Hacker News Reader

In the US, you can’t use personal health information for marketing purposes. If you can prove this link, a lot of very large organizations could potentially be in serious trouble for HIPAA violations.

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

Is there a feasible way to prove this link?

Subpoena Voltaren for documents? I don’t know that there really is.

The shop part (non-pharmacy) of a chemist isn’t a covered entity though right, so hipaa isn’t relevant at all?

Depends which entity collected and sold the data.

A pharmacy is a covered entity, a retail store is not. Does not appear this falls under HIPAA

Where I live in Canada, most pharmacies have a separate cash for the pharmacist and the rest of the store. I wonder if there are any differences in reporting rules for the two.

Is it personal health information if it's tied to an anonymous ID that contains no other details about you? I doubt the advertiser knows OP's name or address when they choose which ad to show.

> Is it personal health information if it's tied to an anonymous ID that contains no other details about you?

If it's deanonymized, is it then not personal information?

> I doubt the advertiser knows OP's name or address when they choose which ad to show.

Nonetheless, an advertisement is then targeted and it's well known that targeted advertisements reveal personal information.

re 2., this is a Bad Thing. I fully agree that neither Google nor anyone at the drugstore 'knows' about the purchase, but the basic problem is that we've built a commercial marketplace that spies on people, but the information about people is treated as privileged commercial data in an automated and unaccountable marketplace.

How does Google link the real life person who bought Voltaren at a store to the online account or fingerprint that browses the Internet?

I don’t think Google linked the account directly to the purchase. My guess would be that Google linked the account to the medication based on patterns from one of its many ways it gathers data.

* visits to websites about that medication

* visits to websites talking about symptoms for which the medication helps

* searches for the above

* I would not be surprised if Google picks up interests from other accounts using the same WiFi (or even other devices on close proximity)

* there are some scary stories about Google/FB/Amazon listening to conversations

So, then, completely different from what the GP suggested.

My comment was an expansion on GPs second bullet point. It’s not Google that knows about the purchase, but Google that “somehow” picked up contextual info from OPs environment linking OPs online identity to Voltaren as a product.

Edit: the purchase could have been involved somewhere in the chain but it’s not necessary.

> Your purchase landed some key about you in a bucket that was mixed and repackaged with many other keys that the advertiser knows as "keys recently interested in Voltaren."

There's not really that much ambiguity in this sentence from the second bullet point.

Unless my mental model of online advertising is wrong, your physical in-store purchase should not be landing you in some Google advertising bucket.

I completely agree that they should not show up. It looks like I went lightly over that sentence and focussed more on the one after:

> Some of those keys are related to people who bought it, or who searched for it, or more indirectly who lingered while reading a page with an ad for it...and in most cases are very short lived.

I think it's the last option. His phone probably heard him ordering Voltaren. It's also the simplest possibility (Ockham's razor).

I know because after discussing extremely rare chemicals at an officemate's desk, he began seeing ads for them. Neither of us had ever Googled or emailed anything related. It was a brand new idea for a brand new project which we had started working on that morning.

This is not the simplest possibility. Based on how often Google Home misunderstands the simplest queries, the tech is nowhere close to getting purchase intents out of random conversations. Besides that - do folks on hn really believe the „our phones are listening 24/7“ conspiracy theories?

I scrolled down further in the thread and it seems they do...

We don't want to believe but here we are. [ha, ha] Our robotic overlords don't even need to be sure, sounds-like is good enough, apply some exotic filters and odds to sell things go though the roof.

My funniest was talking with someone at work (who works for a different company) then when I got home facebook suggested adding them. That I didn't have a phone at the time made it extra comical. Plenty of other people work there, it never suggested those and there are no common contacts. How the CONSPIRACY works exactly I have no idea, the candidate theories are all to hard to imagine. (Like, I'm easy to track because I have no phone?)

I believe it is very possible.

My android phone often asks how did I like this or that shop. Sometimes I was just passing by those shops but on average the phone is quite correct which shops I have visited.

