Tubes #1: Sensitivity Training
Tubes #1: Sensitivity Training
In this issue: catholics, cancer, and peeing with your friends
The subject of online anonymity came up at a house party a few weeks back. One of the people there—a friend I’d known for years—said he couldn’t get over the fact that a privacy reporter like me would use their full name on any social site. I told him that hiding behind an online alias comes with pros and cons, and for me, it just wasn’t worth the effort most of the time.
A few hours into the party when everyone was sufficiently liquored up and had already broken one of the toilets in the place, I watched this same friend go outside and piss on our friend’s driveway. There’s no shame in that, but the fact that he did it in full, open view of both passing cars and partygoers gave me pause; this was a guy who wouldn’t use his real name on Facebook or Instagram, but in the right scenario, he would whip out his junk in front of us all. I, on the other hand would let my Facebook friends know my real name, but would sooner die than step into a public bathroom, let alone do what he did.
I bring this up as a way to show how our ideas of privacy exist on sort of a spectrum—one that’s informed by our own experiences, beliefs, and understanding of the world. If you watch the clip above, for example it’s pretty clear that Ron and Donna are on opposite ends of that spectrum; he’s desperate to get off the grid, while she flat-out says she lives for that grid (her words, not mine). Most of us are somewhere in the piss-soaked middle.
Where you draw the line is normally nobody’s business. Normally. Other times you’re the FTC, and you’re issuing a $7.8MM fine against the mental healthcare app Betterhelp over allegations that it disclosed people’s health data, which is de facto “sensitive” in the agency’s eyes. This story is admittedly from last week, but A) I didn’t have a newsletter then, and B) a tweet from Morningbrew’s Ryan Barwick was posted on Thursday, which prompted me to read the settlement in full. And boy did I have… thoughts!
Here’s one of them:
This is a good reader on the highlights from the case, and pretty much sums up what constitutes “health data” and can get your ass fined by the FTC. This includes:
The fact that you signed up for a therapy app—even if you haven’t gone to a single appointment. Among the transgressions mentioned in the docket was that Betterhelp used the email addresses from “over 70,000 visitors that had signed up for accounts,” (but haven’t actually paid to book a therapist) as fodder for their Facebook ads. It doesn’t matter if those emails are hashed before plugging them into someone’s ad platform, the way Betterhelp’s were—an email is an email.
An IP address, if you’re passing that IP to an ad player in conjunction with some other kind of health data. Here’s how the FTC puts it:
There’s no comprehensive privacy law at the federal level in the U.S., and our country’s only healthcare privacy law is quite literally useless when it comes to governing apps, websites, or most things invented after 1995. So I totally applaud the FTC for taking the initiative here! This is a good thing, and someone had to do it!
But at least for me, the move raises a few questions about “sensitivity,” and what it means in practice. For example: we all know a WebMD Guy whose response to any ache or pain or random bout of nausea is always the same: you whip out your phone and check everyone’s favorite health site to make sure you’re not dying.
Unfortunately, I’m one of these guys. Fortunately, I haven’t died yet. What I have done, instead, is clock in way too many hours scrolling webpages for cancers and carcinomas, among other maladies that I’ll likely never come into contact with.
I’m telling you all of this because I consider my habit of always assuming the worst (both in health and life) to be just another facet of my fun, quirky personality. Scrolling pages about cancer (when you just have acid reflux) or pages about acid reflux (when you actually ate some bad sushi) doesn’t seem sensitive to me. It seems fun and quirky and maybe a bit paranoid, but I wouldn’t say my habit inadvertently leaves me disclosing any of my actual health details to WebMD, or anyone else. And yet…
This is from a 2021 pitchdeck WebMD gave advertisers, which you can see for yourself here.
Now personally, I’d say that someone’s choice to go on a diet isn’t that sensitive. I think they should be proud of the choice! You go girl, eat that kale salad, or whatever. But I’m pretty sure someone’s cancer diagnosis is a sensitive piece of info, or at least that’s what I gathered from the first season of Breaking Bad.
So when any company says “we have about 1.7 million cancer patients on our service per month, and they love ads almost as much as they love going into remission,” my first question is: who told them about these diagnoses in the first place?
Ultimately, only WebMD knows how WebMD classifies its site visitors. But another part of the deck offers a pretty big clue. In talking about its now debuted Cancer Center—which is literally just a sea of webpages about different kinds of cancer and cancer treatment—the platform boasts how the Center was primed to be “the go-to resource for cancer patients and caregivers to learn about care options, treatments, and breakthroughs.”
The way I’m reading it, it really, really seems like WebMD’s saying that “this is a section of our site where people come to read about cancer. Most (if not all!) of people who’d bother spending time here are cancer patients or their caregivers. If you show your ads here, people with cancer will see it. And we’re so sure of this fact that we will put it in our promotional materials.”
