Woman Got Cremation Ads in the Mail After Getting Chemotherapy
404media.co
404media.co
As to how they mailed it to her and got her home address, a data broker who has location data can fairly easily determine a user's home address from that data. Many brokers and networks may also already have an association between a "pseudo-anonymous advertising ID" and real user with name and address. Not saying that location-based retargeting happened this time as the article doesn't give us enough to go off of and other types of retargeting are another possibility.
Overall, I think it's unlikely that the provider or insurer shared her data and other alternatives are more likely.
Disclosure: I work in the ads industry but on contextual targeting only. Some location-based retargeting is terrifying and will probably eventually be criminal. It's a bit of the wild west right now.
(Edit to add a meta note: Apparently this has to be said on Hacker News because people can't distinguish between someone presenting facts and someone making a defense, but I'm not defending the practice. I think it's abhorrent. But if we can't dispassionately analyze reality to try and understand the motivations, then we've really abandoned reason and lost our way).
Edit: I don't want to sound like I'm blaming the victim here. That's not my intent. I just don't think blaming the insurer or provider is fair either. I dump the blame on the data broker/ad network and to a far lesser extent the advertiser.
Yep, I used to get ads like that all the time during my cab driving days.
I would often ponder on how they made any inferences out of my location data because I went to so many different places. There were definitely patterns, hauling around the same people once you learn their schedule is a big part of the job, but using it to sell me stuff is worthless.
Now that the youtubes have taken up the adblocker fight I still get all sorts of ads for medical stuff that has no direct relation to me. I do try to keep up on all the complicated "don't track me, you fucking stalkers" clicky buttons they like to add so perhaps I just fall into age group where their ad dollars shine, dunno?
I have my own story about advertisers inferring personal. Relationship status isn't protected, but the last time I went through a breakup, I was suddenly inundated with dating site ads. I don't feel like my shopping or web browsing habits changed, but they must have to figure it out.
That would be helpful. Also, HIPAA itself isn't exactly a panacea and is full of loopholes. Having effective medical privacy laws would be even better.
We had just visited the Sloan museum in Flint, MI which has an extensive Buick display so an ad for a Buick would not have been unexpected.
Coincidences like this have happened too many times to be coincidental.
The classic example is Target predicting your pregnancy based on specific purchase behaviors. All they have to know is a consistent identifier and your purchase history and they can predict whether you’re pregnant. There’s no need to listen in on conversations or obtain other more detailed user data.
Also, a lot of “private” services and apps really don’t promise jack shit in their privacy policy. They are probably all gathering and selling the data nearly in real time. Their privacy policies are often far more broad, vague, and permissive than their PR will tell you.
You’re with your wife, your devices are often on the same networks, so it’s likely that advertisers know you know each other when you browse. Despite what your wife says, you really don’t know if she interacted with a Pacifica ad or piece of sponsored content. Even if she didn’t search for a Pacifica, it doesn’t have to be specifically something related to minivans, because that information that you are potentially more interested in minivans can come from other metadata.
TikTok manages to figure out your perception of a particular video based on how your fingers are moving on the screen, how long you’re spending on a video, what’s happening when you’re lingering or swiping, etc. You never really have to tell TikTok directly what things you like.
The game of 20 questions works from a similar concept. You can start knowing absolutely zero and ask a very small amount of binary questions to find the specific item the person has on their mind, only metadata.
https://www.businessinsider.com/cox-active-listening-claims-...
> We know what you're thinking. Is this even legal? The short answer is: yes. It is legal for phones and devices to listen to you. When a new app download or update prompts consumers with a multi-page terms of use agreement somewhere in the fine print, Active Listening is often included.
This means you have to give permissions and ignore the orange dot on your screen for this technology to work.
And, you know, at some point consent is consent. It’s a giant dialog box that explains everything. Some people might even want an app that records their activity and gives them compensation for doing so (e.g., Microsoft/Bing Rewards). Who am I to tell that person they don’t want that?
I'm on Fi, she's on Verizon. But I don't doubt that data miners know we're together due to consistent proximity. Neither she nor I did any Pacifica related searches.
99.9% of people who have a healthcare provider at a minimum use their website - communicate with doctor, prescriptions, etc.
All these websites use adtech stuff, and the apps are even worse.
look, don't take my word for it, just look at kaiser permanente's website:
It references google.com directly.
(also try www.dmv.ca.gov, same thing, same cookies)
I had my landlord's property manager sign me up for a identity theft protection service without my permission.
Equifax sells any info about me it can get.
Google has a full profile for my public ip it seems and will fill in suggestions across multiple youtube sessions where one is logged in and the other isn't, on separate machines.
Is this really all technology has to offer? For every new break through, we have 100s of rent seeking middlemen exposing every aspect of our lives.
I had hoped that rising interest rates and a tighter consumer market would change that dynamic somewhat but unfortunately for now it seems to be an incredibly well entrenched status quo that doesn't appear to have a clear path away from
https://en.wikipedia.org/wiki/Driver%27s_Privacy_Protection_...
