In 2019 at Privacy International, I led a project looking into online tracking and profiling practices of websites addressing depression. The aim of the project, named Your Mental Health for Sale, was to expose how intimate data about us can be collected, shared and processed by third parties, without users’ consent or knowledge.
I conducted technical research and co-produced a report exposing the abusive data collection practices of some publishers including sharing answers to depression tests with third parties without informing users and loading marketing trackers before consent.
Following this work, a number of websites mentioned in the report changed their practices to reduce or eliminate data sharing of intimate information with third-parties.
This research served as the basis for a complaint against Doctissimo to French data authority CNIL, one of the worst offenders that did not change its practices following the report. This complaint led to the company being fined 380,000€ in May 2023 for GDPR infringement.
This work obtained coverage in major newspapers and was presented at Blackhat London 2019 (slides)
Media coverage:
Recording of the Blackhat presentation:
Roles:
- Project manager
- Researcher
Tech tools used:
- HTTPToolkit for network interception and analysis
- WebXRay (now defunct) for cookie and requests classification