Utah’s coronavirus website had more tracking technology than almost any other state’s COVID-19 site in the nation, according to an analysis by digital industry watchdogs.
Internet privacy experts say the large number of cookies and ad trackers on utah.coronavirus.gov could allow data-mining companies to exploit citizens — but state officials say the tracking was there only to gauge users’ interaction with the content, allowing the state to learn which public health messages are working.
A scan of coronavirus.utah.gov showed the site contained 10 ad trackers and 22 cookies, according to the Blacklight scanner, created by the technology industry publication The Markup.
However, the number of cookies dropped to 10 on Thursday or Friday, after The Salt Lake Tribune inquired about the cookies and ad trackers.
The Blacklight scan of Utah’s coronavirus website showed tracking technology connected to Facebook; Alphabet, which is the parent company of Google; Snap Inc., which owns Snapchat; Twitter; LinkedIn; and Tapad Inc., which sells software that analyzes user data to identify when multiple devices are used by the same person and target advertising to them. Those companies were still listed as having tracking data on the Utah site as of Friday.
Before 12 cookies were eliminated from Utah’s site, only Hawaii’s coronavirus website had more tracking technology, with 18 ad trackers and 48 third-party cookies. As of Friday, New Jersey also had more, with 11 ad trackers and 12 cookies.
The Markup in March analyzed the vaccine portals and informational websites of all 50 states, and found that the sites on average hosted 2.8 ad trackers and 3.4 third-party cookies: digital information that websites send to a visitor’s device that allows the device to be recognized in the future.
Sometimes these features allow site owners to see how individual users interact with the site, what parts of it they find most engaging, and which visitors are returning as opposed to visiting for the first time. Other times, they allow not just the site’s owner but other businesses to gather information about what a user appears to be interested in as they browse the internet, and use that information to target marketing to them.
The cookies and ad trackers on coronavirus.utah.gov all are linked to the first type of use, said Tom Hudachko, spokesman for the Utah Department of Health.
“The web trackers are used only for analytics purposes. We have a lot of videos on the site, and we use trackers to determine which videos and which types of content are most popular so we can better target and create public messaging,” Hudachko said.
The information the tracking technology gathers is used by UDOH, the Governor’s Office of Economic Development and Penna Powers — the Salt Lake City marketing firm that produces the state’s COVID-19 outreach campaign, Hudachko said.
But internet privacy advocates say government entities in particular should be more cautious when tracking data about residents, who likely are unaware that visiting a public health website could put them in contact with private tech companies.
“How many Utahns know that they just shared data with a whole bunch of companies?” asked Lee Tien, an attorney for the Electronic Frontier Foundation. “Our federal government or state government or city government, whom we pay taxes to and who are supposed to be providing services to citizens — I don’t believe they should be in the business of surreptitiously feeding any commercial entities with that data, that we as citizens think we’re only giving up in order to get a service from our government.”
Tien said it’s particularly exploitative when the service residents are seeking is access to a vaccine that prevents a deadly disease.
“This pandemic has raised a lot of issues about the disposition of the data that are really important,” he said.
Nevada had been the state with the most tracking technology on its COVID-19 vaccination site, but the state eliminated many of those after The Markup’s review. Officials who operate the Nevada site told The Associated Press there were several outdated cookies, as well as some ad trackers used to gauge the effectiveness of ads the state created to promote the vaccine. Some of the tracking also appeared in connection with links to social media sites.
After eliminating several of the tracking mechanisms, legislators in Nevada introduced legislation to extend regulations covering commercial sites to cover government sites as well.
Tracking technology is common in private and commercial websites. The Tribune’s sltrib.com, for example, had 31 ad trackers and 98 cookies, Blacklight showed. The Deseret News had 34 ad trackers and 110 cookies. KSL.com had eight ad trackers and 13 cookies, with 11 ad trackers and 8 cookies at FOX13now.com. KUTV.com had 34 ad trackers and 71 cookies, while ABC4.com had 25 ad trackers and 41 cookies.
But tracking technology is different on the website of a private entity because visitors expect it, Tien argues.
“The thing about commercial sites is, we can see there’s a lot of tracking there. We know there’s a lot of tracking there. Well, it’s a commercial website. They’re trying to make money. It kind of makes sense.”
Scans of Utah’s local health department websites also showed some tracking technology, though not as many as the state site. The Southeast Utah Health Department site had six third-party cookies, Blacklight showed. The TriCounty Health Department of eastern Utah had two ad trackers and four third-party cookies.
Most other local health department sites had three or fewer tracking mechanisms in total.
Among the coronavirus websites created by the 50 states, 23 used no third-party cookies; five states used no cookies or third-party ad trackers.
