Newswise — ITHACA, N.Y. – Internet trackers are more likely to follow people who visit popular health sites to other types of sites, suggesting that advertisers might be more likely to target people based on sensitive health information than previously understood.

A new study from Cornell Tech examined how the order in which users visit 15 major health, education and new sites affects the way third-party trackers follow them around the internet. Although the health sites may have fewer trackers than other types of sites, those trackers are more persistent in following page visitors, the researchers found.

“The health care context is really appealing to advertisers, since it’s such sensitive data that allows advertisers to know a lot about you, or even manipulate you to click on an ad that relates to your health problem,” said Ido Sivan-Sevilla, a postdoctoral fellow at Cornell Tech’s Digital Life Initiative and first author on the paper. The paper was co-authored by Helen Nissenbaum, professor of information science, and master’s students Wenyi Chu and Xiaoyu Liang.

In the study, researchers sought to empirically investigate whether social contexts – the types of websites people are visiting – matter for trackers. They based their research questions on Nissenbaum’s theory of privacy as contextual integrity. According to the theory, privacy demands appropriate flows of information – for example, the information that flows between friends is subject to different rules and norms from the information that flows between an employee and a supervisor.

In the context of this study, tracking people from a health site to a news site is a violation of privacy according to the theory of contextual integrity.

Third-party trackers commonly remember visitors based on unique user identifiers stored via cookies, small pieces of information placed in our internet browsers. The researchers conducted six experiments representing all possible browsing sequences between health, education and news contexts. For each experiment, the researchers determined which user identifiers from the first context were persistently used by trackers in the following two contexts.

Researchers found that users are followed among all three types of social contexts, between every pair of websites they studied. They also found that health care websites are most likely to link users’ identifiers to other types of websites.

The paper, “Unaccounted Privacy Violation: A Comparative Analysis of Persistent Identification of Users Across Social Contexts,” will be presented at the Federal Trade Commission’s PrivacyCon 2020.

For more information, see this Cornell Chronicle story.  

Other Link: Federal Trade Commission’s PrivacyCon 2020