4 ms·

As much as I value privacy and think America needs a new constitutional amendment enshrining it in our rights, this title is clickbait and the entire article is

by maxk42 7y ago

As much as I value privacy and think America needs a new constitutional amendment enshrining it in our rights, this title is clickbait and the entire article is designed to whip you into a panic. Here's the crux: "Privacy International (PI) investigated more than 100 mental health websites in France, Germany and the UK. It found many shared user data with third parties, including advertisers and large technology companies." Yes. Mental health websites use third-party ads just like everyone else. Case closed. They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies. This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.

__m 7y ago
Companies come first in the US, in politics and individual rights
- maxk42 7y ago
  That's not remotely true and has nothing to do with my point.
  - meesles 7y ago
    You're right about it having nothing to do with your point, but GP is correct. Simple example: Californians can't get pre-filled tax forms because the program to provide that service was lobbied against by tax firms. There are tons of example of oil and gas lobbies against environmental concerns, food/beverage lobbies against public health, the list goes on. In the USA, large companies will get their way most of the time at the expense of the public. Every once in a while, the government realizes an issue and puts in some regulations. Rinse and repeat.
    - pkaye 7y ago
      > Californians can't get pre-filled tax forms because the program to provide that service was lobbied against by tax firms. Do you have information on this? From what I heard California cancelled it after implementing because there was not sufficient use. I think its less lobbying and more that people sticking with what they are familiar with... Turbo Tax or an accountant.
      - meesles 7y ago
        This policy report shows great success on all measures: https://www.taxpolicycenter.org/briefing-book/what-was-experience-california-return-free-tax-filing https://www.taxpolicycenter.org/briefing-book/what-was-exper... Most articles pointing out the lobbying issues are somewhat biased, so I'm struggling to find something objective enough I want to share. It was no secret at the time though, so a little Googling will probably surface some resources to look at.
  - seamyb88 7y ago
    They were talking about here on Earth, it may be different where you are.
gchamonlive 7y ago
> They're just ordinary websites with ads and other tracking cookies. This is an interesting take. It means that for information to be sold to third parties it must be explicitly negotiated and delivered, through contractual means, as if it were a product sold with invoices emitted. What actually happens is virtually the same, minus the explicit negotiation and invoice. Information gets sent to third parties, who cross reference browser information and the location from which the info was sent, effectively identifying and tying the user to the mental health related website. That is, in my opinion no different than explicitly selling mental health information to ad companies and should be treated as such.
lithos 7y ago
If a hospital said “we can’t give you patient data, but we’ll give you your own booth to record faces, names, and let you follow patients around", people would be right to be angry.
msbarnett 7y ago
> They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies > This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it. I’d suggest instead that your post is the kind of “silly half-truth” that people shouldn’t fall for. As the article points out (and which you neglected to mention): > And in the case of particularly sensitive data, such as health information, this consent must be explicit. > But the PI investigation found many cookies were installed on people's devices before any consent had been given. Contrary to your “it’s just an ordinary website, and ordinary websites use cookies, nothing to see here” narrative, these are websites that specialize in giving health advice. The knowledge that a person is seeking advice and tests for indicators re: depression is absolutely sensitive health information (insurance companies and potential employers would happily weaponize that information given half a chance), and the law therefore required explicit consent before using those cookies and forwarding those depression indicator survey answers to third-party marketing data-aggregation affiliates, which these websites did not seek. This is a clear-cut violation.
- TeMPOraL 7y ago
  Indeed. I'd also add that: > half-truths that were used to put cookie warnings on nearly every site on the internet The half-truth here is that half-truths were used. Cookie warnings are "this site spies on you" warnings (you don't need them if you only use cookies for making the site work), which were introduced as a strong suggestion for the industry to get its act together. It didn't, so now we have GDPR.
pimterry 7y ago
What? The data that you've visited a mental health support website plus your IP easily takes you into GDPR sensitive data territory, and the rules around this are super strict: https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/. You absolutely should not be handing that information about people to random marketing companies without consent, let alone with informing users. In France, Germany & the UK I would expect that this is a clear & major breach of GDPR and who knows what else. If you read the report, there's also sites where you fill in a quiz about your mental health & depression, and they forward that data to services like qualifio.com ('The leading Interactive Marketing &Data Collection Platform'). That's definitely concerning. There's no way this is reasonable behaviour, and we shouldn't accept it as such.
body12 7y ago
How are precise reading logs of websites that help people learn about and treat mental health conditions not "mental-health information"? "Subject A traveled from a house (maybe not his house, you see, it's de-identified!) went to the library, selected a book on depression and another on cognitive behavorial therapy, read two chapters in the book on depression, made notes about 4 chapters from the CBT book, went back and re-read one chapter from the first book. Subject took quiz from first book which indicated a severity of 22 on the PHQ-9 depression score (it's not PHI because maybe he made up all the answers!) Subject appeared to move slowly with a sad affect through the library and while reading. Subject appeared to be interested in the 2nd chapter of the first book. Subject's other interests include 2000s romantic comedies and RPG video games. Subject's income is approximately 60k/yr and lives in a household with size 1."
brianpgordon 7y ago
This is indeed just business as usual on the web, but I'm not sure that should be an acceptable excuse. Clickbait or not, the article isn't wrong to describe in vivid terms how huge companies traffic in very private personal data so that they can more effectively put ads in your face. Given how willing people seem to be to trade their privacy for a few pennies in free services, maybe plain-language articles like this are what we need to communicate the consequences of where that kind of attitude can lead.
ineedasername 7y ago
If it's gathering health information and outputting guidance then they are legally no longer "just an ordinary websites with ads and other tracking cookies". Something like a survey that may offer guidance to, say, a suicide hotline if the survey results point that way crosses a border between passive information dissemination and active health advice. I think it's unlikely US courts would rule that such systematic gathering of health information doesn't make it a "covered entity". But that's just the US. The article focused on the EU, and there the GDPR automatically elevates the level of opt-in permission required.

