Case Study
Medical Information Disclosure and Wiretapping Laws Prompt Advertising Tracking Investigation for Health Care Company
A growing number of lawsuits allege advertising analytics trackers and website pixels used to collect information violate data privacy protections under existing U.S. federal and state regulations. A leading U.S. health care provider became subject to class action litigation arguing violations of statelevel medical information sharing disclosure and wiretapping laws. FTI Technology’s adtech privacy experts were engaged to perform in-depth analysis in support of a formalized and defensible investigation of the company’s adtech practices, and remediation in response to the litigation.
Situation
Advertising trackers embedded into the backend of websites and applications often gather and send information to third parties, in some cases including personally identifiable information. In this matter, a class action suit alleged violations of state-level medical information sharing disclosure laws, as well as federal and state-level wiretapping violations.
As with most litigations, complaints are about what happened in the past. For this health care organization, the complaint covered five years and a complicated, non-centralized network of sites managed by multiple departments. In addition to intense court scrutiny and the scale of the class action litigation, this case faced several complexities, including a wide range of violations and in scope data types relating to them. These included:
- Health care-related data privacy violations and breaches of data subject rights, involving complaints that advertising trackers on the company’s sites had wrongfully collected and shared personal health information.
- Charges under federal wiretapping laws, the Electronic Communications Privacy Act and Federal Wiretap Act, as well as state-level laws alleging intersection of complainants’ data in transit.
- Video Privacy Protection Act violations, under arguments that the site’s trackers were illegally collecting, storing and sharing information about the video content site visitors were viewing.
Our Role
FTI Technology’s Information Governance, Privacy & Security practice has delivered dozens of remediations, litigations and high-profile Federal Trade Commission actions concerning the use of adtech and data privacy violations. Having worked on some of the first-ever cases of this kind, FTI Technology maintains a highly technical database of ad trackers, which has been mapped to additional information about third-party entities that collect and use data. This resource enables the team to quickly, accurately and defensibly support clients in analyzing their ad tracking activity and potential exposures.
FTI Technology’s experts defined the scope of collection and analysis, working to identify the in-scope domains, sites and mobile platforms requiring review. This informed a map of user journeys, which the team used to conduct mock scenarios of site visits. By completing user journeys, such as filling out forms, clicking on areas of the various pages and reviewing any notices provided, FTI Technology applied its proprietary platform database to track what was data was being collected and sent to a server.
The team also analyzed the client’s complex web of sites and applications and created a timeline to illustrate what trackers were live or active when and what they were configured to do on two separate platforms, Google Tag Manager and Adobe Launch.
FTI Technology organized resulting data and analysis on a dashboard to deliver a report of findings, which could serve as evidence in the litigation and provide the company with information to remediate any instances of data misuse.
Our Impact
The team’s unmatched technical knowledge and expertise delivered defensible evidence for the client’s numerous litigations and charges.
The analysis and detailed reporting about the ad trackers helped make sense of complex data and provide counsel with an informed strategy, enabling the organization to speak authoritatively to the tracking activity across its many websites over the complete five-year period.