Suicide prevention website tracked and shared visitors’ data without consent
113, a national organization for suicide prevention in the Netherlands, collected and shared sensitive information from its website visitors with third parties without consent.
Queen Maxima visits 113 Suicide prevention center in 2018. Photo by Patrick van Katwijk/Getty Images
113, a national organization for suicide prevention in the Netherlands, collected and shared sensitive information from its website visitors with third parties without consent.
Even when visitors clicked the cookie reject button, the site still gathered tons of information from visitors and shared it with tech companies like Microsoft and Google.
According to Hackedemia – an independent platform for cyber journalism that analyzed the 113 suicide prevention website – mouse movements, click behavior, and scrolling patterns were recorded with the help of Microsoft’s session recording and heatmap tool Clarity, even when users explicitly rejected the necessary cookies.
Has your password leaked?
“On a website for visitors in acute psychological distress, session recording is a particularly sensitive issue: navigation patterns on a suicide prevention hotline can be traced back to health data,” the researchers say.
In addition, Google Tag Manager, Google AdSense, Google Analytics, and DoubleClick were loaded before visitors got the chance to consent or reject. Because of this, location data, device information, and other user data were shared with Google without consent.
“For a healthcare institution where anonymity is of vital importance, digital privacy should not be a choice but a prerequisite, without commercial trackers from companies like Google,” the foundation concludes.
The researchers informed the 113 suicide prevention website of their findings. The foundation immediately launched a technical review and decided to temporarily disable the analysis tools on its website.
“We are currently investigating exactly what happened, how this could have occurred, what the potential impact was, and what our next steps will be. Once the investigation is complete and all the facts are clear, we will provide further updates,” the suicide prevention foundation said in a statement.
Hackedemia says it’s impressed with the way the foundation acted.
“113 responded quickly and constructively: they acknowledged the issue publicly within 24 hours of our initial report, launched an internal investigation, brought in external experts, and effectively removed Microsoft Clarity. No legal letter, no denial,” the researchers said.
Unlock exclusive Cybernews content on YouTube.