> This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.
I’d suggest instead that your post is the kind of “silly half-truth” that people shouldn’t fall for.
As the article points out (and which you neglected to mention):
> And in the case of particularly sensitive data, such as health information, this consent must be explicit.
> But the PI investigation found many cookies were installed on people's devices before any consent had been given.
Contrary to your “it’s just an ordinary website, and ordinary websites use cookies, nothing to see here” narrative, these are websites that specialize in giving health advice. The knowledge that a person is seeking advice and tests for indicators re: depression is absolutely sensitive health information (insurance companies and potential employers would happily weaponize that information given half a chance), and the law therefore required explicit consent before using those cookies and forwarding those depression indicator survey answers to third-party marketing data-aggregation affiliates, which these websites did not seek.
This is a clear-cut violation.
I'd also add that:
> half-truths that were used to put cookie warnings on nearly every site on the internet
The half-truth here is that half-truths were used. Cookie warnings are "this site spies on you" warnings (you don't need them if you only use cookies for making the site work), which were introduced as a strong suggestion for the industry to get its act together. It didn't, so now we have GDPR.
This is an interesting take. It means that for information to be sold to third parties it must be explicitly negotiated and delivered, through contractual means, as if it were a product sold with invoices emitted.
What actually happens is virtually the same, minus the explicit negotiation and invoice. Information gets sent to third parties, who cross reference browser information and the location from which the info was sent, effectively identifying and tying the user to the mental health related website. That is, in my opinion no different than explicitly selling mental health information to ad companies and should be treated as such.
"Subject A traveled from a house (maybe not his house, you see, it's de-identified!) went to the library, selected a book on depression and another on cognitive behavorial therapy, read two chapters in the book on depression, made notes about 4 chapters from the CBT book, went back and re-read one chapter from the first book. Subject took quiz from first book which indicated a severity of 22 on the PHQ-9 depression score (it's not PHI because maybe he made up all the answers!) Subject appeared to move slowly with a sad affect through the library and while reading. Subject appeared to be interested in the 2nd chapter of the first book. Subject's other interests include 2000s romantic comedies and RPG video games. Subject's income is approximately 60k/yr and lives in a household with size 1."
You absolutely should not be handing that information about people to random marketing companies without consent, let alone with informing users. In France, Germany & the UK I would expect that this is a clear & major breach of GDPR and who knows what else.
If you read the report, there's also sites where you fill in a quiz about your mental health & depression, and they forward that data to services like qualifio.com ('The leading Interactive Marketing &Data Collection Platform').
That's definitely concerning. There's no way this is reasonable behaviour, and we shouldn't accept it as such.
Simple example: Californians can't get pre-filled tax forms because the program to provide that service was lobbied against by tax firms. There are tons of example of oil and gas lobbies against environmental concerns, food/beverage lobbies against public health, the list goes on.
In the USA, large companies will get their way most of the time at the expense of the public. Every once in a while, the government realizes an issue and puts in some regulations. Rinse and repeat.
Do you have information on this? From what I heard California cancelled it after implementing because there was not sufficient use. I think its less lobbying and more that people sticking with what they are familiar with... Turbo Tax or an accountant.
Most articles pointing out the lobbying issues are somewhat biased, so I'm struggling to find something objective enough I want to share. It was no secret at the time though, so a little Googling will probably surface some resources to look at.
"Privacy International (PI) investigated more than 100 mental health websites in France, Germany and the UK.
It found many shared user data with third parties, including advertisers and large technology companies."
Yes. Mental health websites use third-party ads just like everyone else. Case closed.
They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies.
This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.