself.

'Revealed: Google AI has access to huge haul of NHS patient data' - https://www.newscientist.com/article/2086454-revealed-google...

'Data deadlines loom large for the NHS' - https://www.bmj.com/content/360/bmj.k1215

Mental-health information 'sold to advertisers'

Related Stories