Hacker News Reader

Comment by maxk42 | Hacker News Reader

As much as I value privacy and think America needs a new constitutional amendment enshrining it in our rights, this title is clickbait and the entire article is designed to whip you into a panic. Here's the crux:

"Privacy International (PI) investigated more than 100 mental health websites in France, Germany and the UK.

It found many shared user data with third parties, including advertisers and large technology companies."

Yes. Mental health websites use third-party ads just like everyone else. Case closed.

They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies.

This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.

View on HN

> They're not "selling mental-health information" as if they're violating HIPAA or something. They're just ordinary websites with ads and other tracking cookies

> This is more of the silly kind of half-truths that were used to put cookie warnings on nearly every site on the internet. Don't fall for it.

I’d suggest instead that your post is the kind of “silly half-truth” that people shouldn’t fall for.

As the article points out (and which you neglected to mention):

> And in the case of particularly sensitive data, such as health information, this consent must be explicit.

> But the PI investigation found many cookies were installed on people's devices before any consent had been given.

Contrary to your “it’s just an ordinary website, and ordinary websites use cookies, nothing to see here” narrative, these are websites that specialize in giving health advice. The knowledge that a person is seeking advice and tests for indicators re: depression is absolutely sensitive health information (insurance companies and potential employers would happily weaponize that information given half a chance), and the law therefore required explicit consent before using those cookies and forwarding those depression indicator survey answers to third-party marketing data-aggregation affiliates, which these websites did not seek.

This is a clear-cut violation.

Indeed.

I'd also add that:

> half-truths that were used to put cookie warnings on nearly every site on the internet

The half-truth here is that half-truths were used. Cookie warnings are "this site spies on you" warnings (you don't need them if you only use cookies for making the site work), which were introduced as a strong suggestion for the industry to get its act together. It didn't, so now we have GDPR.

> They're just ordinary websites with ads and other tracking cookies.

This is an interesting take. It means that for information to be sold to third parties it must be explicitly negotiated and delivered, through contractual means, as if it were a product sold with invoices emitted.

What actually happens is virtually the same, minus the explicit negotiation and invoice. Information gets sent to third parties, who cross reference browser information and the location from which the info was sent, effectively identifying and tying the user to the mental health related website. That is, in my opinion no different than explicitly selling mental health information to ad companies and should be treated as such.

This is indeed just business as usual on the web, but I'm not sure that should be an acceptable excuse. Clickbait or not, the article isn't wrong to describe in vivid terms how huge companies traffic in very private personal data so that they can more effectively put ads in your face. Given how willing people seem to be to trade their privacy for a few pennies in free services, maybe plain-language articles like this are what we need to communicate the consequences of where that kind of attitude can lead.

How are precise reading logs of websites that help people learn about and treat mental health conditions not "mental-health information"?

"Subject A traveled from a house (maybe not his house, you see, it's de-identified!) went to the library, selected a book on depression and another on cognitive behavorial therapy, read two chapters in the book on depression, made notes about 4 chapters from the CBT book, went back and re-read one chapter from the first book. Subject took quiz from first book which indicated a severity of 22 on the PHQ-9 depression score (it's not PHI because maybe he made up all the answers!) Subject appeared to move slowly with a sad affect through the library and while reading. Subject appeared to be interested in the 2nd chapter of the first book. Subject's other interests include 2000s romantic comedies and RPG video games. Subject's income is approximately 60k/yr and lives in a household with size 1."

If a hospital said “we can’t give you patient data, but we’ll give you your own booth to record faces, names, and let you follow patients around", people would be right to be angry.

What? The data that you've visited a mental health support website plus your IP easily takes you into GDPR sensitive data territory, and the rules around this are super strict: https://gdpr-info.eu/art-9-gdpr/.

You absolutely should not be handing that information about people to random marketing companies without consent, let alone with informing users. In France, Germany & the UK I would expect that this is a clear & major breach of GDPR and who knows what else.

If you read the report, there's also sites where you fill in a quiz about your mental health & depression, and they forward that data to services like qualifio.com ('The leading Interactive Marketing &Data Collection Platform').

That's definitely concerning. There's no way this is reasonable behaviour, and we shouldn't accept it as such.

If it's gathering health information and outputting guidance then they are legally no longer "just an ordinary websites with ads and other tracking cookies". Something like a survey that may offer guidance to, say, a suicide hotline if the survey results point that way crosses a border between passive information dissemination and active health advice. I think it's unlikely US courts would rule that such systematic gathering of health information doesn't make it a "covered entity". But that's just the US. The article focused on the EU, and there the GDPR automatically elevates the level of opt-in permission required.

Reply on news.ycombinator.com