{"id":5489,"date":"2023-10-21T09:53:24","date_gmt":"2023-10-21T16:53:24","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=5489"},"modified":"2023-10-21T09:53:24","modified_gmt":"2023-10-21T16:53:24","slug":"google-microsoft-facebook-among-tech-giants-illegally-harvesting-private-health-information","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2023\/10\/21\/google-microsoft-facebook-among-tech-giants-illegally-harvesting-private-health-information\/","title":{"rendered":"Google, Microsoft, Facebook Among Tech Giants Illegally Harvesting Private Health Information"},"content":{"rendered":"\n<p>A good reason to utilize <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2022\/03\/10\/ad-blocking-and-avoiding-web-tracking\/\" data-type=\"link\" data-id=\"https:\/\/jasonsblog.ddns.net\/index.php\/2022\/03\/10\/ad-blocking-and-avoiding-web-tracking\/\">uMatrix and uBlock Origin<\/a> so you can block web elements and advertising, as well as using your own <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2022\/03\/17\/run-pi-hole-with-unbound-in-docker-on-a-raspberry-pi\/\" data-type=\"link\" data-id=\"https:\/\/jasonsblog.ddns.net\/index.php\/2022\/03\/17\/run-pi-hole-with-unbound-in-docker-on-a-raspberry-pi\/\" target=\"_blank\" rel=\"noreferrer noopener\">Pi-Hole\/Unbound DNS servers<\/a> where you can block a lot of the tracking, telemetry and advertising domains. But keep in mind that these are the tech companies, many invested in by the CIA&#8217;s venture capitalist arm, that will be used along with your digital ID, vaccine passport, CBDC&#8230; to determine your social credit score in the incoming <a href=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\" data-type=\"link\" data-id=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\">Pano<\/a><a href=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\" data-type=\"link\" data-id=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\" target=\"_blank\" rel=\"noreferrer noopener\">p<\/a><a href=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\" data-type=\"link\" data-id=\"https:\/\/en.wikipedia.org\/wiki\/Panopticon\">ticon<\/a> of digital slavery. And they&#8217;re already big participants in censorship and determining what is considered &#8220;truth&#8221;, all promulgated by people consistently caught in blatant lies. <\/p>\n\n\n\n<p><a href=\"https:\/\/freedomfirstnetwork.com\/2023\/10\/google-microsoft-facebook-among-tech-giants-illegally-harvesting-private-health-information\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/freedomfirstnetwork.com\/2023\/10\/google-microsoft-facebook-among-tech-giants-illegally-harvesting-private-health-information<\/a><\/p>\n\n\n<div class=\"wp-block-ub-divider ub_divider ub-divider-orientation-horizontal\" id=\"ub_divider_100fddf3-d219-4080-b833-23816845bd0d\"><div class=\"ub_divider_wrapper\" style=\"position: relative; margin-bottom: 2px; width: 100%; height: 2px; \" data-divider-alignment=\"center\"><div class=\"ub_divider_line\" style=\"border-top: 2px solid #ccc; margin-top: 2px; \"><\/div><\/div><\/div>\n\n\n<h5 class=\"wp-block-heading\">Google, Microsoft, Facebook, TikTok and the majority of medical and healthcare websites illegally harvest and sell private health information despite a federal crackdown on the practice, according to a new cybersecurity report by Feroot Security.<\/h5>\n\n\n\n<p>by Mike Capuzzo, The Defender<\/p>\n\n\n\n<p>Google, Microsoft, Facebook, TikTok and the majority of medical and healthcare websites illegally harvest and sell private health information despite a federal crackdown on the practice, according to a new&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/wp-content\/uploads\/Beware-of-Pixels-Trackers-Feroot-Client-Side-Security-Report-March-2023.pdf\">cybersecurity report<\/a>.<\/p>\n\n\n\n<p>The report, by Toronto-based cybersecurity firm&nbsp;<a href=\"https:\/\/www.feroot.com\/\">Feroot Security<\/a>, analyzed hundreds of healthcare websites and found that more than 86% are collecting private data and transferring it to advertisers, marketers and&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/defender_category\/big-tech\/\">Big Tech<\/a>&nbsp;social media companies without user consent and in violation of privacy laws.