Health advertising on Facebook: Privacy and policy considerations

Abstract

In this study, we analyzed health-advertising tactics of digital medicine companies (n = 5) to evaluate varying types of cross-site-tracking middleware (n = 32) used to extract health information from users. More specifically, we examine how browsing data can be exchanged between digital medicine companies and Facebook for advertising and lead generation and advertising purposes. Our analysis focused on companies offering services to patient advocates in the cancer community who frequently engage on social media. We co-produced this study with public cancer advocates leading or participating in breast cancer groups on Facebook. Following our analysis, we raise policy questions about what constitutes a health privacy breach based on existing federal laws such as the Health Breach Notification Rule and The HIPAA Privacy Rule. We discuss how these common marketing practices enable surveillance and targeting of medical ads to vulnerable patient populations without consent.

Keywords: dark patterns; digital medicine; health privacy; privacy.

Figure 1

Process for enabling data to pass between digital medicine companies and Facebook

Figure 2

Color’s representation to users on coronavirus 2019 (COVID-19) testing

Figure 3

Summary of third-party trackers by company

Figure 4

Cross-site trackers for Color Genomics

Figure 5

How Leadfeeder’s service reidentifies patients

Figure 6

Sprinklr and Nanigans Unified-CXM, used by Color Genomics

Figure 7

Example of cross-site tracking from Invitae

Figure 8

Example messaging to patients from Health Union

Figure 9

Health Union: Contact Walt Disney Company to opt out of the sale of personal information