The FTC’s ruling more or less says that registering for a therapy site constitutes health data that could, in theory, be abused by advertisers on the assumption that you’re “primed” for therapy, which itself typically comes with the assumption of some lurking mental illness or neuroses. Dear reader, I’ve visited WebMD’s Cancer Center more times than I can count, despite having a clean bill of health (see: the aforementioned quirkiness).
But if WebMD thinks I’m “primed” for a cancer treatment that I don’t need, and suffering from a disease that I don’t have, does that data become sensitive, somehow? What if I’m just scrolling one page about cancer, as opposed to ten or twenty? What if I only scroll down half a page, or watch a few seconds of a video? At what point does a funny quirk turn into something that looks like a terminal disease?
Many people are asking dot jpeg (and by many, I mean literally 3):
While I really am thrilled that the FTC is kicking ass and taking names on the data privacy front, I don’t envy their path forward. No matter where they end up drawing lines in the sand, someone is sure to be pissed.
Other links I’m looking at
Catholic group spent millions on app data that tracked gay priests // Washington Post
In a pretty clear-cut example of data that’s sensitive no matter how you slice it, the Post finally got to the bottom of that 2021 story where a priest was outed (of the closet) and ousted (from the church) based on his phone’s location data. Turns out a hyper-conservative nonprofit was behind the whole thing! All they needed was usage data from dating apps and location data from the clergy’s homes, which were both bought for the low low price of several million dollars.
I’m thinking about doing a deep dive into this story later on (the specifics are fascinating, from a tech perspective), so let me know in the comments if that’s something you’d be into. Maybe I’ll paywall it or something.
The FBI Just Admitted It Bought US Location Data // Wired
Funny how these two articles literally came out within a day of each other. Not like, “ha-ha” funny, but like, “oh, this might be why regulation isn’t happening” funny.
To Drum Up Ad Revenue, Best Buy Opens Self-Serve Platform to Advertisers // Adweek
Atrium, Best Buy partner to co-develop hospital-at-home programming // Healthcare Dive
I have no qualms about Best Buy trying to bolster healthcare business, or Best Buy trying to bolster its targeted ads business. I have a few qualms about Best Buy trying to bolster these two sides of its business simultaneously, because at a certain point you know there’s going to be some weird ad targeting platform aimed at sick people who are stuck at home, and Best Buy’s gonna be the one to debut it because they have the data/infrastructure anyway. Tell me that’s not how this ends.
YouTube makes its case for the TV ad industry’s measurement makeover // Digiday
Back in January, Paramount, Warner Bro’s, Fox, and a few other big name broadcasters banded a task force together over their shared goal of fixing the shitshow that is modern TV advertising. You can read more about that shitshow here, but it boils down to an industry that can’t agree on how best to measure the ads that they run, and no real shared consensus about what an “effective” ad might look like. This week, YouTube decided to chuck its ideas into the ring. Digiday captured some initial responses to those ideas from industry folks. There’s some mild to moderate roasting in here, but my favorite is the guy who rightfully shut down YouTube’s ideas about how long a TV ad needs to be played on screen to fully register with a viewer. YouTube, apparently, thinks it’s two seconds:
Among YouTube’s principles is a call for the industry to use the Media Rating Council’s viewable impression standard — that 100% of ads be displayed on screen for at least two consecutive seconds to count as an impression — “as the basis for counting impressions, reach and frequency,” per the platform’s blog post.
“At the end of the day, our belief is that we need comparable standards that we all can agree to. The MRC has set forth the viewable impression, which we believe is a good standard that the industry should rally behind,” [Google’s Kate Alessi] said.
Members of the traditional TV industry seem to share a different belief. “Two seconds is pretty freaking — it’s too small. It’s stupid. I don’t think clients are going to want that,” said a TV network executive.
Sure, advertisers might not want that, but I, personally, am looking forward to a future where all TV ads are two-seconds long. Imagine how funny all those Sarah McLachlan spots would be.
You’re picturing it, right? Wouldn’t it be funny? No? Just me? Alright.
Notes on Privacy Extremism // It Started With A Tweet
I used to get angry notes from readers when I told them that the only thing they could do about our country’s tech privacy problems was “vote harder,” but I really never had any other ideas for where people could direct their rage/confusion/etc. This piece—written by someone working in the adtech trenches, no less—has plenty, for folks in the industry and out.
Airbnb Could Generate $1.2 Billion With Sponsored Listings and an Ad Platform by 2026 // Skift
The worst part about this blog, in my humble opinion, is how realistic it sounds. No notes.
No notes on this one either; I just figured you could use a snack for the road.
I always appreciated Charlie Warzel’s piece from a few years ago that all online activity, and specifically location data, should be considered health data, and should be treated as strictly as these emails and IP addresses were in this case.
https://www.nytimes.com/2019/08/13/opinion/health-data.html