Health service providers Medmate Australia Pty Ltd (Medmate) and Monash IVF Pty Ltd (Monash) have been found to have interfered with the privacy of users whose sensitive information was collected via third-party tracking pixels, according to two separate determinations by the Australian Privacy Commissioner.
Privacy Commissioner Carly Kind found Monash IVF had deployed third‑party tracking technologies on fertility‑related webpages, resulting in the disclosure of information that revealed sensitive reproductive health information to third‑party advertising platforms.
Meanwhile, Medmate’s use of third‑party tracking technologies on its telehealth and pharmacy webpages had also resulted in the disclosure of health‑related information to third‑party providers, due to inadequate protective measures.
The pixels transmitted information about users’ interactions with health-related webpages and online services to advertising and analytics platforms, enabling those third parties to infer sensitive information about an individual’s health interests and circumstances.
While the pixel technologies were intended for marketing and website performance purposes, the OAIC found they resulted in health information being disclosed to third parties in circumstances that breached the Privacy Act.
The determinations conclude the Office of the Australian Information Commissioner’s year-long investigation into how Medmate and Monash collected sensitive information on their websites which provide telehealth and fertility services respectively.
The Privacy Commissioner’s decision establishes that the use of tracking pixels to track website visitors to health-related websites – and to facilitate targeted advertising activities through third-party digital marketing platforms – amounted to a collection of sensitive information for which the website provider must obtain users’ consent.
The Privacy Commissioner said Australians had “become accustomed” to pervasive online tracking and targeted advertising, “but that doesn’t mean that they’re comfortable with it.”
“In particular when it comes to targeted advertising based on sensitive data, our community attitudes research shows that 9 in 10 Australians consider it neither fair nor reasonable to be targeted on the basis of their sensitive health data.”
“Today’s decision establishes that the advanced technology used for tracking and targeting in the online realm still has to be used in compliance with the Privacy Act. That means website providers must obtain consent where they’re using tracking pixels to collect sensitive information, such as data on health, political opinions, race or ethnicity.”
Published alongside the determinations is a separate report on the OAIC’s inspection of 50 health service provider websites.
Your life, pixelated: how tracking pixels watch your every click, outlines findings, case studies and recommendations to help individuals and organisations manage the privacy risks of third-party tracking pixels.
The OAIC encouraged all organisations covered by the Privacy Act to review their usage of third-party tracking pixels and ensure proper understanding of the relevant obligations under the Privacy Act 1988.
Add Comment