By The Washington Post · Nitasha Tiku · BUSINESS, TECHNOLOGY, HEALTH
But Lemasters felt spooked. The 29-year-old had used another ADHD drug, Adderall, but never publicized it. The ads "just felt invasive," says Lemasters, who says he quit Adderall in 2017 because it made him feel like a zombie. "What bothers me is how powerful those drugs are and how it's pushed, rather than a doctor actually assessing a patient and suggesting a proper solution."
After years of avoiding social media, drug companies are growing bolder about advertising on Facebook and other social networks, according to interviews with advertising executives, marketers, health-care privacy researchers and patient advocates. That is exposing loopholes around the way data can be used to show consumers relevant ads about their personal health, even as both social networks and pharmaceutical manufacturers disavow targeting ads to people based on their medical conditions.
Ads promoting prescription drugs are popping up on Facebook for depression, HIV and cancer. Spending on Facebook mobile ads alone by pharmaceutical and health-care brands reached nearly a billion dollars in 2019, nearly tripling over two years, according to Pathmatics, an advertising analytics company. Facebook offers tools to help drug companies stay compliant with rules about disclosing safety information or reporting side effects.
But seeing an ad for a drug designed to treat a person's particular health condition in the relatively intimate setting of a social media feed — amid pictures of friends and links to news articles — can feel more intrusive than elsewhere online. The same opaque Facebook systems that help place an ad for a political campaign or a new shoe in a user's feed also can be used by pharmaceutical companies, allowing them to target consumers who match certain characteristics or had visited a particular website in the past.
The ability of drug companies to reach people likely to have specific health conditions — a far cry from a magazine or TV ad — underscores how the nation's health privacy law, the Health Insurance Portability and Accountability Act (HIPAA), has not kept up with the times. HIPAA, which safeguards personal health records, typically does not cover drug companies or social media networks.
It also typically doesn't cover the sea of companies known as data brokers that can collect medical information like prescriptions, insurance claims and even electronic health records, as long as they detach the data from the full name and address of the patient, as well as other personal details. Those data brokers first sort the information into groups that are useful for advertisers. Then brokers match that data with identifiers like email addresses, ZIP codes, phone numbers.
Facebook says membership or activity in a group is not used to target ads, and the company's policies prohibit using medical history for targeting, too.
"Medical history is not used to inform the interest categories that we make available to advertisers, and we prohibit businesses from sending us sensitive health information," Facebook spokesman Joe Osborne said in a statement. "Our teams work with health related companies looking to reach their audiences on Facebook and we require them to act in accordance with the law."
Targeting is ubiquitous when it comes to advertising a bathing suit or dish soap on social media. But some patient advocates worry applying standard ad-targeting techniques to health data could cause embarrassment in front of friends and family or discrimination by employers, potentially even affecting insurance rates or service offerings.
"Knowledge about us shouldn't be used to target us, to limit our choices, or manipulate our human vulnerabilities," says Andrea Downing, who moderates a Facebook group for women who have a gene that raises the odds of breast cancer. She filed a 2018 complaint with the Federal Trade Commission about Facebook's privacy practices.
The growing concern about targeted pharmaceutical ads is unfolding against an expansion at Facebook focusing more generally on health — including encouraging more groups, where community members gather to discuss certain topics, like the one Downing moderates. It's also been actively soliciting more health-care-focused ads. Underscoring the important role Facebook plays in health information, the company has recently policed disinformation around the coronavirus.
To reach potential consumers, drug companies don't need to know an individual's medical history. In many cases, the companies don't want the data, since it comes with increased liability of violating new privacy laws like those in Europe and California or angering regulators.
Health-care researchers say that geographic data could be used to target communities with a high percentage of people with substance abuse disorders. Or data like the size of pants bought online, the type of food purchased with a supermarket loyalty card and a cable TV subscription could be combined to target a potentially obese group of consumers, says Adam Tanner, author of "Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records."
Data brokers match data acquired from hospitals, pharmacies and elsewhere with emails, phone numbers, IP addresses and advertising identification numbers to provide a customized list of people who have the characteristics advertisers want to target. Advertising identifiers are a string of numbers assigned to iPhone or Android devices or to Facebook users to help advertisers pinpoint consumers without knowing who they are.
Advertisers can then upload those custom lists and match identifiers with social media users. Using Facebook's tools, advertisers can also create a "look-alike audience" that shares those same attributes.
In addition to using custom lists, Facebook's ad tools allow advertisers to target based on user behavior (such as "likely to engage with conservative U.S. political content"), demographics (such as household income) and interests (like "motherhood" or "parenting"). Facebook says "interests" categories are informed by only three actions: whether a user has liked or interacted with a Facebook page or clicked on an ad. A user's search history within the platform or on the wider web are not used to inform interest categories, the company says.
Still, even if the drug companies aren't using personal data to target an ad, "the effect is the same from the user's perspective," says Kirsten Ostherr, a digital health technology researcher at Rice University.
Takeda Pharmaceuticals, which paid for the Vyvanse ads seen by Lemasters and which also owns Adderall, says it does not have access to information about an individual's past or present prescriptions "to be used in that way," says Kara Hoeger, director of corporate communications for neuroscience.
"Takeda is strongly committed to protecting individuals' privacy and rights with regard to their personal data," Hoeger said in a statement. "Notably, it is not possible and we do not engage an individual on any social media platform based on what treatments they are prescribed."
