12 ms·
Websites selling abortion pills are sharing sensitive data with Google
- droptablemain 4y agoBreaking story: website uses Google Analytics like 95% of other websites. Why is this even a story?
- ClumsyPilot 4y agobecauae it is then possible to obtain this data and imprison them
- nerdjon 4y agoIt is going to continue to be a story until we take this data collection seriously and actually try to curtail it. We can't just wipe it away with "we already know this is happening" when its wrong in the first place.
- nickthegreek 4y agoIt is a story because some states might be able to sue for information regarding visitors to those sites due to local laws. Its about informing citizens that their private purchases might not be as private as they want.
- raverbashing 4y agoLooks like the GDPR worries about privacy and data sent independent to 3rd parties had some merit
- chopin 4y agoWebsites subject to GDPR use Google Analytics left and right. Even government websites do this. GDPR has good intentions but enforcement is lacking severely.
- robertlagrant 4y agoGDPR isn't intended to stop its use. It's intended to inform users of data sharing and provide them a mechanism to subsequently delete.
- TylerE 4y agoInstead it's just another way to train users to click Yes/Accept without thinking! How could this possibly go wrong?
- mrguyorama 4y agoActually, the longer GDPR has been around, the more I see websites popping up with a comprehensive modal that gives gentle explanations of what each toggle does. Hell, now some websites even default to "non-required" tracking off, and literally do not require you to do anything to limit the data they harvest from you. And I'm pretty sure this is some third party's drop in solution.
- robertlagrant 4y ago> Instead it's just another way to train users to click Yes/Accept without thinking! How could this possibly go wrong? GDPR doesn't specify UX.
- Nextgrid 4y agoIt's intended to ask users for consent before stalking them. But lack of enforcement means that in practice implementations use a non-compliant popup that forces users to accept (and is often technically flawed in that the tracking scripts are loaded regardless of the user's answer).
- ensignavenger 4y agoPresumably the person ordering these drugs is already providing the site with payment information (credit card) and a shipping address... seems like anyone suing for this information would probably start there rather than with google analytics.
- RajT88 4y agoI am not going to visit or look up these sites on my work computer. But if they are headquartered outside the US like many online pharmacies are, likely they are going to just ignore any law enforcement requests for user data. Putting myself in the shoes of an online pharmacy selling abortion meds, I would be crazy to headquarter in the US. I'd be surprised if even a few were US-based.
- yunohn 4y agoQuite a few of the websites from the article claim to be USA based.
- tonywebster 4y agoI think bringing attention to common practices putting people in jeopardy is a good thing, because it’s likely website operators and the general public don’t think about these risks. If data is collected, it can be used by police and prosecutors. Ignoring the problem because everyone knows about analytics does not start necessary conversations. Google has increasingly been a target for law enforcement investigations, and the search warrants Google receives can be as broad as compelling Google to turn over data on the accounts or IP addresses of anyone who Googled someone’s name.[1] [1] https://www.techdirt.com/2017/03/17/judge-grants-search-warrant-demanding-info-everyone-who-searched-certain-persons-name/ https://www.techdirt.com/2017/03/17/judge-grants-search-warr...
- ehhthing 4y agoShouldn't this be a discussion about how law enforcement search powers are getting out of control, then?
- ceejayoz 4y agoLaw enforcement searches aren't the only risk here.
- deleted 4y ago[deleted]
- lostlogin 4y agoThe state controlling reproduction is the alarming bit for me, closely followed by the surveillance creepiness Google enables.
- bee_rider 4y agoThat’s another worthwhile topic, but since the privacy threat model of a companies selling some types of birth control will be unusual for the foreseeable future, it is also worth talking about in isolation.
- bee_rider 4y ago
- j45 4y agoIt is immature journalism. Either the writer or an editor who ultimately decided on the headline.
- paulryanrogers 4y agoBecause it could lead to prosecuting women for exercising reproductive rights?
- lostlogin 4y ago[flagged]
- willcipriano 4y agoIt never was, Roe was a bad ruling.
- bagels 4y agoIt may be a violation of HIPAA for the pharmacies to be doing this.
- b1n 4y agoBecause it IS news to a lot of people. And putting it in context brings home the reality and implications of tracking that many people may not be aware of. If you've ever seen any SaaS websites where they have... - Our Product vs Competitor 1 - Our Product vs Competitor 2 - Our Product vs Competitor 3 - Our Product vs etc... ... then you can see why this is important from an SEO perspective.
- godelski 4y agoJust because something is obvious to you doesn't mean it is to others. You're in a bubble if you think everyone is highly tech literate.
- t433 4y ago[flagged]
- godelski 4y agoEven though I disagree with the parent, HN has strict guidelines about calling people names and I'm actually in favor of these guidelines. We all fall prey to our emotions so please just edit the comment. If HN is overflowing with clowns we have to take extra caution not to become one ourselves and to dissuade them from coming here.
