“The data shared included:
- drug names entered into Drugs.com were sent to Google’s ad unit DoubleClick.
- symptoms inputted into WebMD’s symptom checker, and diagnoses received, including “drug overdose”, were shared with Facebook.
- menstrual and ovulation cycle information from BabyCentre ended up with Amazon Marketing, among others.
- keywords such as “heart disease” and “considering abortion” were shared from sites like the British Heart Foundation, Bupa and Healthline to companies including Scorecard Research and Blue Kai (owned by software giant Oracle).
In eight cases (with the exception of Healthline and Mind), a specific identifier linked to the web browser was also transmitted — potentially allowing the information to be tied to an individual — and tracker cookies were dropped before consent was given. Healthline confirmed that it also shared unique identifiers with third parties.
None of the websites tested asked for this type of explicit and detailed consent.”