On March 16, the Federal Trade Commission (FTC) published a “deep dive” article on the technical side of FTC’s recent cases on digital health platforms GoodRx and BetterHelp. The two digital healthcare platforms allegedly shared user health data with third parties for advertising.
The article says that both cases drew attention to the use of third-party tracking pixels which permit platforms to collect, analyze, and infer information about user activity. “The remedies in GoodRx and BetterHelp include strong provisions like bans that place strict, comprehensive limits on whether and how certain user information may be disclosed for advertising,” the article notes. “In GoodRx and BetterHelp, this included a ban on the sharing of health information for any advertising purposes, and the BetterHelp order further bans the disclosure of other personal information for re-targeting.”
The article adds that “Tracking pixels have evolved from tiny, pixel-sized images on web pages for tracking purposes to include a broad range of HTML and JavaScript embedded in web sites (and email). Tracking pixels can be hidden from sight and can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site. Businesses often want to use them to track consumer behavior (pageviews, clicks, interactions with ads) and target ads to users who may be more likely to engage or purchase something based on that prior online behavior.”
As to how pixel tracking works, the article explains that after a company chooses a pixel tracking provider, the provider will generate a tracking pixel—a small piece of code placed into the website or ad—and identify their tracking goals. The company will then use an interface with the provider to test, track, and refine their settings.
“Pixel tracking can be monetized several ways,” the article states. “One way to monetize pixel tracking is for companies to use the tracking data collected to improve the company's own marketing campaigns. The data can be used to target more specific audiences with ads and other marketing messages. Another is that companies can monetize the data collected by further optimizing their own ad targeting systems and charging other companies to use its advertising offerings.”
The concerns, according to the article, include:
- Traditional controls may not prevent pixels from collecting and sharing data
- Consumers may not realize that tracking pixels exist
- Lack of transparency around data collection and use
- Personal information may not be removed
The article concludes by saying that “Our agency remains committed to protecting consumers and enforcing the law. Companies using tracking pixels that impermissibly disclose an individual’s personal information (which may include health information) to third parties may be violating the FTC Act, the FTC’s Health Breach Notification Rule, the HIPAA Privacy, Security, and Breach Notification Rules, other state or federal statutes involving the disclosure of personal information, and your privacy promises to consumers. As the Office of Technology grows, we will work to ensure the agency continues to be forward thinking and equipped to address and decipher developing technologies and harms.”