by maxk42 7y ago

__m 7y ago

Companies come first in the US, in politics and individual rights

maxk42 7y ago
That's not remotely true and has nothing to do with my point.
- meesles 7y ago
  You're right about it having nothing to do with your point, but GP is correct. Simple example: Californians can't get pre-filled tax forms because the program to provide that service was lobbied against by tax firms. There are tons of example of oil and gas lobbies against environmental concerns, food/beverage lobbies against public health, the list goes on. In the USA, large companies will get their way most of the time at the expense of the public. Every once in a while, the government realizes an issue and puts in some regulations. Rinse and repeat.
  - pkaye 7y ago
    > Californians can't get pre-filled tax forms because the program to provide that service was lobbied against by tax firms. Do you have information on this? From what I heard California cancelled it after implementing because there was not sufficient use. I think its less lobbying and more that people sticking with what they are familiar with... Turbo Tax or an accountant.
    - meesles 7y ago
      This policy report shows great success on all measures: https://www.taxpolicycenter.org/briefing-book/what-was-experience-california-return-free-tax-filing https://www.taxpolicycenter.org/briefing-book/what-was-exper... Most articles pointing out the lobbying issues are somewhat biased, so I'm struggling to find something objective enough I want to share. It was no secret at the time though, so a little Googling will probably surface some resources to look at.
- seamyb88 7y ago
  They were talking about here on Earth, it may be different where you are.

gchamonlive 7y ago

> They're just ordinary websites with ads and other tracking cookies. This is an interesting take. It means that for information to be sold to third parties it must be explicitly negotiated and delivered, through contractual means, as if it were a product sold with invoices emitted. What actually happens is virtually the same, minus the explicit negotiation and invoice. Information gets sent to third parties, who cross reference browser information and the location from which the info was sent, effectively identifying and tying the user to the mental health related website. That is, in my opinion no different than explicitly selling mental health information to ad companies and should be treated as such.

lithos 7y ago

If a hospital said “we can’t give you patient data, but we’ll give you your own booth to record faces, names, and let you follow patients around", people would be right to be angry.

msbarnett 7y ago

> They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies > This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it. I’d suggest instead that your post is the kind of “silly half-truth” that people shouldn’t fall for. As the article points out (and which you neglected to mention): > And in the case of particularly sensitive data, such as health information, this consent must be explicit. > But the PI investigation found many cookies were installed on people's devices before any consent had been given. Contrary to your “it’s just an ordinary website, and ordinary websites use cookies, nothing to see here” narrative, these are websites that specialize in giving health advice. The knowledge that a person is seeking advice and tests for indicators re: depression is absolutely sensitive health information (insurance companies and potential employers would happily weaponize that information given half a chance), and the law therefore required explicit consent before using those cookies and forwarding those depression indicator survey answers to third-party marketing data-aggregation affiliates, which these websites did not seek. This is a clear-cut violation.

TeMPOraL 7y ago
Indeed. I'd also add that: > half-truths that were used to put cookie warnings on nearly every site on the internet The half-truth here is that half-truths were used. Cookie warnings are "this site spies on you" warnings (you don't need them if you only use cookies for making the site work), which were introduced as a strong suggestion for the industry to get its act together. It didn't, so now we have GDPR.

pimterry 7y ago

What? The data that you've visited a mental health support website plus your IP easily takes you into GDPR sensitive data territory, and the rules around this are super strict: https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/. You absolutely should not be handing that information about people to random marketing companies without consent, let alone with informing users. In France, Germany & the UK I would expect that this is a clear & major breach of GDPR and who knows what else. If you read the report, there's also sites where you fill in a quiz about your mental health & depression, and they forward that data to services like qualifio.com ('The leading Interactive Marketing &Data Collection Platform'). That's definitely concerning. There's no way this is reasonable behaviour, and we shouldn't accept it as such.

body12 7y ago

How are precise reading logs of websites that help people learn about and treat mental health conditions not "mental-health information"? "Subject A traveled from a house (maybe not his house, you see, it's de-identified!) went to the library, selected a book on depression and another on cognitive behavorial therapy, read two chapters in the book on depression, made notes about 4 chapters from the CBT book, went back and re-read one chapter from the first book. Subject took quiz from first book which indicated a severity of 22 on the PHQ-9 depression score (it's not PHI because maybe he made up all the answers!) Subject appeared to move slowly with a sad affect through the library and while reading. Subject appeared to be interested in the 2nd chapter of the first book. Subject's other interests include 2000s romantic comedies and RPG video games. Subject's income is approximately 60k/yr and lives in a household with size 1."

brianpgordon 7y ago

This is indeed just business as usual on the web, but I'm not sure that should be an acceptable excuse. Clickbait or not, the article isn't wrong to describe in vivid terms how huge companies traffic in very private personal data so that they can more effectively put ads in your face. Given how willing people seem to be to trade their privacy for a few pennies in free services, maybe plain-language articles like this are what we need to communicate the consequences of where that kind of attitude can lead.

ineedasername 7y ago

If it's gathering health information and outputting guidance then they are legally no longer "just an ordinary websites with ads and other tracking cookies". Something like a survey that may offer guidance to, say, a suicide hotline if the survey results point that way crosses a border between passive information dissemination and active health advice. I think it's unlikely US courts would rule that such systematic gathering of health information doesn't make it a "covered entity". But that's just the US. The article focused on the EU, and there the GDPR automatically elevates the level of opt-in permission required.