Medical journals and advertiser tracking—Consequences for patients, clinicians, and editors

Abstract

Medical journal websites frequently contain tracking code that transfers data about journal readers to third parties. These data give drug, device, and other medical product companies a potentially powerful resource for targeting advertisements and other marketing materials to journal readers based on unique attributes and medical interests that can be inferred from the articles they read. Thus, while editors may strictly regulate the content of advertisements that such companies place in their journals’ pages, they simultaneously provide those companies with the means to target readers in other forums, possibly in ways that subvert editorial guidelines. We examine the implications of third-party tracking on medical journal webpages, and recommend actions that publishers, editors, and academic societies can take to curb it.

Drug and device companies spend upwards of $20 billion a year on advertising targeting health care providers (HCPs). ¹ One of the primary ways these companies reach their intended audience is by placing advertisements in professional medical journals. In principle, these advertisements can increase knowledge of new therapeutics and accelerate their appropriate prescribing in specific patient populations. However, such advertising can also harm public health and raise health care costs by generating demand for therapies with limited evidence of efficacy and cost-effectiveness.^2,3

Medical journal editors recognize the conflict of interest between running lucrative drug and device advertisements and publishing unbiased scientific findings. Accordingly, most follow International Committee of Medical Journal Editors (ICMJE) guidelines, which, among other measures, recommend that journals not carry advertisements for products proven to be harmful to health and that editors have final authority for approving print and online advertisements. ⁴

Little attention has been paid, however, to medical journals’ role in facilitating targeted advertising to providers and other journal readers, such as patients, once they have left the journal website. Medical journal websites contain third-party trackers that transfer user data to advertisers, data brokers, and social media companies. ⁵ These companies can use the information gathered on medical journal pages to target advertisements and other marketing material to journal readers based on their unique attributes and inferred medical interests. Thus, while editors may strictly regulate the content of advertisements that drug and device companies place in their journals’ pages, they simultaneously provide those companies with the means to target readers in other forums, possibly in ways that subvert ICMJE guidelines. We examine the extent and implications of third-party tracking on medical journal websites and then describe steps that journal editors and publishers can take to protect the privacy of visitors to their websites.

What is third-party tracking?

Third-party trackers are hidden pieces of code embedded on many websites^6–9 that initiate data transfers from a user's computer to third-party domains—that is, entities other than the website the user is visiting. When someone visits HHS.gov, for example, a third-party tracker sends information about that visit to the ad service DoubleClick (owned by Google). These data transfers typically include users’ IP address and URLs of visited webpages. Many third parties also set cookies on users’ browsers—small pieces of data that serve as persistent identifiers, allowing users to be tracked across multiple websites. Using these tools, companies are able to construct detailed profiles of individuals’ browsing behaviors, which can, in turn, be linked to email addresses, social media profiles, and other real-world identifiers.

Third-party tracking on medical journal websites

Because third-party tracking is designed to be invisible to web users, many readers likely have no idea how much tracking they are exposed to when they visit a medical journal website. However, we have found that more than 99% of medical journals with an impact factor of two or greater ⁸ include at least one third-party tracker on their website. ⁵ In fact, the average medical journal website had 31 third-party trackers sending data to domains owned by different parent companies. Figure 1 displays the unique third-party tracking entities on two of the top 10 medical journals by impact factor. We also found that six medical journals had no third-party tracking on their websites, suggesting that it is possible for a journal website to serve its primary function—presenting academic articles—without facilitating targeted advertisement to its readers. Journals without tracking had similar impact factors to all studied journals (within the interquartile range), but were from small publishers and had basic websites with less functionality. Future studies could examine in greater depth the properties and policies of medical journal websites that have no third-party tracking.

Figure 1.

Data transfers to third-party domains on two of the top 10 medical journal websites (by impact factor), by parent company.

The most prolific trackers on medical journal websites are operated by familiar big tech companies, including Google/Alphabet, Twitter, and Facebook. While these companies allow advertisers to reach a wide variety of audiences across a vast range of websites, many also support advertisers that seek specifically to target HCPs and patients. Google's advertising policy, for instance, contains guidelines to allow pharmaceutical companies to promote prescription drugs to users whose data they have collected. ¹⁰ Adobe and Oracle, each of whose trackers appeared on at least 40% of medical journal websites, have published lists with many medical specialties in the audience “segments” available to direct targeted advertising.^11,12 By selecting among these segments, a pharmaceutical company could, for instance, display advertisements to users inferred to be “addiction medicine” or “child and adolescent psychiatry” providers. These companies also include groups with different health conditions in their audience segments, allowing advertisers to target, for example, individuals who are likely to purchase certain anti-allergy medications. Other companies, like DMD Marketing Corporation, whose trackers appeared on the websites of several leading medical journals, specialize in targeting HCPs, ¹³ offering pharmaceutical companies the ability to deliver targeted marketing materials “based on an HCP's browsing behavior.” They suggest, for instance, that “if an HCP visits the latest clinical trial summary, the system might automatically send an email from the sales rep that contains the full clinical trial report as an attachment.”

