{"id":8561,"date":"2021-10-24T10:00:01","date_gmt":"2021-10-24T10:00:01","guid":{"rendered":"http:\/\/TheNextWeb=1370746"},"modified":"2021-10-24T10:00:01","modified_gmt":"2021-10-24T10:00:01","slug":"nonprofit-websites-are-riddled-with-ad-trackers","status":"publish","type":"post","link":"https:\/\/www.londonchiropracter.com\/?p=8561","title":{"rendered":"Nonprofit websites are riddled with ad trackers"},"content":{"rendered":"\n<p>Last year, nearly <a href=\"https:\/\/www.plannedparenthood.org\/uploads\/filer_public\/67\/30\/67305ea1-8da2-4cee-9191-19228c1d6f70\/210219-annual-report-2019-2020-web-final.pdf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">200 million people<\/a> visited the website of Planned Parenthood, a nonprofit that many people turn to for very private matters like sex education, access to contraceptives, and access to abortions. What those visitors may not have known is that as soon as they opened plannedparenthood.org, some two dozen ad trackers embedded in the site alerted a slew of companies whose business is not reproductive freedom but gathering, selling, and using browsing data.<\/p>\n<p>The Markup ran <a href=\"https:\/\/themarkup.org\/blacklight?url=www.plannedparenthood.org\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Planned Parenthood\u2019s website through our Blacklight tool<\/a> and found 28 ad trackers and 40 third-party cookies tracking visitors, in addition to so-called \u201csession recorders\u201d that could be capturing the mouse movements and keystrokes of people visiting the homepage in search of things like information on contraceptives and abortions. The site also contained trackers that tell Facebook and Google if users visited the site.<\/p>\n<p>The Markup\u2019s scan found Planned Parenthood\u2019s site communicating with companies like Oracle, Verizon, LiveRamp, TowerData, and Quantcast\u2014some of which have made a business of assembling and selling access to masses of digital data about people\u2019s habits.<\/p>\n<p>Katie Skibinski, vice president for digital products at Planned Parenthood, said the data collected on its website is \u201cused only for internal purposes by Planned Parenthood and our affiliates,\u201d and the company doesn\u2019t \u201csell\u201d data to third parties.<\/p>\n<p>\u201cWhile we aim to use data to learn how we can be most impactful, at Planned Parenthood, data-driven learning is always thoughtfully executed with respect for patient and user privacy,\u201d Skibinski said. \u201cThis means using analytics platforms to collect aggregate data to gather insights and identify trends that help us improve our digital programs.\u201d<\/p>\n<p>Skibinski did not dispute that the organization shares data with third parties, including data brokers.<\/p>\n<p>A <a href=\"https:\/\/themarkup.org\/blacklight?url=www.ppgulfcoast.org\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Blacklight scan of Planned Parenthood Gulf Coast\u2014<\/a>a localized website specifically for people in the Gulf region, including Texas, <a href=\"https:\/\/www.nytimes.com\/2021\/09\/10\/us\/politics\/texas-abortion-law-facts.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">where abortion has been essentially outlawed<\/a>\u2014churned up similar results.<\/p>\n<p>Planned Parenthood is not alone when it comes to nonprofits, some operating in sensitive areas like mental health and addiction, gathering and sharing data on website visitors.<\/p>\n<p><a href=\"https:\/\/themarkup.org\/blacklight\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Using our Blacklight tool<\/a>, The Markup scanned more than 23,000 websites of nonprofit organizations, including those belonging to abortion providers and nonprofit addiction treatment centers. The Markup used the <a href=\"https:\/\/www.irs.gov\/charities-non-profits\/exempt-organizations-business-master-file-extract-eo-bmf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">IRS\u2019s nonprofit master file<\/a> to identify nonprofits that have filed a tax return since 2019 and that the agency <a href=\"https:\/\/github.com\/the-markup\/investigation-nonprofit-privacy\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">categorizes<\/a> as focusing on areas like mental health and crisis intervention, civil rights, and medical research. We then examined each nonprofit\u2019s website as publicly listed in <a href=\"https:\/\/www.guidestar.org\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">GuideStar<\/a>. We found that about 86 percent of them had third-party cookies or tracking network requests. By comparison, when The Markup did a <a href=\"https:\/\/themarkup.org\/blacklight\/2020\/09\/22\/blacklight-tracking-advertisers-digital-privacy-sensitive-websites\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">survey of the top 80,000 websites<\/a> in 2020, we found 87 percent used some type of third-party tracking.