Privacy activists and academics from leading institutions have called for charities to stop sharing user data with advertisers from web pages providing support or advice on sensitive topics such as mental health and domestic abuse.
The open letter to the charity sector follows an investigation by digital rights group ProPrivacy earlier this year, which found that pages of leading charities’ websites had third-party trackers linked to bodies including data brokers, which sell information about consumers to advertisers.
Sean McGrath, editor of ProPrivacy, pointed to leading UK charities — including the Alzheimer’s Society, Marie Curie and the British Heart Foundation — as being among the organisations causing concerns over their data-sharing practices.
The charities listed above did not immediately respond to requests for comment.
“Just by going on [one of these] sites, I advertise to data brokers the fact that I’m vulnerable,” said Sylvie Delacroix, professor in law and ethics at the University of Birmingham and one of the letter’s signatories. “[Data brokers] have the freedom to aggregate this information with other information [including age, income and political views] to sell to advertisers.”
Mr McGrath emphasised that the presence of these trackers was likely to have been the result of the legitimate efforts by charities to target customers elsewhere on the web. “They [often] bring in third-party agencies who say, ‘We need you to install these pixels on your site so that we can retarget customers,’ and one of those pixels happens to belong to . . . a data broker.”
He said that in some cases, installing one tracker on a site could also act as a kind of “Trojan horse” to allow others in. “It could well be that [in some cases, charities] are not even fully aware of the trackers they have on their sites.”
The UK Information Commissioner’s Office has been critical of the adtech industry, releasing a report in July 2019 which found that personal data was widely used in the process of selling adverts without consent.
Last month, it ordered credit data company Experian to make “fundamental changes” to its handling of personal data after it found that the company had undertaken significant “invisible” processing without individuals’ knowledge.
However, the regulator announced in May that it had paused its investigation into the wider adtech industry. “It is not our intention to put undue pressure on any industry at this time but our concerns about adtech remain and we aim to restart our work in the coming months, when the time is right,” said an ICO spokesperson.
Data brokers have increasingly positioned themselves as offering “data for good” services during the Covid-19 pandemic, leading to resistance from privacy activists. In June, the Financial Times reported that companies such as Experian were offering to help officials in the UK to identify people struggling in the aftermath of the crisis.
In the US, data broker Ubermedia released research in April in which it claimed to show it had mapped the movement of homeless populations in Los Angeles with the aim of assisting local government decision-making in allocating resources.