If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.
Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.
Seemed like a major HIPAA violation to me.
Maybe not, but GDPR sure is.
How you're using it, it sounds like Bob or Charlie in your mind is a person. I might be wrong in interpreting it that way. If so could you give another example where Bob and Charlie are companies and the information of Alice is part of a transaction.
>If Alice tells her coworker Bob that she had diabetes, it's not a HIPAA violation for Bob to tell Charlie.
I was responding to the parent comment's claim that it's not a HIPAA violation but rather a GDPR violation.
You have to take some personal responsibility, though. If they saw your Youtube recommendations or your Spotify playlist, they'd probably make inferences as well. That porn link in your history you forgot to clear? Be aware of who's watching and browse anonymously if you're concerned.
Easy to prove, store a log of all your network traffic, and record all the audio you speak, then when you see a match, go back, find the proof, become world famous
"What if we capture the flashes and steal the password?"
Well, if you're positioned to capture the flashes, you're definitely positioned to just watch me type it in...
I assume most users would not. But they would be ok with their bank balance being shown if they specifically opened their bank website.
It's not hard to imagine a person's career being affected by something like that.
They're not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them.
That's the point -- we should have that choice. And the default should be "no".
Ideally you would have site-specific or content-specific ads normally and personalized ads if you created an account and chose to opt-in.