5 ms·

Buried in complaint 3, "Make Chrome’s ‘Incognito mode’ actually incognito" "One example: Just this week, my colleague Tatum Hunter reported that Google (as wel

Buried in complaint 3, "Make Chrome’s ‘Incognito mode’ actually incognito" "One example: Just this week, my colleague Tatum Hunter reported that Google (as well as Facebook and TikTok) was sent personal information when patients use the Planned Parenthood website scheduling pages. The problem was marketing embedded in the code of the page — and Chrome does little to stop that kind of tracking." You scheduled an abortion. Planned Parenthood’s website could tell Facebook (June 29) https://www.washingtonpost.com/technology/2022/06/29/planned-parenthood-privacy/ https://www.washingtonpost.com/technology/2022/06/29/planned... https://archive.ph/3HHtt https://archive.ph/3HHtt That's on Planned Parenthood.

zozbot234 4y ago
Chrome's Incognito mode is doing its job here, by making sure that the user is logged out of her Facebook account during that browsing session. What the tracking code does is a different matter altogether, and even Facebook has tried and failed to stop it from sending all sorts of sensitive data, including stuff that might well fall under HIPAA.
js2 4y ago
> That's on Planned Parenthood. Only in part. Ultimately it's the browser that's sharing the data from PP to FB. It's not like PP is making a direct connection from their backend to FB's backend. It's Chrome that's connecting to FB. Apple has demonstrated with Safari that browsers can fight this tracking if they want to. Google has no interest in doing so because their browser doesn't work for the user. It works for the likes of Google, FB, and yes, PP.
- judge2020 4y ago
  > It's not like PP is making a direct connection from their backend to FB's backend. But it’s possible from the backend: https://developers.facebook.com/docs/marketing-api/app-event-api/ https://developers.facebook.com/docs/marketing-api/app-event...
  - js2 4y ago
    Yes, but unlikely what's happening here. I assume incompetence not malice on PP's part. That doesn't excuse this privacy leak. My point is that this isn't all on PP. I consider Google and FB malicious in sharing data in their zeal for dollars. I consider PP incompetent in protecting privacy in its marketing efforts, which yes, also needs dollars, but it's a non-profit and really not in its interests to share this information.
- bushbaba 4y ago
  Would make for an interesting lawsuit. Should chrome be held liable for violating hipaa.
  - thaeli 4y ago
    I don't see how they would be a covered entity.
  - tomrod 4y ago
    Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]
- ChrisMarshallNY 4y ago
  Also, lest we forget, the site designer. Most folks are unaware of the things that can happen, when a Web designer loops in a dependency. The dependencies tend to bring friends. Lots of friends. I'm not sure what the answer is. Many, many folks are incapable of designing sites without the dependencies, and these dependencies often add great value, so "don't do that" isn't really an option. It's easy enough to say "set up a licensing board," but these tend to be a cure, worse than the disease. Incumbents will use them to prevent competition, and governments like to use them as a private piggy bank, like red-light cameras. Paying for the dependencies makes sense (if I make my living on something, it’s only natural that I pay for my tools and raw materials), but the chains can be long, and there can be many parts that simply cannot be paid for, or will get stolen, or corrupted. I think that we need to figure out some way to improve the dependency space, but there's no simple solution. Anyone claiming there is, is trying to sell something that is maybe a bit past its "sell by" date. "There's always an easy solution to every human problem; Neat, plausible and wrong." "The fact that I have no remedy for all the sorrows of the world is no reason for my accepting yours. It simply supports the strong probability that yours is a fake." -H. L. Mencken
indymike 4y ago
> That's on Planned Parenthood. This is really an important point. The owner of a website or app has to comply with regulations, and HIPAA should apply to people seeking medical care, especially those seeking care that is politically or otherwise sensitive. This is literally what HIPAA was trying to prevent: disclosure of medical info to third parties without direct consent of the patient. A click should not be enough to consent. Third party tags have no place in the DOM on these sites.
zagrebian 4y ago
This is exactly what the Google Container add-on for Firefox protects against. It stops Google from tracking you across the web because your Google login does not exist when you visit other websites. It only exists within the container. https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai... Unfortunately, it does not have Mozilla’s “Recommended” seal of approval. I assume Mozilla cannot do this because Firefox development is funded by Google, so Mozilla has to tolerate Google’s tracking to some degree. I’m still using this add-on because I cannot imagine my web browsing life without it.
- autoexec 4y ago
  > This is exactly what the Google Container add-on for Firefox protects against. It stops Google from tracking you across the web because your Google login does not exist when you visit other websites. I don't think that it does. I mean, it does help a little, but if you have Firefox with this add-on installed and visit websiteA which pings google's server and loads their JS which fingerprints your browser they have your device logged, the fact that you visited websiteA logged, your IP address logged, and a timestamp logged. When you visit websiteB 5 hours later (in a different tab, window, or session) and that site also pings google's server and loads their JS they get all that same information again and Google has successfully tracked you going to both sites. These containers aren't useless, but they aren't preventing Google from tracking your online activity either. Your best bet is to configure Firefox to not allow javascript (at least not by default and not got any domain owned by Google), to block all google domains at your edge, and never log into a google product. At that point, google isn't tracking you and you have no need for the add-on. That assumes that you're on a PC. If you're using an android device you might as well accept that any website you visit will be tracked by google no matter what else you do.
  - zagrebian 4y ago
    > google's server and loads their JS which fingerprints your browser they have your device logged This is a big claim. Do Google’s ad-serving scripts really engage in fingerprinting? If yes, then there should be proof. Is there proof? I don’t think it’s possible for Google to do this covertly using JavaScript, so either Google does this and we have proof, or Google doesn’t do this.
WebbWeaver 4y ago
Yeah and your ISP is going to follow that
deleted 4y ago
[deleted]

zozbot234 4y ago

Chrome's Incognito mode is doing its job here, by making sure that the user is logged out of her Facebook account during that browsing session. What the tracking code does is a different matter altogether, and even Facebook has tried and failed to stop it from sending all sorts of sensitive data, including stuff that might well fall under HIPAA.

