Several digital health and genetic testing websites shared customer data with Meta for ad targeting without explicitly informing customers, Wired reported Feb. 6.
In a new report, researchers and members of a patient privacy advocacy group detailed their findings from downloading their own data from the "Off-Facebook" activity tool, which shows what information about users third parties are sharing with Facebook. They were surprised to find five health sites were included on the list of companies that shared their information with Facebook. In three of these cases, the company policy lacked clear language about how third-party tools would use and share their information.
While ad tracking is common, it is also relatively non-transparent, and it can be difficult to understand how and where data is used. It may also have a greater impact on patient populations, as third-party tracking tools could gather health information on a patient while also building a larger picture of their interests and demography. This means ads can then be targeted and personalized for the patient specifically, perhaps making reference to their health condition, as some pregnant women have experienced.
"Many of the companies we looked at aren't HIPAA-covered entities, so this health-related data exists in an almost wholly unregulated space. Research has consistently shown that the flow of such information for advertising can disproportionately harm vulnerable populations," Eric Perakslis, PhD, chief science and digital officer at Durham, N.C.-based Duke University's Clinical Research Institute, told Wired.
Three of the five companies mentioned in the report have changed their ad sharing policies and made any remaining policies more explicit to the customer, giving them the opportunity to opt in or out.