Sheffield City Council claims to offer “free and confidential support” to people suffering from alcohol addiction. The UK council doesn’t keep information on who’s looking for such support quite so confidential. The council shares information on who visits that web page with at least 25 different data collection companies, among them eight data brokers and nine advertising auction companies including Google, according to a report from Brave Software.
Sheffield is far from unique; Brave found that nearly every council (region of local government) in the UK shares data on who visits sensitive web pages. Around half of UK councils share this data by allowing real-time bidding (RTB) for advertising on their page, which shares personal data with hundreds of companies seeking to focus advertising on specific demographics. Last year, the UK’s Information Commissioner’s Office condemned RTB as likely to cause “high risk to the rights and freedoms of individuals,” yet 198 local government councils continue to permit the practice. Meanwhile, 23 councils allow data brokers to collect data on who browses the government websites.
UK citizens use council websites to register life events such as moving, getting married, or having a baby, as is required by law. The Brave report shows that this information is generally vulnerable to third party surveillance. The Sheffield City Council page on alcoholic treatment is just one example of the government sharing data on those researching medical information; Ealing council shares data on those who visit the local government web page on children’s disability benefits with 21 data collection companies, according to the report. Meanwhile, it found Enfield council in London shares data on who’s looking for financial assistance. This information can be used to inform which citizens are profiled as “budgeters on benefits” by the Council Advertising Network.
Brave notes that the councils typically allow third parties to access the unique ID codes of people browsing their web pages, as well as the location, device details, and occasionally IP address. Data brokers collect vast amounts of data, which combine unique ID codes with other personal information, usually including name, address, age, income, and interests. Council websites allowing third parties access to users’ ID codes means that a person’s interest in alcoholism or disability services could be added to these profiles.
“This is a remarkable breach of public trust. A citizen should be able to engage with their local government without fear of private businesses surveilling the exchange,” Johnny Ryan, chief policy officer at Brave, told Quartz.
UK councils aren’t the only websites who share such personal information. In 2017, the Verge showed how misleading rehab ads are targeted to people who Google addiction-related terms. Ryan previously told Quartz that cookies are the online equivalent of having a sticker permanently stuck to your back that reads “interested in substance abuse.” Those who wish to research sensitive issues anonymously online can use a VPN and an ad blocker; Brave recommends its own browser, which blocks all ads and website trackers.
“No personal data is sold on to ‘data brokers’ – Marketing agencies used for the programmatic side of our advertising are under contract to utilise the data collected by third-party cookies (in this case, the IP address given for each new browsing session) for advertising purposes only,” a spokesman for Ealing council who identified himself only as “Jack” wrote in an email to Quartz.
Sheffield City said it used cookies in line with data protection laws. “We take the protection of our customer’s personal data very seriously and treat it confidentially, and as such do not use cookies to sell personal data to third parties,” Mark Gannon, director of business change and information solutions at the council, said in a statement. Gannon said Sheffield only shared anonymous data, but did not reveal how it ensured anonymity. Data called “anonymous” is typically merely pseudonymised, meaning it’s attached to a unique ID or IP address rather than a name, and is easy to de-anonymize. Enfield council did not respond to requests for comment.
Update (Feb. 13, 2020): This article has been updated to include the statement about data brokers from the Ealing council spokesperson