- t433 4y ago[flagged]
- libraryatnight 4y ago[flagged]
- 33955985 4y agoThat you don’t think the possibility of governments prosecuting vulnerable women seeking health care in the US using surveillance capitalist tools is a story says more about you than the article.
- wodenokoto 4y agoIt’s the surprising consequences of this. The privacy implications here are totally different than for a travel blog.
- toss1 4y agoBecause in this instance, the consequence is that this data can now enable a quasi-fascist minority to impose their religious views on others, with consequences of serious jail time for (in other states) innocent and vulnerable women. When will people realize that surveillance capitalism is morally bankrupt (aside from also being a fraud), and that personally identifiable information is toxic waste? This is so far beyond "Don't Be Evil" . . .
- brodouevencode 4y agoBecause it is centered around a highly divisive topic abortion. If it were anything else no one would care, even activities that are not widely legal. For example: Online retailers selling marijuana products send fingerprints to Google Analytics overwhelming majority would not care Brothels selling appointments online send fingerprints to Google Analytics overwhelming majority would not care Online retailers selling firearms send fingerprints to Google Analytics overwhelming majority would not care
- Bud 4y ago[dead]
- dsfyu404ed 4y agoFirearms people get pissed over the tracking. Before it was more broadly legal weed people used to be pissed over that. I presume the kind people who book prostitutes online don't like the data trail either. The reason you're hearing about of this is because HN cares a lot about abortion whereas all those other topics are of much less importance around here.
- tomjen3 4y agoNot breaking news: business has surveilance cameras. Breaking news: the business is a gym, and the area includes the showers.
- jjav 4y ago> Why is this even a story? It's a story because it's a privacy violation and also a HIPAA violation. Very similar to the case where health care providers were using Facebook trackers which was sending PII and PHI (private health info) to Facebook which has triggered multiple lawsuits. https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-rece... It's great that some light is being shined on these violations. You can't just put spyware tracking on sensitive websites.
- nerdjon 4y ago[flagged]
- andrei_says_ 4y ago[flagged]
- nerdjon 4y agoI guess that is true, it just makes it really hard to be hopeful that things are not going downhill in multiple ways due to exactly what you said happening. My point more is here, given what happened I am not convinced that this is enough to put up enough controversy to make the government take the necessary action.
- colechristensen 4y ago>The country cares, but a few ultra determined parties care more. The sooner people realize that the "ultra determined" don't actually care about the issue, the better. They care about acquiring power. Pushing on abortion was a good way to get people riled up to vote for them. The people doing the pushing were using it as a tool to manipulate voters, they do not actually care. A lot of people have been made to care, of course, but the people pulling the strings do not. Any issue that can get people passionate will be used this way.
- snikeris 4y agoSee also: https://en.wikipedia.org/wiki/Wedge_issue https://en.wikipedia.org/wiki/Wedge_issue
- dsfyu404ed 4y ago> Pushing on abortion was a good way to get people riled up to vote for them But why? Why did they have an audience? Why did peddling abortion restrictions cause people to vote for them? I'll tell you why. Because we intentionally gave them an citizenry equipped with the kinds of beliefs and moral compasses with which those sorts of arguments resonate. We spent decades raising people to think that human life is infinity valuable and that even the risk of harm is tantamount to blood in the streets. We have been raising people to err on the side of restricting people's freedom in order to prevent harm, both real harm and the statistical hypothetical small harm. We have done this on purpose so that people become outraged when they hear that some employer's machinery does not conform to the latest safety standards. We have done this so that people shun people who engage in slightly dangerous behavior. Of course, everything has tradeoffs and as a side effect of this we have created a society of people who are happy to err on the side of the fetus to the detriment of the mother's bodily autonomy and vote accordingly. In short, we are reaping exactly what we sowed.
- xbar 4y agoOk google.
- themanmaran 4y agoThe HN title is incorrect. The original article has no mention of "fingerprints". The title in the article is more accurate: "...Are Sharing Sensitive Data With Google". Perhaps it was updated later. Or there was some misuse of the word "fingerprint" (i.e. browser/device fingerprint, opposed an actual scan of your finger).
- codazoda 4y agoI think the title is probably sensationalized and should be edited to match the page per the typical rules. I suspect good intent here though where this probably means "fingerprints" in the technical sense and the article does talk about that.
- mikedelago 4y agoI agree. "fingerprints" should be changed to "digital fingerprints" to make it clear that literal, actual fingerprints are not going to google.
- factsarelolz 4y agoSo which is easier? Law Enforcement going after Google for the data or LE going after the site itself for the data on customers? Seems like it would be easier for LE to threaten a small pharmacy versus a big corp like google.