Google knows when you are in the pharmacy and might use a different routine interpreting ambient sounds when you are there. Voltarol (ibuprofen gel) is a distinct sound that even very lossy algorithm with low level of processing power can distinguish with a sufficient level of accuracy.

Agreed.

Can you prove neither of you Googled anything related? Surely either you or your office mate could have done further research later on, which would involve searching those chemicals online and browsing Web pages related to them?

Alternatively if someone near you overheard your conversation, and Googled it, then Google could link all of your locations together and conclude that you are all interested in the same thing. This is how Facebook has its creepy ability to indirectly predict what items you are interested in - usually someone near you searches for what you're talking about later on in the day, and it guesses that it's important to both of you.

I do most searches in an incognito window so it can't be browser history.

In some cases, it's even something like my wife joking about selling the car to a friend on WhatsApp, and suddenly Facebook show ads where you can sell the car. One time I told my wife to buy something at the grocery store (verbally, no text) and FB shows me the ad for that exact item.

Anecdotes like this are plausibly explained as https://en.m.wikipedia.org/wiki/Frequency_illusion

We had a similar thing happening to us: Wife and I have no kids and have no plans to have them. Kid related stuff is just not part of our everyday interactions. One day we visit some friend who are a couple with kids and in that visit we TALK about babies and rising kids and whatnot. Next day my wife (who has the FB app Installed), starts getting kid's diapers ads. I dont have FB app and I dont get those ads.

She uninstalled the app after that.

> I do most searches in an incognito window so it can't be browser history.

Incognito mode is mostly a convenience for you to do browsing without saving local history or cookies. It doesn't stop tracking.

I assume the fingerprint is different in incognito versus a regular window. But unless you are using VPN/adblockers/pihole/etc your browser is still executing third party JS and potentially sending tracking data to google using a plain https connection coming from your residential IP.

I can imagine it's not that hard for Google to link different requests from the same IP with slightly different fingerprint data to be coming from the same user.

edit: and for searches it is even easier, because you are communicating directly with google by performing the search, no tracker or JS necessary.

How does Google link the real life person who bought Voltaren at a store to the online account or fingerprint that browses the Internet?

Often, through the payment.

People use the same payment methods in the same stores over and over. This data is accumulated by the stores, and sold. if you signed up for a "points card" or some other gimmick to get 2¢ off something, the personal information you used when you signed up is added to the profile.

What you bought in the store is added to your profile (within legal limits in certain jurisdictions).

Some stores have devices that listen to your mobile phone's identifiers (wifi, Bluetooth, etc) and add that to your profile. Now the data profilers know what other stores you shop in. Some stores are experimenting with facial recognition (Walgreens). That gets added to your profile.

If you go to several in a single day, your route between the stores can be guessed. If you go to one or more places (stores, parking garages, streets that pass parking lots) that have sensors that read the NFC chips in your car's tires, then that can be added to your profile.

Now they know everywhere you go, everywhere you shop, everything you buy, how much you buy, how much you spend, your race, your gender, how you dress, what brands are displayed on your clothing, and any visible hair, moles, or tattoos.

That's just off the top of my head.

And people wonder, "Wow. I am a little scruffy. How did Facebook know to show me an ad for a razor?"

Hmmm....

Use cash!

Use cash!

It's a start. But unfortunately, doesn't get you out of a lot of the other surveillance methods.

Also, paying cash is yet another bit of entropy. Like using Firefox.

"Also, paying cash is yet another bit of entropy. Like using Firefox. "

I do not understand. I am typing this on Firefox. Felling the low entropy vibe!

That doesn't help if you use a loyalty card, which a lot of people do for the promos.

And even if you pay via card/phone ( which is literally multiple times faster and less hassle), the payment processor and card issuer don't know the individual items.

Don't use a loyalty card. Duh!

And don't bring a phone! Ofc the 2 of those combined makes pinpointing you even easier. Like taking candy from a baby.

