In a very comprehensive post from the Federal Trade Commission’s Office of Technology, the FTC takes what it calls “[a] deep dive into the technical side of FTC’s recent cases on digital health platforms, GoodRx & BetterHelp.”
As most readers know, the FTC recently took enforcement action against GoodRx and BetterHelp, two digital healthcare platforms, for allegedly sharing user health data with third parties for advertising. Both cases highlighted the use of third-party tracking pixels, which enable platforms to amass, analyze, and infer information about user activity. The remedies in GoodRx and BetterHelp included bans that place limits on whether and how certain user information may be disclosed for advertising. For GoodRx and BetterHelp, this included a ban on the sharing of health information for any advertising purposes, and the BetterHelp order further bans the disclosure of other personal information for re-targeting. Here’s what the FTC says about pixel tracking:
What is pixel tracking?
Tracking pixels have evolved from tiny, pixel-sized images on web pages for tracking purposes to include a broad range of HTML and JavaScript embedded in web sites (and email). Tracking pixels can be hidden from sight and can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site. Businesses often want to use them to track consumer behavior (pageviews, clicks, interactions with ads) and target ads to users who may be more likely to engage or purchase something based on that prior online behavior.
How does it work?
Companies interested in pixel tracking must first choose a pixel tracking provider. The provider will then generate a tracking pixel, a small piece of code that will be placed into the website or ad and define their tracking goals such as purchases, clicks, or pageviews. The company will then use some version of a dashboard or interface with the provider to track, test, and refine their settings.
Pixel tracking can be monetized several ways. One way to monetize pixel tracking is for companies to use the tracking data collected to improve the company’s own marketing campaigns. The data can be used to target more specific audiences with ads and other marketing messages. Another is that companies can monetize the data collected by further optimizing their own ad targeting systems and charging other companies to use its advertising offerings.
What are the FTC’s stated concerns?
-
- Widespread usage of invisible pixels with no way for consumers to avoid.
- Lack of clarity around data collection and use.
- Personal information may not be effectively removed.
* * *
Interestingly, the FTC does not claim it knows all there is to know about pixel tracking. In its post, the FTC took the unusual step of asking researchers and journalists to help it answer the following questions about pixel tracking (even as it brings enforcement actions regarding pixel tracking):
- Industry conditions and competitive dynamics.
- Which pixel providers are particularly competitively significant for various tracking use cases, and how has competition in this industry evolved?
- How prevalent is pixel tracking relative to other forms of online tracking?
- What broader impact does pixel tracking have on competitive conditions in online tracking and advertising?
- Consumer harms.
- What unique consumer harms, financial or otherwise, can result from the use of pixel tracking technologies?
- How might the harms of pixel tracking technologies differ for certain communities?
- Business rationales.
- Does data collection from pixel tracking offer business advantages or disadvantages to companies, relative to alternative forms of data collection?
- What financial impact does pixel tracking have on advertising networks, data brokers, social networks, advertisers, and other parties?
- Data processing, use, and monetization.
- To what extent do first parties—including companies with diverse businesses practices—internally share data to use for purposes that consumers might not reasonably expect?
- For parties that obtain data via pixel tracking, what processing do they perform on this data, and how do they use and monetize this data beyond direct ad targeting?
- Do other platforms that handle sensitive data (e.g., health, financial, location, etc.) make use of third-party tools like pixel tracking in ways that risk exposing that data?
- Data retention and management.
- What is the minimum data retention period necessary to provide services based on pixel tracking?
- What are the circumstances that inform retention periods?
- How do companies keep track of the data they receive from pixels?