Takeda did not respond to questions about how the ads were targeted. But when someone visits a Vyvanse web page featured in a Facebook ad, they are tracked by a variety of tools, including cookies and fingerprinting technology, which profiles your online behavior, according to a feature on Firefox browsers that helps users see how their online activity is being tracked.
Pharma advertising has been around for a while on Google and its video-streaming service YouTube, which allow prescription ads to target based on content. They prohibit drug companies from using personalized targeting, such as demographic information, customized audiences or interest-based targeting. Even so, ad agencies say Facebook is still the leading choice for health advertisers, in part because many users are already discussing their health there.
According to Pathmatics, Pfizer, Allergan, Merck and GlaxoSmithKline were among the top 10 spenders on Facebook mobile ads in 2019, along with fast-growing health start-ups like SmileDirectClub and Roman.
Pharmaceutical companies say they only target based on nonsensitive data. Ryan McKeel, a spokesperson for Gilead Sciences, which is running Facebook ads for the HIV drugs Descovy and Biktarvy, told The Washington Post: "The intended audiences for these campaigns are based on epidemiologic data. Outreach is a result of commonly available, aggregate demographic data (age, gender, geography), self-reported information and user interests."
There are potential benefits to this kind of advertising, says Eric Perakslis, former chief information officer and chief scientist of informatics at the Food and Drug Administration. Pharma companies can reach people most in need of their product, and the social aspect of advertising could even help with adherence to taking medication.
Social media has also been an effective tool for recruiting patients for clinical trials and for getting ads in front of health-care professionals most likely to prescribe a drug, according to Kate Endres, vice president of health and beauty at Havas Media Group, who works with pharmaceutical clients.
Currently on Facebook and Instagram, pharma ad campaigns promote prescription drugs that treat major depressive episodes, weight loss for overweight and obese people, HIV prevention and treatment, and cancer immunotherapy, as well as a multiple sclerosis medication marketed to millennials. Those "branded" ads promote the name of the drug and warn about potential risks, just like on TV.
Even more common are sponsored posts from celebrity influencers and patient influencers, or "unbranded" disease awareness campaigns that don't name the drug. For example, Audrina Patridge, a reality TV star from MTV's show "The Hills," recently promoted lip injections by Juvéderm to her 1.7 million Instagram followers.
Unbranded advertising offers another workaround to regulatory concerns. AMAG Pharmaceuticals reached 25 million women on Facebook and Instagram for a disease awareness campaign called Unblush for hypoactive sexual desire disorder, says Meghan Rivera, AMAG's head of women's health sales and marketing. It was launched months before AMAG's "female Viagra," a prescription injection taken 45 minutes before intercourse, was approved by the FDA. The campaign targeted users only by age, gender and people who visited their unbranded websites, she says.
Rivera says social media was an obvious fit because using real women to speak authentically about their experience helped destigmatize the conversation around sexual health. "This is where women are going and engaging not only in conversations, but also as an exploratory space. If you're posting something relevant to them, we see significant interaction," she says.
Direct-to-consumer pharmaceutical advertising is regulated by the FDA, which published "draft guidance" in 2014 around social media drug ads that did not include any restrictions on ad targeting.
When Facebook started actively soliciting pharmaceutical ads in late 2016, the initial pitch fizzled out in part because pharma companies found the standard behavioral advertising tactics — like using cookies to target consumers based on which websites they visited — too risky, says Ritesh Patel, chief digital officer of health at Ogilvy Consulting, a division of the global ad agency, which works with large pharma clients.
Even now, Patel says, "all of my clients are absolutely very particular about making sure that any program that we do, whether it's digital or social, there's no ability to get access to personally identifiable information."
Facebook has made a renewed push to attract pharma ads over the past couple of years, says Endres, from Havas Media Group. She estimates that there are at least 30 people inside Facebook working with health and pharma clients and says Facebook's legal team has jumped on a call when one of her pharma clients had questions.
Health advocates say the ability to target patients in an otherwise highly regulated space underscores the broader lack of accountability in how consumer health data is shared and used to influence behavior.
"There's widespread acknowledgment that HIPAA needs to be updated for the 21st century," Ostherr says. "We should be demanding that policymakers really think about not just the Facebooks of the world, even though they're important, but the larger economy of data mining and digital profiling that is totally invisible to the average user, but also the average doctor."
In late January, the FDA proposed a set of studies that will use a real Instagram influencer to promote a fictitious prescription medication for endometriosis to examine influencer marketing, including how "focusing on target populations" impacts consumer awareness of risks and intent to purchase the drug.
In a statement, FDA spokesperson Brittney Manchester said, "The FDA actively continues to consider these and other social media topics, and more broadly works to develop approaches to a variety of topics related to the labeling and advertising of medical products." The FDA requires promotion of medical products on the internet and social media to be "truthful, non-misleading and balanced."
The Federal Trade Commission, which oversees deceptive advertising, also has regulatory oversight. The FTC says that companies that "use or disclose sensitive personal information, such as health information, for or through targeted advertising, it could be subject to an FTC enforcement action" for deception or unfairness.
Industry trade groups who want to keep these practices self-regulated have stepped in to offer guidance. In January, the Network Advertising Initiative, an association for third-party digital advertising companies, published a code of conduct on "health-related tailored advertising." It covered consent from consumers, the use of offline data, and "inferences that a user has, or is likely to have sensitive health conditions."
The NAI's head of compliance, Anthony Matyjaszewski, says, "We didn't want companies to take advantage, under the guise of demographic marketing, to get really very specific about who they're trying to target."