Over the last couple months, work I did over the last few years has resurfaced in some fun and interesting ways.
GoodRX, the FTC, and Sharing Data With Advertisers
In February 2023, the FTC fined GoodRX 1.5 million dollars for sending consumer health data to Facebook, Google, and Braze. This news is both satisfying and frustrating: satisfying in the sense that the FTC actually acted and held GoodRX to account, and frustrating because GoodRX had 766.6 million in revenue in 2022, so 1.5 million is effectively a rounding error.
The FTC complaint (pdf download) cites a “consumer watchdog” that publicly revealed GoodRX’s practice in February 2020, and to that I say, woof. I was the lead researcher on that work when I was at Consumer Reports, and a subset of the findings from that work were first published in February 2020. The public reporting effectively summarizes the findings, but left out technical details about how GoodRX sent information to advertising companies. The technical details make it pretty clear that the way adtech is structured creates the conditions for this problem. GoodRX was using adtech the way adtech is designed, and that architecture sent personal health information to multiple advertisers, including Facebook and Google.
Direct to Consumer DNA Tests
In the spring of 2021, I ran some tests (with the help of my dog – true story) on direct to consumer DNA products. This work was originally reported by Catherine Roberts at Consumer Reports. These kits have a lot of the same problematic issues as GoodRX, and these problems are exacerbated when people consent to what these companies try and sell as “research.”
Recently, I had the opportunity to talk with Rachael Brown at ABC News Australia who was working on a story about relatives who discovered one another via direct to consumer DNA testing. Her piece is beautifully crafted, and humanizes the privacy implications in a way most journalists writing about privacy fail to do. The family has ties back to the Holocaust, and in the process of telling this story, she highlights issues with consent, unclear terms, and how opaque the process can be even for people getting a family-altering experience. My small contribution to the piece was made possible via some drool generously donated by Door, the Privacy Hound, pictured above.
The piece is available on the web, via Apple podcast, and as a text-based version. I have both read the story and listened to it, and while I generally prefer text to audio, in this case the audio version brings the details to life in what is, for me, a more compelling narrative.