Mental health websites share unsolicited user data

European mental health websites often share personal data of users with advertisers, technology companies and third parties without permission. This is what the organisation Privacy International says in the report ‘Your mental health for sale’. Three quarters of the sites would use tracking cookies without asking permission.

European mental health websites often share personal data of users with advertisers, technology companies and third parties without permission. This suggests the organization Privacy International after comparing 136 popular websites on mental health related to depression. Three quarters share unsolicited data.

To understand how mental health data is currently protected, Privacy International analysed 136 popular mental health web pages related to depression in France, Germany and the UK. A small subset of online depression tests has also been selected for further analysis.

Possible violation of privacy regulations

Privacy International found out that user data on these websites was often shared with third parties, such as advertisers and technology companies such as Google. Because there is no transparency or honesty about the fact that, or how, this data is sold, the websites would violate the European privacy rules in force since May 2018. The research concerns, among other things, the cookies on the websites.

From the 75 percent of web pages we’ve analyzed that include marketing trackers (some of which are part of RTB), to depression tests that share your answers with third parties, our report shows that many mental health websites don’t take their users’ privacy as seriously as they should. Some websites treat their users’ personal data as a product, but do not comply with their obligations under European data protection and privacy legislation.

Discouraging findings

Privacy International considers the findings to be discouraging. They give rise to serious concerns about the way in which these websites deal with people’s data. What happens when you visit a website related to mental health? Information that reveals when exactly someone feels low or anxious – especially when combined with other data about their interests and habits – can be misused to target people when they are most vulnerable’.

On average, a French health site had 44 cookies, compared to 12 in the UK and 7 in Germany. Of the sites, 85 percent to 92 percent had a Google tracker on board. Facebook trackers also appear to be popular on mental health sites: 49 percent of French websites had one, with a similar percentage in the UK and 23% in Germany. These cookies allow companies such as Google, Facebook and Amazon to send targeted advertisements to users.

Situation dutch websites no different

In May 2019, the Dutch Consumers’ Association (Nederlandse Consumentenbond) published similar results in a survey of websites available in the Netherlands with information on sensitive topics within the categories of religion, youth, medicine and sexual orientation, such as websites of institutions in the mental health sector.

Researchers from the ‘Consumentenbond’ searched online in March and April for topics within the above categories. By means of queries about depression, addiction, sexual orientation and cancer, among other things, they ended up on 106 websites. 48 percent of these sites placed one or more advertising cookies when they visited them immediately, i.e. without the visitor’s permission. In almost all cases, these were Google cookies.

In recent years, the Consumers’ Association has frequently published critical reports on medical websites. The websites often place cookies from advertising networks without permission, as a result of which they receive very personal information about the visitors.