<\/p>\n\n\n\n<p>As patients or consumers browse their favorite or trusted medical websites or sign in to hospital portals to access their private health records, invisible bits of HTML code \u2014 called \u201ctracking pixels\u201d \u2014 embedded on the websites harvest private information, such as whether patients have cancer, erectile dysfunction or are behind on their hospital bill.<\/p>\n\n\n\n<p>The information is repackaged and sold for a variety of uses, including to companies that target individual users with internet ads, according to the report.<\/p>\n\n\n\n<p>The risk of having personal data scraped is particularly high on log-in and registration pages where internet users supply troves of information, unaware it is being hijacked and sold. More than 73% of log-in and registration pages have invisible trackers that pirate personal health information, the study found.<\/p>\n\n\n\n<p>Approximately 15% of the tracking pixels analyzed by Feroot record users\u2019&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/defender\/tiktok-tracking-system-keystrokes-risk-cola\/\">keystrokes<\/a>, harvesting social security numbers, usernames and passwords, credit card and banking information, and an infinite variety of personal health data, including medical diagnosis and treatment.<\/p>\n\n\n\n<p>The study showed that \u201c<a href=\"https:\/\/childrenshealthdefense.org\/defender\/youtube-google-advertisers-kids-data\/\">Google<\/a>&nbsp;is the absolute dominant collector\u201d of data. Ninety-two percent of the websites loaded on the Google search engine contained data-harvesting technology across wide sectors of the U.S. economy including healthcare and telehealth, banking and financial services, airlines, e-commerce, and the federal and state governments.<\/p>\n\n\n\n<p>The number two offender was Microsoft with 50.4% of websites on its platform hiding tracking tools, with Facebook next at 50.2% percent and TikTok at 7.41% percent and growing fast.<\/p>\n\n\n\n<p>Google, as the driver of its parent Alphabet, the&nbsp;<a href=\"https:\/\/companiesmarketcap.com\/\">world\u2019s fourth largest company<\/a>, is often called \u201c<a href=\"https:\/\/en.wikipedia.org\/wiki\/Google\">the most powerful company in the world<\/a>.\u201d It counts on advertising, a lifeblood of the global digital economy, for 80% of its revenue.<\/p>\n\n\n\n<p>Microsoft and Facebook \u201cround up the Top 3\u201d of companies that systematically breach data, the report said. Representatives of Google, Microsoft, and Facebook&nbsp;<a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2023-10-17\/private-health-data-still-being-exposed-to-big-tech-report-says#xj4y7vzkg\">denied their companies<\/a>&nbsp;used tracking pixels to harvest personal data.<\/p>\n\n\n\n<p>Website owners are responsible for controlling data collection, a Google spokesperson said.&nbsp;<a href=\"https:\/\/support.google.com\/analytics\/answer\/13297105?hl=en\">Google policy<\/a>&nbsp;prohibits Google Analytics and advertising customers, including for example hospital or telehealth websites, from collecting health data in violation of the U.S. Health Insurance Portability and Accountability Act (<a href=\"https:\/\/www.hhs.gov\/hipaa\/index.html\">HIPAA<\/a>). It\u2019s up to the websites to determine \u201cwhether they are HIPAA-regulated entities and what their obligations are under HIPAA,\u201d Google policy says.<\/p>\n\n\n\n<p>Personal health data collected by a tracker or third party without a user\u2019s consent is a&nbsp;<a href=\"https:\/\/www.ama-assn.org\/practice-management\/hipaa\/hipaa-violations-enforcement\">violation of HIPAA<\/a>, said Feroot CEO Ivan Tsarynny.<\/p>\n\n\n\n<p>Big Tech companies \u201cdo have policies that talk about protecting health info,\u201d&nbsp;<a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2023-10-17\/private-health-data-still-being-exposed-to-big-tech-report-says#xj4y7vzkg\">Tsarynny said<\/a>. But \u201cthe real-world application of these policies is a different story.