Mental health websites are sharing user data with advertisers, including the results of tests for depression.

This means that individuals seeking information or help for mental health conditions can be targeted with adverts while they may be vulnerable.

Researchers, from Privacy International based in London, looked at 136 of the most popular websites in the UK, France and Germany that provide resources and information about mental health conditions.

The researchers found that 76% of the websites contained third party marketing trackers. These collect information about a user and can track them as they browse other sites.

This can be combined into a detailed profile.

Many of the pages had trackers from Google, Facebook and Amazon and shared information with data brokers – firms that aggregate information and sell individual profiles to other organisations – and advertising companies.

Commentators state that it is currently (almost) impossible to seek information and help about depression without advertisers knowing.

Knowing who is depressed and when allows advertisers to target people when they are at their most vulnerable.

Advertisers target users based on their personal data, such as their IP address and location, and the site they visit. Some sites also have real-time bidding, where information, including a page’s content and URL, is used to instantaneously show a relevant ad on the page.

Several websites with questionnaires about depression stored users’ answers and shared them with third parties.

When the researchers first analysed the UK’s National Health Service (NHS) website in September 2019, they found that a mood self-assessment quiz shared individual answers, test scores and the test URL with Adobe for analysis purposes. However, the NHS website has since updated its privacy policy so users now need to manually opt in to be tracked.

The researchers also found that doctissimo.fr, one of France’s most popular health websites, sent unique user identifiers and answers to a data collection firm. They basically send all of an individuals answers to the test to a third party that is named nowhere on their website, and nowhere in their privacy policy. A perfect example of abusing someone’s confidence.”

Under the European Union’s General Data Protection Regulation (GDPR), websites and apps are required to obtain consent before tracking users.

Data relating to physical or mental health is considered a “special category” and can only be processed with explicit consent or for relevant other reasons.

Reference

Lu, D. (2019) Mental Health Sites Share User Data with Ad Firms. New Scientist. 07 December 2019, pp.9.