- snapcaster 4y agoI disagree with your framing. It costs resources to target specific companies even small ones. Google has ALL the data on ALL the pharmacies. You get it from them and just not bother with each individual company
- jrochkind1 4y agoIt's worth thinking about, but it's hard to say. Perhaps Google would voluntarily turn over the info without a search warrant, and/or would do it quietly without telling the customer even if not required by law to keep it quiet -- but the small pharmacy with the relationship with its customers would not. Perhaps law enforcement already has a relationship with google and established channels for accessing this info, whether with or without a court order.
- Nextgrid 4y agoGoogle's stalking can also deanonymize a user even if they used fake details and an anonymous payment method on the website.
- shadowgovt 4y ago> Perhaps Google would voluntarily turn over the info without a search warrant Not in general in this scenario. Google has made exceptions in the past (generally around an emergency with threat to life involved), but they're reluctant to make such exceptions for even federal LEO. State-level LEO, which is who would be making these requests, has far less leverage over Google; they could make it harder for Google to do business in their state, but (a) the states we're talking about are doing that already, so Google cares less about a lever that's already being pulled and (b) the states don't have higher authority to appeal to (what are they gonna do, try to make a Supreme Court case out of noncompliance with... A warrantless data request?).
- theartfuldodger 4y ago[flagged]
- theartfuldodger 4y ago[flagged]
- h2odragon 4y agopresumably they send this information on all their customers no matter what they're buying (or more likely even just browsing), right?
- godelski 4y agoI'm AMAZED at the comments here. I see two common ones: 1) this is news? and 2) no experts used. Both are just insane. For 1) not everyone is tech literate. You're telling me that everyone you know also knows that companies like Google, Apple, Amazon, Netflix, etc are capturing your data across the web? That they can (almost) uniquely identify you? You've probably been living in SV your entire life and never traveled around the bay -- or further -- if that is an honest statement. This statement comes off as self serving, saying that _you_ know better. Maybe the article isn't for you, and that's okay. You don't have to comment. The comment section may not be for you either. Post if you can _contribute_ to the discussion, otherwise don't. For 2) I understand the concern, but ProPublica has long worked with topics like these and legal issues. I guarantee you that their staff has enough expertise to understand what browser fingerprints are. That's really not a high bar so your screams for experts are falling short. They list the tool they used and the websites in question. Your calls for expertise will raise if you give reason to them by pointing out how a tool might be flawed and/or that websites are actually capturing fingerprints like the article claims (but that can change after the article's release). So if you want to disprove the article disprove it instead of making a call to authority. Otherwise you're just noise. Ironically these two types of posts are in direct contradiction to one another. But can we please stop and actually discuss the article instead of you? This is a stupid flame war and most of us just want to discuss the actual contents of the article. Please don't even respond to this, just participate in the conversation to the actual contents of the article.
- Teever 4y agoYou don't have to be tech literate to know that the man spies on you. Hell you don't even need to be literate. I worked in construction about a decade ago when the Snowden thing was big and I asked a construction worker with a grade 10 education from a rural part of Canada what he thought of it and he chortled before saying 'of course they're spying on us. They've always been spying on us.' Meanwhile I have a friend who is a lawyer for the federal govt and this guy just can't seem to grasp anything regarding privacy law and why people care about itm. Meanwhile he's flabbergasted that Madison Square Gardens has the technical means and gall to kick out any lawyers tenuously related to legal action against them. At some point people are responsible for their level of ignorance. I dont know where that point is but I'm sure that it exists.
- jrochkind1 4y agoOh BROWSER fingerprints. I thought the headline meant actual fingerprints from your hand. The "fingerprints" word is not in the current headline on propublica.org...
- daniel-cussen 4y ago[dead]
- olliej 4y agoI understand the specific relevance of abortion pills given the taliban nature of some US states, but this is a general issue: healthcare companies have no business embedding 3rd party content on any of their sites, unless those are - maybe - HIPPA compliant authentication services (again maybe)
- shadowgovt 4y agoThis probably doesn't violate HIPAA. HIPAA doesn't prevent law enforcement from acquiring data in the interests of a criminal prosecution. Meanwhile, the data as currently silo'd is not sufficient to figure out who somebody is (ad companies are real keen on that, because they don't want the sites they serve to harvest ad data on their users and side-step the ad services; as a result, the fingerprints are usually double-blinded in a way such that only the user's browser can aggregate enough data to "know" who the user is).
- danuker 4y agoChances are, when you order something online, you have some Big Tech e-mail account that is not end-to-end-encrypted (because e-mail very rarely is). So, your bill from buying medical devices or drugs will be available as plaintext to Big Tech even if you block analytics third-parties.