{"id":1449,"date":"2023-06-30T12:18:20","date_gmt":"2023-06-30T12:18:20","guid":{"rendered":"https:\/\/healthynewsusa.com\/?p=1449"},"modified":"2023-06-30T12:18:25","modified_gmt":"2023-06-30T12:18:25","slug":"need-to-get-plan-b-or-an-hiv-test-online-facebook-may-know-about-it","status":"publish","type":"post","link":"https:\/\/healthynewsusa.com\/?p=1449","title":{"rendered":"Need to Get Plan B or an HIV Test Online? Facebook May Know About It"},"content":{"rendered":"
\n\tDarius Tahir and Simon Fondrie-Teitler, The Markup<\/span><\/p>\n

Looking for an at-home HIV test on CVS\u2019 website is not as private an experience as one might think. An investigation by The Markup and KFF Health News found trackers on CVS.com telling some of the biggest social media and advertising platforms the products customers viewed.<\/p>\n

And CVS is not the only pharmacy sharing this kind of sensitive data.<\/p>\n

We found trackers collecting browsing- and purchase-related data on websites of 12 of the U.S.\u2019 biggest drugstores, including grocery store chains with pharmacies, and sharing the sensitive information with companies like Meta (formerly Facebook); Google, through its advertising and analytics products; and Microsoft, through its search engine, Bing.<\/p>\n

The tracking tools, popularly called \u201cpixels,\u201d collect information while a website runs. That information is often sent to social media firms and used to target ads, either to you personally or to groups of people that resemble you in demographics or habits. In previous investigations, The Markup found pixels transmitting information from the Department of Education<\/a>, prominent hospitals<\/a>, telehealth startups<\/a>, and major tax preparation companies<\/a>.<\/p>\n

Pharmacy retailer websites\u2019 pixels send a shopper\u2019s IP address \u2014 a sort of mailing address for a person\u2019s computer or household internet \u2014 to social media giants and other firms. They also send cookies, a way of storing information in a user\u2019s browser that in this case helps track a user from page to page as the user browses a retailer\u2019s site. Cookies can sometimes also associate individuals on a site with their account on a social media platform. In addition to the IP address and cookies, the pixels often send information about what you\u2019ve clicked or bought, including sensitive items, such as HIV tests.<\/p>\n

\u201cHIV testing is the gateway to HIV prevention and treatment services,\u201d said Oni Blackstock, the founder of Health Justice and a former assistant commissioner for the New York City Bureau of HIV\/AIDS Prevention and Control, in an interview.<\/p>\n

\u201cPeople living with HIV should have control over whether someone knows their status,\u201d she said.<\/p>\n

Many retailers shared other detailed interaction data with advertising platforms as well. Ten of the retailers we examined alerted at least one tech platform when shoppers clicked \u201cadd to cart\u201d as they shopped for retail goods, a capacious category that included sensitive products like prenatal vitamins, pregnancy tests, and Plan B emergency contraception.<\/p>\n

Supermarket giant Kroger, for instance, informed Meta, Bing, Twitter, Snapchat, and Pinterest when a shopper added Plan B to the cart, and informed Google and Nextdoor, a social media platform on which people from the same neighborhood gather in forums, that a shopper had visited the page for the item. Walmart informed Google\u2019s advertising service when a shopper browsed the page of an HIV test, and Pinterest when that shopper added it to the cart.<\/p>\n

A previous investigation from The Markup found that Kroger used loyalty cards<\/a> to track, analyze, and sell an array of data about customers to advertisers.<\/p>\n

Using Chrome DevTools, a tool built into Google\u2019s Chrome browser, The Markup and KFF Health News visited the websites of 12 of the U.S.\u2019 biggest drugstores and examined their network traffic. This monitoring tool allowed us to see what information about shopping habits and, in some cases, prescriptions, were sent to third parties.<\/p>\n

Over the course of the investigation, retailers frequently changed their trackers \u2014 sometimes activating them, sometimes removing them. Some retailers appeared to be taking steps to limit tracking on sensitive items.<\/p>\n

For example, Walgreens\u2019 website prevented some trackers from activating on the pages of some products, which included Plan B and HIV tests. This code didn\u2019t prevent all tracking, though: Walgreens\u2019 site continued sending Pinterest information about those sensitive items a user added to the cart.<\/p>\n

Walgreens shared a new policy after learning of The Markup and KFF Health News\u2019 findings. Spokesperson Fraser Engerman said that while the chain already had a \u201crobust privacy program,\u201d it would no longer share browsing data related to reproductive health and HIV testing. Engerman also told us that \u201cPinterest confirmed that the data will be deleted and that it has not been used for advertising purposes.\u201d Crystal Espinosa, a spokesperson for Pinterest, said the company \u201ccan confirm that we will be deleting the data Walgreens requested.\u201d<\/p>\n

The Pharmacy vs. the Pharmacy Aisle<\/strong><\/p>\n

In the U.S., drugstores and grocery stores with associated pharmacies are only partially covered by the Health Insurance Portability and Accountability Act, or HIPAA. The prescriptions picked up from the pharmacy counter do have this protection.<\/p>\n

But in a separate section, sometimes confusingly called the pharmacy aisle, stores also often sell over-the-counter medications, tests, and other health-related products. Consumers might think such purchases have similar protections to their prescriptions, but HIPAA only covers the pharmacy counter\u2019s clinical operations, such as dispensing prescriptions and answering patients\u2019 questions about medication.<\/p>\n

This distinction can be confusing enough inside the brick-and-mortar location of a retailer. But the line can become even harder to make out on a website, which lacks the clarifying delineations of physical space.<\/p>\n

What\u2019s more, descriptions about what will happen with retail data are generally in retailers’ privacy policies, which can usually be found in a link at the bottom of their webpages. The Markup and KFF Health News found them murky at best, and none of them were specific about the parts of the site that were covered by HIPAA and the parts that weren\u2019t.<\/p>\n

In the \u201cPrivacy Notice for California Residents\u201d part of its privacy policy<\/a>, Kroger says it processes \u201cpersonal information collected and analyzed concerning a consumer\u2019s health.\u201d But, the policy continues, the company does not \u201csell or share\u201d that information. Other information is sold: According to the policy, in the last 12 months, the company sold or shared \u201cprotected classification characteristics\u201d to outside entities like data brokers.<\/p>\n

Kroger spokesperson Erin Rolfes said the company strives to be transparent and that, \u201cin many cases, we have provided more information to our customers in our privacy notices than our peers.\u201d<\/p>\n

Brokering of general retail data is widespread. Our investigation found, though, that some websites shared sensitive clinical data with third parties even when that information would be protected at a HIPAA-covered pharmacy counter. Users attempting to schedule a vaccine appointment at Rite Aid, for example, must answer a survey first to gauge eligibility.<\/p>\n

This investigation found that Rite Aid has sent Facebook responses to questions such as:<\/p>\n