Health Advertising on Facebook: Privacy & Policy Considerations

TL;DR

This paper investigates how digital medicine companies share health data with Facebook for advertising, revealing privacy risks, policy gaps, and potential violations affecting vulnerable patient groups.

Contribution

It provides an analysis of health data sharing practices between digital medicine companies and Facebook, highlighting privacy concerns and policy implications.

Findings

Digital medicine companies exchange health data with Facebook for advertising.

Inconsistent privacy practices and dark patterns may lead to unauthorized data collection.

Marketing practices enable surveillance of vulnerable patient populations.

Abstract

In this study we analyzed content and marketing tactics of digital medicine companies to evaluate various types of cross site tracking middleware used to extract health information from users without permission. More specifically we examine how browsing data can be exchanged between digital medicine companies and Facebook for advertising and lead generation purposes. The analysis was focused on a small ecosystem of companies offering services to patients within the cancer community that frequently engage on social media. Some companies in our content analysis may fit the legal definition of a personal health record vendor covered by the Federal Trade Commission, others are HIPAA covered entities. The findings of our analysis raise policy questions about what constitutes a breach under the Federal trade Commission's Health Breach Notification Rule. Several examples demonstrate serious problems with inconsistent privacy practices and reveal how digital medicine dark patterns may elicit unauthorized data from patients and companies serving ads. Further we discuss how these common marketing practices enable surveillance and targeting of medical ads to vulnerable patient populations, which may not be apparent to the companies targeting ads.