Dutch online pharmacies shared health data with tech firms without proper consent
An investigation found that 20 Dutch online pharmacies and supermarkets shared sensitive health data including pregnancy test purchases and customer contact details with Google, Meta, TikTok and Pinterest. Data was shared even when users refused cookies, and cookie notices failed to adequately explain the sharing of health-sensitive information as required by GDPR.
What happened
Investico, Radar and De Groene Amsterdammer examined 20 online pharmacies and supermarkets including Jumbo, Bol and Etos. All 20 shared sensitive medical data with Google, while a smaller group also sent customer information to Meta, TikTok or Pinterest.
The data included information about products viewed or purchased such as pregnancy tests, and in some cases addresses, phone numbers and email addresses. Data was shared when users clicked 'accept' on cookie pop-ups, but also when users refused cookies: 15 pharmacies sent medically sensitive information to Google even when cookies were rejected.
Reported impact
Consumers had sensitive health data including pregnancy test purchases and contact details shared with technology companies without adequate understanding or explicit consent. The practice enabled targeted advertising based on health-sensitive product purchases.
Index analysis
Cookie notices failed to adequately explain what would happen to personal data in violation of GDPR requirements to inform users and obtain consent for advertising cookies. The notices did not clearly convey that pharmacies would share data about sensitive products, such as medical items, with technology companies.
The sharing of sensitive health data is subject to stricter rules under GDPR than ordinary advertising data, yet many pharmacies did not comply with these heightened requirements.
Governance controls
Websites are required under GDPR to provide sufficient information about cookie policies and obtain consent for advertising cookies. Special protections apply for sharing of sensitive data such as medical information.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.