\u201d<\/p>\n\n\n\n<p>Feroot\u2019s study comes as \u201cconcern grows regarding data mining companies using pixels\/trackers that load into browsers from websites to collect privacy and sensitive user data,\u201d the report stated.<\/p>\n\n\n\n<p>\u201cCompliance regulators and government authorities are increasingly stepping in with bans, restrictions, and executive orders to curb them.\u201d<\/p>\n\n\n\n<p><a href=\"https:\/\/www.beckershospitalreview.com\/healthcare-information-technology\/9-hospitals-health-systems-facing-lawsuits-for-healthcare-data-sharing.html\">Eighteen major hospital systems<\/a>&nbsp;were sued this year for sharing patients\u2019 sensitive health data with Google,&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/defender\/drugstores-personal-health-data-facebook-kff\/\">Facebook<\/a>&nbsp;and other tech giants in violation of privacy laws, according to Becker\u2019s Hospital Review.<\/p>\n\n\n\n<p>Protect your wealth or retirement with <a href=\"https:\/\/ourgoldguy.com\/ffn\">PHYSICAL BULLION<\/a>. Gold and silver in a self-directed IRA or in your safe at home is quickly becoming the most popular way to defend Americans\u2019 life\u2019s savings. Contact <a href=\"https:\/\/ourgoldguy.com\/ffn\">Ira Bershatsky<\/a> for real answers to your questions.<\/p>\n\n\n\n<p>They include prominent academic medical centers such as the University of Pittsburgh Medical Center, the University of Chicago Medical Center, the University of Iowa Medical Center, Chicago-based Northwestern Memorial Hospital and the University of California San Francisco Medical Center.<\/p>\n\n\n\n<p>Prompted by growing concerns over data theft and the article, \u201c<a href=\"https:\/\/themarkup.org\/pixel-hunt\/2022\/12\/13\/out-of-control-dozens-of-telehealth-startups-sent-sensitive-health-information-to-big-tech-companies\">\u2018Out of Control\u2019<\/a>: Dozens of Telehealth Startups Sent Sensitive Health Information to Big Tech Companies,\u201d Feroot launched an investigation \u201cto ascertain the exact magnitude and pervasiveness of social media pixels\/trackers collecting and transferring personal, sensitive, and private data using pixels or trackers.\u201d<\/p>\n\n\n\n<p>The security platform Feroot sells to companies \u201cmade it possible to get detailed facts regarding active client-side e-skimming,\u201d the company said.<\/p>\n\n\n\n<p>Feroot collected data on pixels\/trackers during an eight-week period in January and February.<\/p>\n\n\n\n<p>The company said it examined more than 3,675 organizations with unique websites in seven economic sectors. It studied 108,836 unique web pages, including especially vulnerable login, registration and credit card processing pages, 227 trackers and 7 million data transfers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key findings from \u2018Beware of Pixels &amp; Trackers\u2019:<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pixel trackers are \u201ccommon and abundant\u201d \u2014 an average of 13.16 pixels\/trackers were found per website, \u201cwith Google, Microsoft, Meta (owner of Facebook), ByteDance (owner of TikTok), and Adobe being some of the most common.\u201d<\/li>\n\n\n\n<li>\u201cMission-critical\u201d webpages, such as log-in or registration pages, increase the risk of exposing private information. An average of 5.96% of websites had pixels\/trackers on webpages reading user input forms containing privacy or sensitive data.<\/li>\n\n\n\n<li>Pixel trackers transfer data to foreign locations around the globe \u2014 \u201cabout 5% of the data transferred by pixels\/trackers loaded from US-based websites is sent outside the US.\u201d<\/li>\n\n\n\n<li>Pixel trackers collect and transfer data without first obtaining the explicit consent of visitors.<\/li>\n\n\n\n<li>Pixels and trackers are loading from domains banned by the U.S. government and various U.S. states and even from some of those same governments, including Russia and China. Data obtained by Russian and Chinese websites is a security risk from surveillance and spying.