Mental health websites don't have to sell your data. Most still do.

In a follow up to PI’s initial research on sharing of personal data by mental health websites, a second analysis illustrates how change is possible and yet most webpages analysed still share your data with third-parties for marketing purposes.

KEY FINDINGS

A few websites have made changes to limit the amount of personal data shared with third parties
One of the site offering a depression test is now clean of any third party
Generally, most websites analyses haven’t taken action to limit data sharing
This means your personal data are still shared for advertising purposes in many case

The changes discussed in this article are based on a second analysis performed in late November, 3 months after the original study Your Mental Health is for Sale and following the exact same methodology. All data collected can be found at the bottom of this page.

Change is possible

Back in September 2019 we published the report Your Mental Health is for Saleexposing how a majority of the top websites related to mental health in France, Germany and the UK share data for advertising purposes. This report most notably highlighted how numerous mental health websites engage in programmatic advertising, a type of advertising that relies on sharing your personal data with hundreds if not thousands of companies to eventually serve you targeted ads. It also exposed how a small number of websites offering depression tests share your answers directly with third parties.

Thanks to wide coverage and outrage as well as a related study by the Financial Times published on the front page of the paper edition, this report led some websites to reconsider their practices and implement changes to limit the amount of data shared.

Our re-scan of the websites shows, for example, that the NHS’ depression test no longer sends answers to a third party server and has been completely purged of all third parties, including Hotjar, a company providing session recording capabilities. The charity Mind also reported to the Financial Times that they had been reviewing their practices: “As a result of a report published by Privacy International in September, we have removed marketing trackers from our site and won’t reinstate them until our review has finished and we are satisfied we’re using them appropriately”. Similarly, the Health Prevention Agency reduced the number of third parties for the website depression.org.nz. Another positive change we observed is the decrease in the number of mental health websites in Germany contacting third-parties for marketing purposes from 61.36% to 50%.

This is not the first time PI’s research pushes companies to change. Many Android apps using the Facebook SDK changed their default behavior following our App analysis in 2018, while Facebook changed the default parameters of its SDK to prevent data from being shared as soon as the user would open an app this SDK. Similarly, in September 2019, our research into menstruation apps led two of the main apps we exposed to stop sharing sensitive personal data with Facebook. This is a positive change that we welcome and that proves that websites and apps don’t have to trade your privacy.