One example: https://egov.maryland.gov/mva/
we found three trackers on the Planned Parenthood site which is kind of shocking in this age where private citizens could sue you in some states over healthcare decisions.
https://www.forhers.com/sexual-health
https://www.forhers.com/birth-control
Planned Parenthood also offers birth control ordering through the mail. adrr says no tracking/retargeting, so could be a coincidence.
1. Searching for things around chemotherapy, cancer, and death on some site
2. Having an app on your phone that tracks your location and sells it. Many apps do this. It's not too difficult to reverse engineer where people went and who they are with the various datasets that can be bought.
3. Data brokers getting access to medical information. Too many companies play fast and loose with their data. It would not be a surprise.
We leak data everywhere. Companies are often poor at following regulations. There are too few regulations in most of US around data about us.
And it was all useless marketing because we'd already done all this when the diagnosis first came through, so it just kept reminding us of what was likely going to happen. I kept getting them for a year after the cremation.
Sometimes its better not knowing why you received that type of marketing.
Also, every time I contact my dealer for just about anything, I get a survey in the mail. I’ve tried everything I could think of to stop them but nothing has worked so far. The last one I gave a very low score on about half the questions and a week later I got a call from somebody at the dealership. When I explained it was because I’m trying to get the surveys to stop he said he would contact somebody in the regional Subaru office to see if there was anything they could do but he didn’t sound hopeful.
Much more likely is that she has been Googling keywords about chemo, and those websites she clicked on sold her data to a data broker.
Advertising is a blight on society.
Along the way, you end up thinking nothing of corrupting the medium your ads support.
It's a blight all the way down.
I for one enjoy personalized ads
Lol, most sane HackerNews commenter
What I think is abhorrent is that the rest of us are being forced into that system as well.
Given the primary purpose of GDPR banners is asking permission for tracking so you can advertise to me, which I've already made abundantly clear I do not want, no, I don't prefer GDPR banners. Just don't track me, and you won't have to do this nonsense.
GDPR banners are a symptom of the blight you're supporting. Don't blame it on us.
Same as with sex: consent matters.
To be abundandtly clear: I do not consent to view ads. You cannot consent for me, and it is pretty fucked up that you think you can.
Not only is this not consent, even when people explicitly tell advertisers that they do not consent, such as by sending a "do not track" header or using an adblocker, advertisers are specifically violating their explicit non-consent. You really have no moral ground to stand on here--this is literally someone saying "no" and you trying to shove your garbage in front of them anyway. Shame on you for defending this behavior.
If you want me to view ads as a condition of you serving up content, don't serve up content until I view the ad. There are plenty of sites that do this and I have no problem with that.
As such, it's also good to condemn everybody who helps them in their endeavors.
Advertising may ever only be related to the surrounding content. It's the (traditional) TV model. Saturday morning cartoons shows you cereal commercials.
For the web this would translate to seeing funeral ads if you're on a website for cancer. But if this follows you later, then we should simply get the death penalty involved for the company that follows you.
From a simple sense, all AI and logic created to track people goes away - ad companies need to simply focus on determining the BEST ads to display on the web pages the ad is pinned to.
Also, do you think Saturday morning cartoons should somehow relate to breakfast cereals? The reason that there haven't been Saturday morning cartoons in a couple of decades is because of a law saying the opposite.
If you want to display gravestone advertisements during saturday morning cartoons, you are free to do so. I'm just referring to the concept of trying to do well in your advertising efforts on that part, as LONG as it is done so without knowing who is witnessing this ad.
Yes re-reading my post doesn't state this, I just thought that would be obvious given the story we're discussing.
Make the spying illegal, not the advertising that relies on it. Then there is zero first amendment issue.
I would argue that corporations do not have rights, except inasmuch as the people within the corporation have rights. Rights are for people, and corporations are not people. So, there's no conflict with the first amendment here.
Yes, I'm aware of corporate personhood in the U.S.--I'm saying that the Supreme Court was wrong when they interpreted the constitution that way.
To flesh this idea out a bit: if a person decides to say of their own accord "people who eat Cheetos are cool", that's protected speech. However, if you're acting on behalf of the Cheetos corporation to say "people who eat Cheetos are cool", i.e. you are paid by the Cheetos corporation to say it, that's you acting on behalf of that corporation and the corporation can be punished. Note what I said here: the corporation can be punished, not the person: this sidesteps a lot of ambiguous situations where a person's right to free speech might be violated.
> Then, after you decide that somehow commerce overrules the first amendment in this situation, you are stuck with the job of setting up a government process that will judge, with legal force, whether an advertisement is sufficiently related to the surrounding content. This institution will have to grapple with, among many questions, "Is an ad for replacing your gutters ever related to its surrounding content?" or "What does it mean for an advertisement to be related to a work of fiction?"
This sort of handwringing amounts to a complaint that a Hacker News poster didn't post a fully-detailed piece of legislation. Okay, some details haven't been explained, but it isn't reasonable to expect that a user on an internet forum would draft a complete piece of legislation. These details aren't insurmountable or even difficult to iron out through normal legislative processes, and even when (not if) this is done imperfectly, it would likely be a massive improvement over the current free-for-all.