<\/p>\n<p>About 11 percent of the 23,856 nonprofit websites we scanned had a Facebook pixel embedded, while 18 percent used the Google Analytics <a href=\"https:\/\/support.google.com\/analytics\/answer\/2611268\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\u201cRemarketing Audiences\u201d<\/a> feature.<\/p>\n<p>The Markup found that 439 of the nonprofit websites loaded scripts called session recorders, which can monitor visitors\u2019 clicks and keystrokes. Eighty-nine of those were for websites that belonged to nonprofits that the IRS categorizes as primarily focusing on mental health and crisis intervention issues.<\/p>\n<p>\u201cAs a user of this website, by sharing your information with them, you probably don\u2019t assume that this sensitive information is shared with third parties and definitely don\u2019t assume that your keystrokes are recorded,\u201d Gunes Acar, a privacy researcher who copublished a <a href=\"https:\/\/freedom-to-tinker.com\/2017\/11\/15\/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">2017 study on session recorders<\/a>, said. \u201cThe more sensitive the website is, the more worried I am.\u201d<\/p>\n<p>Tracy Plevel, the vice president of development and community relations at Gateway Rehab, one of the nonprofits with session recorders on its site, said that the nonprofit uses trackers and session recorders because it needs to stay competitive with its larger, for-profit counterparts.<\/p>\n<p>\u201cAs a nonprofit ourselves, we are up against for-profit providers with large advertising budgets as well as the addiction treatment brokers who grab those seeking care with similar online advertising tactics and connect them with the provider who is offering the greatest \u2018sales\u2019 compensation,\u201d Plevel said. \u201cAdditionally we know user experience has a big impact on following through on treatment. When someone is ready to commit to treatment, we need to ensure it [is] as easy as possible for them before they get frustrated or intimidated by the process.\u201d<\/p>\n<p>Other nonprofits had a significant number of trackers embedded on their sites as well. The Markup <a href=\"https:\/\/themarkup.org\/blacklight?url=theclinickc.org\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">found 26 ad trackers and 50 third-party cookies<\/a> on The Clinic at Sharma-Crawford Attorneys at Law, a Kansas City legal clinic that represents low-income people facing deportation.<\/p>\n<p>Rekha Sharma-Crawford, the board president of The Clinic, wrote in an emailed statement, \u201cWe take privacy and security concerns very seriously and will continue to work with our web provider to address the issues you have identified.\u201d<\/p>\n<p>Save the Children, a humanitarian aid organization founded more than 100 years ago, had 26 ad trackers and 49 third-party cookies. March of Dimes, a nonprofit started by President Franklin D. Roosevelt that focuses on maternal and infant care, had more than 29 ad trackers on its site and 58 third-party cookies. City of Hope, a Californian cancer treatment and research center, had 25 ad trackers and 47 third-party cookies.<\/p>\n<figure class=\"post-image post-mediaBleed aligncenter\"><img decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-1370760 js-lazy\" src=\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021.jpg\" alt=\"Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021\" width=\"1578\" height=\"660\" sizes=\"(max-width: 1578px) 100vw, 1578px\" data-srcset=\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021.jpg 1578w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-280x117.jpg 280w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-270x113.jpg 270w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-540x226.jpg 540w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-1536x642.jpg 1536w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-796x333.jpg 796w\"><figcaption>Credit: <a href=\"https:\/\/themarkup.org\/blacklight\/2021\/10\/21\/nonprofit-websites-are-riddled-with-ad-trackers\" target=\"_blank\" rel=\"noopener noreferrer\">The Markup<\/a><\/figcaption><figcaption><a href=\"https:\/\/thenextweb.com\/news\/nonprofit-websites-riddled-ad-trackers-syndication#\" data-url=\"https:\/\/twitter.com\/intent\/tweet?url=https%3A%2F%2Feditorial.thenextweb.com%2Fprivacy%2F2021%2F10%2F24%2Fnonprofit-websites-riddled-ad-trackers-syndication%2F&amp;via=thenextweb&amp;related=thenextweb&amp;text=Check out this picture on: Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021\" data-title=\"Share Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021 on Twitter\" data-width=\"685\" data-height=\"500\" class=\"post-image-share popitup\" title=\"Share Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021 on Twitter\"><i class=\"icon icon--inline