js2 4y ago

> That's on Planned Parenthood. Only in part. Ultimately it's the browser that's sharing the data from PP to FB. It's not like PP is making a direct connection from their backend to FB's backend. It's Chrome that's connecting to FB. Apple has demonstrated with Safari that browsers can fight this tracking if they want to. Google has no interest in doing so because their browser doesn't work for the user. It works for the likes of Google, FB, and yes, PP.

judge2020 4y ago
> It's not like PP is making a direct connection from their backend to FB's backend. But it’s possible from the backend: https://developers.facebook.com/docs/marketing-api/app-event-api/ https://developers.facebook.com/docs/marketing-api/app-event...
- js2 4y ago
  Yes, but unlikely what's happening here. I assume incompetence not malice on PP's part. That doesn't excuse this privacy leak. My point is that this isn't all on PP. I consider Google and FB malicious in sharing data in their zeal for dollars. I consider PP incompetent in protecting privacy in its marketing efforts, which yes, also needs dollars, but it's a non-profit and really not in its interests to share this information.
bushbaba 4y ago
Would make for an interesting lawsuit. Should chrome be held liable for violating hipaa.
- thaeli 4y ago
  I don't see how they would be a covered entity.
- tomrod 4y ago
  Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]
ChrisMarshallNY 4y ago
Also, lest we forget, the site designer. Most folks are unaware of the things that can happen, when a Web designer loops in a dependency. The dependencies tend to bring friends. Lots of friends. I'm not sure what the answer is. Many, many folks are incapable of designing sites without the dependencies, and these dependencies often add great value, so "don't do that" isn't really an option. It's easy enough to say "set up a licensing board," but these tend to be a cure, worse than the disease. Incumbents will use them to prevent competition, and governments like to use them as a private piggy bank, like red-light cameras. Paying for the dependencies makes sense (if I make my living on something, it’s only natural that I pay for my tools and raw materials), but the chains can be long, and there can be many parts that simply cannot be paid for, or will get stolen, or corrupted. I think that we need to figure out some way to improve the dependency space, but there's no simple solution. Anyone claiming there is, is trying to sell something that is maybe a bit past its "sell by" date. "There's always an easy solution to every human problem; Neat, plausible and wrong." "The fact that I have no remedy for all the sorrows of the world is no reason for my accepting yours. It simply supports the strong probability that yours is a fake." -H. L. Mencken

indymike 4y ago

> That's on Planned Parenthood. This is really an important point. The owner of a website or app has to comply with regulations, and HIPAA should apply to people seeking medical care, especially those seeking care that is politically or otherwise sensitive. This is literally what HIPAA was trying to prevent: disclosure of medical info to third parties without direct consent of the patient. A click should not be enough to consent. Third party tags have no place in the DOM on these sites.

zagrebian 4y ago

This is exactly what the Google Container add-on for Firefox protects against. It stops Google from tracking you across the web because your Google login does not exist when you visit other websites. It only exists within the container. https://addons.mozilla.org/en-US/firefox/addon/google-container/ https://addons.mozilla.org/en-US/firefox/addon/google-contai... Unfortunately, it does not have Mozilla’s “Recommended” seal of approval. I assume Mozilla cannot do this because Firefox development is funded by Google, so Mozilla has to tolerate Google’s tracking to some degree. I’m still using this add-on because I cannot imagine my web browsing life without it.

autoexec 4y ago
> This is exactly what the Google Container add-on for Firefox protects against. It stops Google from tracking you across the web because your Google login does not exist when you visit other websites. I don't think that it does. I mean, it does help a little, but if you have Firefox with this add-on installed and visit websiteA which pings google's server and loads their JS which fingerprints your browser they have your device logged, the fact that you visited websiteA logged, your IP address logged, and a timestamp logged. When you visit websiteB 5 hours later (in a different tab, window, or session) and that site also pings google's server and loads their JS they get all that same information again and Google has successfully tracked you going to both sites. These containers aren't useless, but they aren't preventing Google from tracking your online activity either. Your best bet is to configure Firefox to not allow javascript (at least not by default and not got any domain owned by Google), to block all google domains at your edge, and never log into a google product. At that point, google isn't tracking you and you have no need for the add-on. That assumes that you're on a PC. If you're using an android device you might as well accept that any website you visit will be tracked by google no matter what else you do.
- zagrebian 4y ago
  > google's server and loads their JS which fingerprints your browser they have your device logged This is a big claim. Do Google’s ad-serving scripts really engage in fingerprinting? If yes, then there should be proof. Is there proof? I don’t think it’s possible for Google to do this covertly using JavaScript, so either Google does this and we have proof, or Google doesn’t do this.

WebbWeaver 4y ago

Yeah and your ISP is going to follow that

deleted 4y ago

[deleted]