The reason rights apply to corporations is that rights apply to people in aggregate, as well as individually and there is no way to deny rights to the group without denying rights to the individuals within that group (also because treating corporations as legal entities makes things like suing them as entities possible. Otherwise one would have to file individual lawsuits with individual people for any claim.)
If rights only applied to individuals, then it would be trivial to suppress any political or cultural expression by making any collective gathering or expression illegal. There is no reason to consider corporations a special case in this regard.
In that statement, yes, but there's a ton of nuance to how that's applied.
> The reason rights apply to corporations is that rights apply to people in aggregate,
True, but corporate personhood captures the aggregate rights of people in a corporation only slightly more effectively than the 3/8 compromise captured the rights of slaves. If you're going to claim that the rights of a corporation are based in the rights of the people in that corporation, then you'd expect that the people in the corporation get to wield those aggregate rights equally, because they all have equal rights. But the reality is that a handful of people within a corporation get to wield those aggregated rights: executives and board members are literally taking the rights of their workers and wielding them in ways that often don't benefit the workers. That's not aggregated rights, that's an injustice.
> there is no way to deny rights to the group without denying rights to the individuals within that group
This is a pretty blanket statement. There are certainly some cases where a right cannot be denied to a group without denying rights to the individuals within a group. But it is abundantly clear that making it illegal for a corporation to pay for advertising, while allowing individuals to pay for speech or say things, is a restriction of the corporation's rights and not the individual's.
Again, you're free to say anything you like about products, that's your right. But a corporation has no right to pay people to say anything about their product.
> If rights only applied to individuals, then it would be trivial to suppress any political or cultural expression by making any collective gathering or expression illegal.
We've got a separate right to assemble which I believe in, so no, you're making a straw man argument on my behalf here.
And "collective expression" needs more explanation. Certainly, advertising does not represent the views of every individual in the corporation that advertises, so the idea that this is a "collective expression" is absurd. If anything, it's forcing speech on peons who had very little choice in what was said--if we're claiming their aggregate rights are being represented here, then the decision makers in what is said are violating their rights by not giving them input on what is said.
Put another way: it is well-established that forcing someone to say something is a clear violation of their right to free speech. So if the free speech rights of a corporation are the aggregate of the rights of the individuals, then there has to be unanimity within the corporation on what is said in order to not force that speech on the individuals in the corporation who might object to what is said.
> There is no reason to consider corporations a special case in this regard.
The central case is perfectly fine for my point: there is no group in existence which is capable of exercising my right to free speech. Even groups where I get to vote, so they theoretically represent me, do an extremely poor job of saying what I want said.
For example, corporations do not have a right to post accurate information about their products on their own website, because as I said, corporations don't have rights. However, a law against corporations posting accurate information about their products on their own website would be obviously counterproductive.
It makes sense for them to spend $200 to acquire each new customer. You could send out around 300 bulk letters for $200. So it makes sense to cast a wide net including mailing people who just made their first purchase at a pet store. Obviously some of those people only bought a $4 gold fish and will laugh at the pet insurance quote.
Private jet pricing? Maid services? Live-in nannies?
Woman sorting mail: "Oh, an ad for cremation! This one's for you." (handing it to husband)
I am at the hospital right now.
Please continue telling standup jokes until I cease from existing.
Now I only need about five minutes of material that good.
1. the woman in question is old,
2. the data broker has a list of all old people
3. the data broker sold that list of old people to a cremation firm
4. the cremation firm sent out mailers
5. the chemotherapy was a coincidence.
I get emails to an old, legacy email address of mine. I haven't actively used it in like 15 years, and when I did use it, it was on gaming forums because remember the days where you didn't give your real contact details to every random person with a site on the internet?
Anyway, this email has ended up in various people search databases for me which has then resulted in the likes of AWS recruiters, Druid salespeople, etc. emailing me on this address.
I can see the path how this came to be:
Gravatar Leak tied this email to newer email addresses I actually use -> various data brokers, probably buying off each other -> people search websites -> Amazon recruiting, Druid sales, etc.
And now data from an illegal data breach has laundered its way into companies that consider themselves very serious about being law-abiding using that data.
Unfortunately, the closer you get to the source, the less upstanding and more transient these companies are. The people search websites are kind of sketchy at times, the data brokers they buy from are more so, etc. So trying to get legal actions against the data brokers is kind of pointless, it feels.
And this has real world effects. Recently a company which I was in the hiring process for decided midway to switch to emailing this legacy email address. Not any of the ones listed publicly with my real identity, not the one on linked where they claimed to have contacted me from, not the one we'd been conversing over for months, but one they'd plucked out of whatever people search DB they were using. Luckily I was aware of recruiters less-than-ideal handling of contact details, so I knew to check the ancient inbox when they went weirdly quiet in a way that was odd for that phase of the process.
I think the only way to stop this is for there to be financial penalties on the end users of the ill-gotten data. When the druid salesperson emails me on the address obtained from the Gravatar data breach, there should be a fine for misuse of data, no matter how many layers of intermediaries there are between the Gravatar hackers and Imply Data, Inc. and the same story for when Amazon's recruiter does it. It's clear that anything less will not dissuade companies from the dissolution of responsibility for using ill-gotten data.