icon--twitter--dark\"><\/i><\/a>Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021<\/figcaption><noscript><img decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-1370760\" src=\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021.jpg\" alt=\"Results of Blacklight scans of the homepages of Save the Children, March of Dimes, and City of Hope, performed on Oct 19 2021\" width=\"1578\" height=\"660\" srcset=\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021.jpg 1578w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-280x117.jpg 280w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-270x113.jpg 270w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-540x226.jpg 540w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-1536x642.jpg 1536w, https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2021\/10\/Results-of-Blacklight-scans-of-the-homepages-of-Save-the-Children-March-of-Dimes-and-City-of-Hope-performed-on-Oct-19-2021-796x333.jpg 796w\"><\/noscript><\/figure>\n<p>Paul Butcher, associate vice president of global digital strategy at Save the Children, said in an emailed statement that the organization \u201ctakes data protection very seriously.\u201d Butcher also wrote that Save the Children collects some data through ad trackers \u201cto improve user experience\u201d and that the organization is in the process of revamping its data retention policies and recently hired a new head of data.<\/p>\n<p>March of Dimes and City of Hope did not respond to requests for comment.<\/p>\n<h2><strong>State-level privacy laws miss nonprofits<\/strong><\/h2>\n<p>While health data is governed by HIPAA, and FERPA &nbsp;regulates educational records, there are no federal laws governing how websites track their visitors. Recently, a few states\u2014California, Virginia, and Colorado\u2014have enacted consumer privacy laws that require companies to disclose their tracking practices and allow visitors to opt out of data collection.<\/p>\n<p>But nonprofits in two of those states, California and Virginia, don\u2019t need to adhere to the regulations.<\/p>\n<p>Sen. Ron Wyden (D-OR), who has proposed his <a href=\"https:\/\/www.wyden.senate.gov\/news\/press-releases\/wyden-introduces-comprehensive-bill-to-secure-americans-personal-information-and-hold-corporations-accountable\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">own federal privacy legislation<\/a>, said that nonprofits accrue a large amount of potentially sensitive data.<\/p>\n<p>\u201cNonprofits store incredibly personal information about things we\u2019re passionate about, from political causes and social views to which charitable causes we care about,\u201d Wyden said in an emailed statement. \u201cIf a data breach reveals someone donates to a domestic violence support group or an LGBTQ rights organization or the name of their mosque, any of that information could be incredibly private.\u201d<\/p>\n<p>Nonprofit leaders, however, argue that they lack the infrastructure and funding to comply with privacy law requirements and must gather and share information on donors in order to survive.<\/p>\n<p>\u201cOne of the most substantive and impactful uses of data by nonprofits has been our fundraising,\u201d said Shannon McCracken, the CEO of The Nonprofit Alliance, an advocacy group made up of nonprofits and businesses. \u201cWithout the ability to cost-effectively reach prospective new donors and current donors, then nonprofits can\u2019t continue to be as impactful as they are today.\u201d<\/p>\n<p>But purposeful or not, privacy experts say, nonprofits are feeding personal information to data brokers and tech giants like Facebook and Google.<\/p>\n<p>\u201cA nonprofit might share your phone number and name with LiveRamp. Tomorrow, a for-profit entity can then reuse that same data to target you,\u201d said Ashkan Soltani, a privacy expert and former chief technologist at the Federal Trade Commission. \u201cThe data flows that go into these third-party aggregators and data brokers come often from nonprofits as well.\u201d<\/p>\n<p>Soltani, who was appointed executive director of the California Privacy Protection Agency on Oct.&nbsp;4, helped draft the California Consumer Privacy Act, which was originally introduced with the nonprofit exemptions.<\/p>\n<p>Many major nonprofits work with data brokers to help organize and analyze their data, Jan Masaoka, CEO of the California Association of Nonprofits, said.<\/p>\n<p>\u201cPeople that have big donor lists use them extensively, pretty much all of them use one of the services,\u201d Masaoka said. \u201cThey don\u2019t keep it in-house, pretty much everybody keeps it with one of these services.