<\/li>\n\n\n\n<li>Meta (owner of Facebook and Instagram) and&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/defender\/restrict-act-tiktok-surveillance-censorship\/\">TikTok<\/a>, owned by Chinese company&nbsp;<a href=\"https:\/\/www.bytedance.com\/en\/\">ByteDance<\/a>, were \u201cparticularly worrisome\u201d for privacy invasion and surveillance risks. Thirty-four U.S. states, both Republican and Democratic-controlled, have banned the use of TikTok on government devices. Montana in May banned the app on all personal devices.<\/li>\n\n\n\n<li>TikTok is often present whether or not the TikTok app is deleted. TikTok pixels\/trackers can still \u201cload into webpages handling mission-critical user data and can collect and transfer it.\u201d<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">GoodRX case highlights corporate deceit around data-sharing<\/h2>\n\n\n\n<p>While corporations face losing profit and reputation from data breaches or fines for causing them, individuals face a potentially catastrophic loss of privacy when major health websites harvest and sell their information, according to the Federal Trade Commission (FTC).<\/p>\n\n\n\n<p>In February, the FTC fined popular discount drug and telehealth site&nbsp;<a href=\"https:\/\/www.goodrx.com\/\">GoodRx<\/a>&nbsp;for \u201c<a href=\"https:\/\/www.ftc.gov\/news-events\/news\/press-releases\/2023\/02\/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising\">failing to report<\/a>&nbsp;its unauthorized disclosure of consumer health data to Facebook, Google, and other companies.\u201d<\/p>\n\n\n\n<p>The action to \u201cbar GoodRx from sharing consumers\u2019 sensitive health information for advertising\u201d was the FTC\u2019s first enforcement action under its&nbsp;<a href=\"https:\/\/www.ftc.gov\/legal-library\/browse\/rules\/health-breach-notification-rule\">Health Breach Notification Rule<\/a>.<\/p>\n\n\n\n<p>\u201cDigital health companies and mobile apps&nbsp;<a href=\"https:\/\/www.pymnts.com\/news\/regulation\/2023\/ftc-goodrx-settle-complaint-around-health-breach-notification-rule\/\">should not cash in<\/a>&nbsp;on consumers\u2019 extremely sensitive and personally identifiable health information,\u201d FTC Bureau of Consumer Protection Director Samuel Levine said in a news release after the settlement. \u201cThe FTC is serving notice that it will use all of its legal authority to protect American consumers\u2019 sensitive data from misuse and illegal exploitation.\u201d<\/p>\n\n\n\n<p>The FTC enforcement against GoodRx revealed a particularly egregious, yet not uncommon, example of how corporate health and medical websites betray patient trust and manipulate patient data, the FTC said.<\/p>\n\n\n\n<p>According to the FTC\u2019s complaint,&nbsp;<a href=\"https:\/\/iapp.org\/news\/a\/a-healthy-dose-of-consent-takeaways-from-the-ftcs-goodrx-case\/\">GoodRx violated the law<\/a>&nbsp;by improperly sharing sensitive personal health information since at least 2017, though it promised otherwise.<\/p>\n\n\n\n<p>The company \u201cdeceptively promised its users that it would never share personal health information with advertisers or other third parties,\u201d the FTC charged, and deceptively displayed a seal at the bottom of its telehealth services homepage \u201cfalsely suggesting to consumers that it complied with \u2026 HIPAA.\u201d<\/p>\n\n\n\n<p><strong>Stock up on long-term storage beef before prices SKYROCKET. 10+ year shelf life, premium cuts, all-American, no mRNA jabs. Promo code \u201ccleancows\u201d at <a href=\"https:\/\/freedomfirstbeef.com\/\">Freedom First Beef<\/a>.<a href=\"https:\/\/classic.avantlink.com\/click.php?tool_type=ml&amp;merchant_link_id=0984d6ac-c2d0-48d4-b6af-f170d581b2bb&amp;website_id=6ef335b2-5485-4cd2-9187-518a5323f4f4\"><\/a><\/strong><\/p>\n\n\n\n<p>In reality, the FTC complaint said, GoodRx \u201cmonetized its users\u2019 personal health information, and used data it shared with Facebook to target GoodRx\u2019s own users with personalized health- and medication-specific advertisements on Facebook and Instagram.\u201d<\/p>\n\n\n\n<p>For example, GoodRx in August 2019 made lists of its users \u201cwho had purchased particular medications such as those used to treat heart disease and blood pressure, and uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook so it could identify their profiles,\u201d according to the complaint.