Vulnerable people are inadvertently sharing data about their mental health with advertisers, data brokers and large tech companies, according to an analysis of ‘depression tests’ and other popular mental health sites.
Privacy International analyzed 136 popular mental health web pages in France, Germany and the UK, using the open-source tool webxray.
Depression-related web pages also used a large number of third-party tracking cookies, which were placed before users were able to confirm or deny consent.
“This raises serious questions about compliance with EU data protection,” the researchers point out.
In the case of the French website doctissimo.fr, for instance, the depression test page contacted 48 third parties as soon as it was opened. On average, mental health web pages placed 44.49 cookies in France, 7.82 in Germany and 12.24 in the UK.
Meanwhile, a number of depression test websites store user’s answers to the test – and share them with third parties in the URL. Two websites, PasseportSanté and depression.org.nz, stored test results as variables in the URL, and shared them with all third parties.
Analyzing three sites in detail, the team found that
netdoktor.de, passeportsante.net and doctissimo.fr use programmatic advertising with Real-Time Bidding (RTB) – currently being scrutinized by regulators in the EU.
The data being shared, they say,typically includes information about the device used, or where a user is located. In the case of some depression test websites, this also included granular information about the exact web page people visited, and thus what health conditions they were concerned about.
“When data brokers, advertisers and online tracking companies collect data about our mental health without our knowledge or consent, this is highly intrusive,” the researchers say.
“Information that reveals when exactly someone is feeling low or anxious – especially if combined with other data about their interests and habits – can be misused to target people when they are at their most vulnerable.”