\u201d<\/p>\n<p>She noted that Blackbaud is a company that nonprofits often turn to. The <a href=\"https:\/\/oag.ca.gov\/data-broker\/registration\/185724\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">registered data broker<\/a>\u2019s marketing material promotes a <a href=\"https:\/\/www.documentcloud.org\/documents\/21083627-blackbaud-nonprofit-cooperative-database-marketing\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">co-op database<\/a> that combines donor data from more than 550&nbsp;nonprofits with public information on millions of households.<\/p>\n<p>Blackbaud didn\u2019t respond to a request for comment.<\/p>\n<p>Because of a lack of funds, nonprofits also rely on third-party platforms\u2014which also happen to be data brokers\u2014to manage their data\u2019s security and privacy, McCracken said. But these kinds of companies aren\u2019t immune to cyberattacks either: Blackbaud <a href=\"https:\/\/www.blackbaud.com\/newsroom\/article\/2020\/07\/16\/learn-more-about-the-ransomware-attack-we-recently-stopped\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">disclosed a ransomware attack in 2020<\/a> in which hackers stole passwords, Social Security numbers, and banking information, according to a <a href=\"https:\/\/www.sec.gov\/ix?doc=\/Archives\/edgar\/data\/1280058\/000128005820000044\/blkb-20200929.htm\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Securities and Exchange Commission filing<\/a>. Hundreds of <a href=\"https:\/\/www.idtheftcenter.org\/blackbaud-data-breach-leaves-lasting-impact-on-u-s-and-international-nonprofits\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">charitable organizations, schools, and hospitals<\/a> were affected, along with more than 13 million people, according to the Identity Theft Resource Center.<\/p>\n<p>\u201cThey rely on this kind of problematic ecosystem to achieve their work, and as a result, they share number lists, email addresses, or browsing behavior with third-party advertising companies and subject their members to risk,\u201d Soltani said.<\/p>\n<h2><strong>The exception<\/strong><\/h2>\n<p>Unlike its predecessors in California and Virginia, Colorado\u2019s privacy bill doesn\u2019t have an exemption for nonprofits.<\/p>\n<p>In both California and Virginia, the bills\u2019 main supporters gave nonprofits an exemption as a political maneuver. Alastair Mactaggart, a real estate developer and founder of Californians for Consumer Privacy, who was the driving force behind the California Consumer Privacy Act, said his proposal was already facing opposition from tech giants and didn\u2019t want a political showdown with nonprofits, too.<\/p>\n<p>\u201cYou gotta take the first step, so we figured this was the one that would be the easiest to bounce off,\u201d Mactaggart said. \u201cEventually, I hope that the big nonprofits are included as well.\u201d<\/p>\n<p>David Marsden, the state senator who introduced the Virginia Consumer Data Protection Act, echoed that sentiment, reflecting that the law wasn\u2019t perfect but still a good start.<\/p>\n<p>\u201cDoes this pick up everybody that it should, or exempt everybody who needs an exemption? Probably not, but it comes pretty close,\u201d Marsden said. \u201cWe were able, with this bill, to get it passed without people getting up and objecting to what we were trying to do.\u201d<\/p>\n<p>Colorado state senator Robert Rodriguez, who co-sponsored the state\u2019s privacy bill, said he didn\u2019t include an exemption for nonprofits because he felt that any entity that had data on more than 100,000 people should have to follow privacy protections. He also didn\u2019t understand why other states had exemptions.<\/p>\n<p>\u201cSomeone that has over 100,000 records is a good size,\u201d he said in an email. \u201cThey should have some protections or requirements to follow.\u201d<\/p>\n<p><em>This article by Alfred Ng and Maddy Varner was <a href=\"https:\/\/themarkup.org\/blacklight\/2021\/10\/21\/nonprofit-websites-are-riddled-with-ad-trackers\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">originally published on The Markup<\/a> and was republished under the <a href=\"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Creative Commons Attribution-NonCommercial-NoDerivatives<\/a><a rel=\"nofollow noopener\"> license.<\/a><\/em><\/p>\n<p> <a href=\"https:\/\/thenextweb.com\/news\/nonprofit-websites-riddled-ad-trackers-syndication\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last year, nearly 200 million people visited the website of Planned Parenthood, a nonprofit that many people turn to for very private matters like sex education, access to contraceptives, and access to&#8230;<\/p>\n","protected":false},"author":1,"featured_media":8562,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts\/8561"}],"collection":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8561"}],"version-history":[{"count":0,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts\/8561\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/media\/8562"}],"wp:attachment":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}