The VICE Channels

Facebook Is Mining Private Data from Cancer Organizations, New Lawsuit Alleges

Mar 18 2016 4:15 PM
Facebook Is Mining Private Data from Cancer Organizations, New Lawsuit Alleges

Photo by Sean Locke via Stocksy

A group of cancer and healthcare companies claim that Facebook is illegally collecting data from their users through its use of cookies.

A new class action lawsuit has been filed against Facebook, alleging that it collects private medical information from well-respected cancer organizations.

The suit claims that Facebook mines data from websites such as through its use of cookies. When users visit a site that has a relationship with Facebook, such as, Facebook allegedly collects data on that visit, including any URLs they visit within that site or what they enter into the site's search bar. According to the suit, filed by the law firm of Kiesel Law LLP, Facebook "commandeers" their browser and sends data to Facebook milliseconds before the site appears on your screen. The user has no idea the information has been gathered.

"When you're searching private medical information, you don't realize it's being sent to Facebook," says Kiesel Law LLP partner Paul Kiesel. "If for example, I search for information on stomach cancer, they're going to know that either—God forbid—I have stomach cancer, or that I am interested in finding more information. Either way it is private medical information."

According to the suit, any site with a Facebook "like" button can potentially send browsing data to Facebook, possibly without the knowledge of the web developers. However, Kiesel Law LLP makes clear in its suit that many sites do not share data with Facebook. "For example, the websites for the Mayo Clinic and Johns Hopkins Medicine include a small Facebook icon on nearly every page, but do not permit Facebook to track user communications," the brief states.

Read More: England's Most Outrageous College Feminist Facebook Group

As stated by a 2015 study on internet privacy cited in the complaint, medical information is the second most valuable type of data to be culled from users. After all, what motivates someone to spend cold hard cash better than their own health? "Look at the nightly news and you can see how much [the pharmaceutical industry is] spending on marketing," says Kiesel. "If they could target that marketing, that's enormously valuable to the business." According to the lawsuit, targeted ads produce 670 percent more clicks than non-targeted ads, and are twice as likely to make someone make a purchase.

Photo via Flickr user Spencer E Holtaway

Medical data is also valuable because it is so hard to get. Companies are not allowed to gather or share medical information without express authorization, because of the Health Insurance Portability & Accountability Act (HIPAA). Enacted in 1996, HIPAA sets ground rules for the medical industry that regulate the sharing of medical information.

Under HIPAA, medical information cannot be shared unless it is for a specific purpose. The purpose must be disclosed to the individual, with an expiration date, and with notification of the individual's right to revoke their authorization. The suit alleges that Facebook's data policies do not meet any of those guidelines.

Facebook has not disclosed what it uses this information for, but Keisel is optimistic that this lawsuit will bring it to light. "Discovery through litigation will bear out how it's used, whether it's banner ads, direct marketing, all that is possible. But what matters most is your right to privacy."

It is unclear whether and the other wesbites named in the suit—,, Adventist Health System, BJC Healthcare, the Cleveland Clinic, and University of Texas MD Anderson Cancer Center—were aware of the data mining done at the hands of Facebook. In an email to the Courthouse News Service, a Facebook representative said the suit "is without merit," and that they will defend themselves "vigorously."

More from VICE

The Latest