Justin Sullivan/Getty Images
show image

“I have HIV, now what?” Tracking cookies found on NHS advice pages

Invasive tracking technology has been covertly installed on more than a dozen NHS landing pages about sensitive medical conditions, new research has revealed.

An investigation by Cookiebot found that 60 per cent of surveyed NHS advice articles about HIV, pregnancy, mental illness, alcoholism and cancer contained tracking cookies from Google even though they did not serve adverts.

Industry experts fear the technology could be used to link sensitive web browsing data to users’ real identities, such as through online accounts. Research published earlier this year revealed Google’s adtech network used a number of labels, including sexually transmitted diseases, cancer and mental health, to target users. This kind of targeting is currently the subject of a legal complaint under GDPR.

“Cookiebot has exposed the firms that surreptitiously listen in when a vulnerable person goes to their government for advice about mental illness, HIV, alcoholism, etc,” said Brave’s policy chief Johnny Ryan. “The list of offenders includes some of the biggest technology companies in the world. These companies must be stopped from inserting themselves between the citizen and state.”

The investigation also uncovered the scale of tracking cookies on government websites. Nearly nine out of ten official EU member states’ websites contain third party ad tracking services.

Trackers find their way on to websites largely through third-party plugins such as social sharing widgets, embedded video players, web analytics services and comment sections. The prevalence of cookies has prompted calls for the EU’s upcoming ePrivacy Regulation to better protect consumers from ad tracking. “This report shows the need for the EU to adopt a strong ePrivacy Regulation,” said European Digital Right policy advisor Diego Naranjo.

“Online tracking is ubiquitous and it can expose very intimate information about individuals without them even being aware that information is being collected and shared with others.”

A Google spokesperson said: “Our policies are clear: if website publishers choose to use Google web or advertising products, they must obtain consent for cookies associated with those products.

“We do not permit publishers to use our technology to collect or build targeting lists based on users’ sensitive information, including health conditions like pregnancy or HIV.”