<\/p>\n\n\n\n<p>\u201cGoodRx then used that information to target these users with health-related advertisements.\u201d<\/p>\n\n\n\n<p>People who accessed GoodRx coupons to purchase, for instance, Viagra would see ads for erectile dysfunction medication on their Facebook or Instagram page ads, the FTC says.<\/p>\n\n\n\n<p>\u201cSimilarly, people who had used GoodRx\u2019s telehealth services to get treatment for sexually transmitted diseases would get ads for STD testing services.\u201d<\/p>\n\n\n\n<p>GoodRx disclosed to Facebook the medication purchase data it receives from pharmacy benefit managers and also used the data to target ads.<\/p>\n\n\n\n<p>By using Facebook\u2019s ad targeting platform, the FTC said, \u201cGoodRx designed campaigns that targeted customers with ads based on their health information. For example, if a customer had revealed a possible erectile dysfunction issue to GoodRx, they might have seen an ad on Facebook like Exhibit A in the FTC complaint.\u201d<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter\"><a href=\"https:\/\/www.ftc.gov\/system\/files\/ftc_gov\/pdf\/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf\"><img decoding=\"async\" src=\"https:\/\/i0.wp.com\/childrenshealthdefense.org\/wp-content\/uploads\/\/good-rx-complaint-online-ad-600x982.jpg?resize=600%2C982&amp;ssl=1\" alt=\"\"\/><\/a><figcaption class=\"wp-element-caption\">Source: Federal Trade Commission complaint<\/figcaption><\/figure>\n\n\n\n<p>In February, California-based GoodRx, a&nbsp;<a href=\"https:\/\/www.macrotrends.net\/stocks\/charts\/GDRX\/goodrx-holdings\/market-cap\">$2.1 billion company<\/a>, paid a&nbsp;<a href=\"https:\/\/childrenshealthdefense.org\/defender\/goodrx-personal-health-data-breach-ftc\/\">$1.5 million civil penalty<\/a>&nbsp;to the FTC to settle the complaint and denied any wrongdoing.<\/p>\n\n\n\n<p>Howard Danzig, founder and president of&nbsp;<a href=\"https:\/\/ecchic.com\/\">Employers Committed to Control Health Insurance Costs<\/a>, said \u201cfining GoodRx just $1.5 million dollars is not even a slap on the wrist. While many employers are so vigilant about respecting the guidelines of the HIPAA privacy laws, large tech companies basically get a pass.\u201d<\/p>\n\n\n\n<p>\u201cHow about major penalties for Facebook, Google and any others who were the beneficiaries of this information?\u201d he wrote on his&nbsp;<a href=\"https:\/\/www.linkedin.com\/posts\/howarddanzig_ftc-fines-goodrx-15m-for-sharing-sensitive-activity-7029561434858557441-8iqD\/\">LinkedIn<\/a>&nbsp;page with almost 9,000 followers.<\/p>\n\n\n\n<p>\u201cHow about determining whether or not there were any criminal violations that should be pursued against the individuals who actually collaborated to do this? How about \u2018REPARATIONS\u2019 from the companies involved to the people and customers whose privacy was breached?\u201d<\/p>\n\n\n\n<p>The data breach occurred for \u201cadvertising purposes,\u201d he noted. \u201cHow far afield can this really be taken and how far afield has it been taken?\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A good reason to utilize uMatrix and uBlock Origin so you can block web elements and advertising, as well as using your own Pi-Hole\/Unbound DNS servers where you can block a lot of the tracking, telemetry and advertising domains. But keep in mind that these are the tech companies, many invested in by the CIA&#8217;s [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-5489","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/5489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=5489"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/5489\/revisions"}],"predecessor-version":[{"id":5490,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/5489\/revisions\/5490"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=5489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=5489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=5489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}