There's a lot of online marketing companies that do a lot of work in this area. It's pretty easy to do if you have any kind of ID or token to link the data. It can be done with credit card numbers, a phone's location services, membership programs, coupons, etc. Here's some of the stuff Facebook does, which just scratches the surface of what is possible:

https://www.facebook.com/business/help/1150627594978290

please do go into detail about how data about an exact goods purchase that is linked to a specific person (ignoring the bunk about 'anonymization') can be regarded as having a legitimate business reason

Marketing is a legitimate business reason.

Other example, In the US, lots of jurisdictions have restrictions on ingredients. For example, dextromethorphan and pseudoephedrine.

If you are buying over the counter medicines that contain these, in some jurisdictions, you need to provide an ID.

> Marketing is a legitimate business reason.

Pervasive targeted marketing is not a legitimate business reason.

its legitimate. distasteful but legitimate.

The word you're looking for is "legal".

It's legal. It's illegitimate but legal.

The first three results on Google show the definition of legitimate as "allowed by law".

If you want to make a moral argument for why it shouldn't be allowed, then do that.

The etymology of “legitimate” and “legal” are shared but they have very different meanings. If you are not a native speaker of English then these connotations can be hard to discern since word meanings are fluid and regional, but at least in the US the meanings are quite different.

It's legal, but not necessarily legitimate. Informally, people use the latter terms to articulate their view of what the law should be, rather than what it is.

why use a word with a known definition to try to mean the near opposite? its confusing.

if you think the thing sucks, just say it sucks.

Many words have multiple definitions, as you are surely aware. Legitimate is one of them.

yep, all the definitions of legitimate equivocate it to legal/lawful.

except here, y'all want it to mean not-lawful.

I'm legitimately not smart enough to continue this conversation.

Depends if morals matter.

If right and wrong are important then "legitimate" encompass them. So it s possible for something to be legal but not legitimate.

There are not a lot of legal but absolutely immoral (the other way, illegal but legitimate - plenty) the actions of the FANG IMO definitely fall into the category of legal but illegitimate.

Because to me good and evil are important considerations

That's just not true. Please don't make things up.

Here are two (abridged) definitions from the Oxford dictionary:

1. conforming to the law or to rules

2. make legitimate; justify or make lawful.

You're choosing to ignore the verb make in the second definition, describing the act of conferring legitimacy on something, which necessarily implies that it was previously lacking.

The second example literally says "make legitimate". You're trying too hard to be right. :D

On the contrary, pervasive targeted marketing is exactly a legitimate business reason in the context of increasing revenue efficiently, as most corporations want to do.

Selling cocaine is a great way to efficiently increase revenue, but it's not a legitimate way

Selling cocaine is a legitimate way to increase revenue. If the cocaine is real (i.e you aren't selling flour) then why wouldn't it be legitimate?

It might not be legal, but CocaCola is allowed to import coca leaves by the millions.

Don't be ridiculous! It would be absurd for the Coca Cola company to be allowed to directly import coca leaves for use in their "secret" recipe. Instead, it's an intermediary (the "Stepan Company") who imports the 200,000 lbs of coca leaves each year, removes the cocaine for pharmaceutical use, and then sells the remaining "flavor" extracts to Coca Cola: https://www.nytimes.com/1988/07/01/business/how-coca-cola-ob...

(which is to say, thanks for encouraging me to learn about this)

I think we're getting confused on word meanings here. Legitimate is far too vague a work. I'm trying to get at the idea that just because something would WORK doesn't make it ok to do. There is what is possible under capitalism (anything legal) and then there is what is RIGHT. Selling cocaine isn't JUST illegal, it's also probably wrong due to it's addictive properties. Similarly, selling people's data and tracking people without their consent is legal, but it's also wrong in most people's opinion.

> Remember that when you purchase something, the data about the purchase is BOTH yours AND the entity from whom you made the purchase.

This is wrong. Because in my case the information is highly personal, while in the shop owner's case it's just business information.