A 2023 Study by Joanne Kim at Duke University, found that data brokers are marketing highly sensitive data on individuals’ mental health conditions on the open market, with seemingly minimal vetting of customers and seemingly few controls on the use of purchased data.

Help Us Educate Patient Communities About This Practice.

We made a shareable infographic to help educate patient communities about this issue, and hope you will share the link to the study to help us raise awareness of the practice – which is unethical and harmful to people seeking social support online.

Key Findings From Duke’s Study:

• The Issue: Some data brokers are advertising and offering to sell highly sensitive data on individuals’ mental health conditions on the open market, with seemingly minimal vetting of customers and seemingly few controls on the use of purchased data.
  
• How Common is It? 26 of the 37 contacted data brokers responded to inquiries about buying mental health data, and 11 firms were ultimately willing and able to sell the requested mental health data.
  
• Is the Data Identifiable*? Whether this data would be de-identified or aggregated before providing to the client was often unclear, and many of the studied data brokers at least seemed to imply that they have the capabilities to provide identifiable data.
  
• Who Can Buy Mental Health Data? The 10 most engaged data brokers asked about the purpose of the purchase and the intended use cases for the data; however, after receiving that information (verbally or in writing) from the author, those companies did not appear to have additional controls for client management, and there was no indication in emails and phone calls that they had conducted separate background checks to corroborate the author’s (non-deceptive) statements.
  
• What Type of Mental Health Information is Available for Purchase? The 10 most engaged brokers advertised highly sensitive mental health data on Americans, including data on those with depression, attention disorder, insomnia, anxiety, ADHD, and bipolar disorder as well as data on ethnicity, age, gender, zip code, religion, children in the home, marital status, net worth, credit score, date of birth, and single parent status.
  
• How Much Does It Cost to Buy Mental Health Data? Pricing for mental health information varied: one data broker charged $275 for 5,000 aggregated counts of Americans’ mental health records, while other firms charged upwards of $75,000 or $100,000 a year for subscription/licensing access to data that included information on individuals’ mental health conditions.
  
• Can Individuals Opt Out or Correct their Information? Based on an evaluation of privacy policies, data brokers seem collectively less willing to provide access and disclosure to their customers and users about the collection or correction of personal data.
  
  *Note that it is increasingly possible to re-identify even de-identified and aggregate data. For more on this topic, see this article from The Markup.
  
  Additional Concerning Findings from Duke’s Study:
  
• One company that the author was in contact with depicted their firm as an advertising tech firm. The sales representative offered to ask their manager about coordinating a data deal on information from organizations they advertise for on behalf of the author.
• Data broker 1 emphasized that the requested data on individuals’ mental health conditions was “extremely restricted” and that their team would need more information on intended use cases—yet continued to send a sample of aggregated, de-identified data counts.
• After data broker 1 confirmed that the author was not part of a marketing entity, the sales representative said that as long as the author did not contact the individuals in the dataset, the author could use the data freely.
• Data broker 2 implied they may have fully identified patient data, but said they were unable to share this individual-level data due to HIPAA compliance concerns. Instead, the sales representative offered to aggregate the data of interest in a de-identified form.
• Data broker 4 was the most willing to sell data on depressed and anxious individuals at the author’s budget price of $2,500 and stated no apparent, restrictive data-use limitations post-purchase.
• Data broker 4 advertised highly sensitive mental health data to the author, including names and postal addresses of individuals with depression, bipolar disorder, anxiety issues, panic disorder, cancer, PTSD, OCD, and personality disorder, as well as individuals who have had strokes and data on those people’s races and ethnicities.
• Two data brokers, data broker 6 and data broker 9, mentioned nondisclosure agreements (NDAs) in their communications, and data broker 9 indicated that signing an NDA was a prerequisite for obtaining access to information on the data it sells.
• Data broker 8 often made unsolicited calls to the author’s personal cell. If the author was delayed in responding to an email from data broker 8, the frequency of calls seemed to increase.
• Some brokers imposed data use limitations on the possible sale of people’s mental health information, ranging from “single-use” (which usually pertains to mailing purposes) to “multi-use” (which means the dataset is available for one year after purchase) based on the firm and the product purchased.