What are the implications of third-party tracking on medical journals?

The invisible but ubiquitous presence of third-party trackers on medical journal websites gives drug and device companies a particularly powerful tool for advertising to providers based on the journal websites they visit and the articles they read. Trackers can, for example, infer that a visitor to a journal's website is a physician reading about type 2 diabetes treatments and then show that individual an advertisement for a particular company's new diabetes therapy. That advertisement could be displayed on the journal's website if the journal allows for the placement of targeted advertisements, or it could be displayed on a string of other websites visited by the physician. Unlike static advertisements that appear in print or digital versions of medical journals—which frequently do not adhere to FDA safety guidelines ¹⁴ but can in principle be monitored by journal editors—there is no reliable mechanism for ensuring that targeted pharmaceutical advertisements shown to physicians on other websites contain adequate safety information or even that they are for products proven to be safe and effective.

Patients who access medical journal websites to learn more about their own health conditions may also be at risk from targeted advertising. An older adult who, following a diagnosis of mild cognitive impairment, starts reading articles and commentaries on Alzheimer's trials may suddenly start receiving targeted advertisements for both legitimate drugs and for unproven therapies. In addition to potentially exposing patients to misleading information, when such advertisements begin appearing on shared computers, they may also compromise patient privacy.^15–17

Recommendations

Regulatory oversight of third-party tracking varies but is generally minimal. In the U.S., while communication between HCPs and patients is protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), no such regulation protects health-related information that can be inferred from web browsing. Attempts at regulating digital privacy and tracking, such as the California Consumer Privacy Act of 2018, have faced substantial legal and technological barriers to successful implementation. ¹⁸ In Europe, the General Data Protection Regulation (GDPR), which protects online personal data by informing users of cookies and restricting data collection and use through the levying of penalties, has similarly faced enforcement challenges due to evasion and budgetary constraints. ¹⁹ Though GDPR tightened consent rules, consent alone may be insufficient, ²⁰ as users may frequently click through complicated consent banners online and be unaware of profile construction. One issue in particular has been the growing consolidation among firms that engage in third-party tracking. ²¹ Market concentration enables construction of richer and potentially more sensitive user profiles, which has implications for privacy. In the U.S., greater Federal Trade Commission oversight of digital privacy and anti-trust laws more broadly and health tracking more specifically, as well as continued efforts to enact federal privacy laws, may begin to address some of the issues of targeted advertising to HCPs through third-party tracking.

Fortunately, journal editors can also take immediate steps to begin shielding readers from third-party tracking. First, using freely available privacy monitoring tools such as OneTrust, TrustArc, and Osano, editors should undertake privacy audits of their websites to make themselves aware of the trackers that are currently present. Some publishers may have simply overlooked the fact that “free” tools used to monitor website traffic and performance also transfer data to third parties, and might be responsive to editor requests to reduce or eliminate unnecessary tracking. With better awareness of the trackers on their websites, editors and publishers will be able to make informed decisions about how to optimize privacy protections on their websites. Second, if they are unwilling or unable to eliminate all trackers in the near term, editors should at least give users the option to limit third-party tracking. Currently, many medical journals deny access to users who take the basic privacy-protecting step of blocking cookies, ²² making privacy-conscious readers choose between foregoing access to journal content and allowing tracking. Instead of compelling this tradeoff, journal websites can and should be modified to allow full access to users blocking cookies. Ultimately, medical journal editors should commit to working with publishers to eliminate third-party trackers on their websites, as a small number of journals have done. ⁵ Existing ICMJE recommendations prohibit selling advertisements intended to be juxtaposed with journal content on the product being advertised. This norm should be supported by medical professional societies. Notably, these changes would not prohibit journals from running digital advertisements, so long as those advertisements are contextual rather than targeted, with no user data flowing to third parties. In fact, the experience of other online publishers suggests that the switch from targeted to contextual advertising would have minimal impact on journals’ advertising revenue. ²³

Conclusion

While many medical journals rely on income from online advertising, they can and should do so without helping advertisers and other third parties accumulate data about their readers. Consistent with their commitment to curbing misleading or harmful advertising, medical journal editors and publishers should work towards ending their participation in the targeted advertising economy.