Nevada lawmakers have introduced legislation that would create new web privacy protections after an investigation by The Markup found the state’s COVID-19 vaccine information site contained the most trackers in the country.
The emergency legislation, introduced by Assembly minority leader Robin Titus and other members of the Assembly, would broaden the scope of Nevada’s existing privacy law. Currently the law requires “commercial” website operators to explain how they collect information and give consumers a way to opt out. Under the proposal, the law would expand to cover any website running a public awareness campaign by or on behalf of government officials.
Blacklight
We Ran Tests on Every State’s COVID-19 Vaccine Website
The results, measuring accessibility and privacy protections, were not always great
The Associated Press reported the bill’s introduction last week and pressed the site’s operators about The Markup’s findings. Titus told The Markup in an email that she became aware of the issue through the AP’s follow-up reporting to The Markup’s article. “I was shocked and immediately spurred to action to draft an emergency leadership bill to prohibit the sharing or selling of data during public information campaigns,” she said.
In March, The Markup published an investigation testing every state vaccination website in the United States for privacy and performance. Nevada’s site, which is run through a partnership with a nonprofit organization called Immunize Nevada, was an outlier in the test.
Using Blacklight, a tool built by The Markup that scans websites for tracking code, we found 45 cookies on Nevada’s site—more than the lowest 46 states we looked at combined.
Immunize Nevada didn’t respond to requests for comment from The Markup.
A spokesperson for the organization, Marissa Medeiros, previously told The Markup that the site “uses digital advertising to educate and inform Nevadans about these vaccines, and we use Google Analytics to track the performance of these ads.” The site also interacted with social media services, which contributed to the count, according to Medeiros.
After the article’s publication, Edward Estipona, the CEO of Estipona Group, a creative agency that worked with Immunize Nevada, told the AP that it ran a “full site audit” and removed several outdated cookies. When The Markup reexamined the site this week, all of the cookies Blacklight searches for were disabled by default, and the site now prompts users to opt in. Three-quarters of the 24 ad trackers had also been removed, leaving six on by default. The site also published a new privacy policy outlining how the site collects user data and a cookie preferences page.
“Thank you for letting us know,” Estipona said in an interview with The Markup this week. “It’s one of those things about taking a village to help.”
Estipona told The Markup that the cookies on the site were largely from old social media ad campaigns and that the site only captured behavioral data, like where a visitor went after clicking on an ad.
Some trackers, including some from social media services, are still marked as “functional” to the site and can’t be opted out of. Estipona said many were required for accessibility and features like embedded video.
18
Number of ad trackers, out of 24, removed from the Immunize Nevada site following The Markup's investigation.
Source: Blacklight/The Markup
The Markup’s investigation in March found that several states at the time did not have any cookies or ad trackers. The site with the second-highest number of cookies, Utah, had 22—less than half of what we found on Nevada’s site. We found Utah’s site had the same number when we checked again this week.
In our March test, Nevada also had the lowest score in a measure of website performance, and was the slowest page to load of those we looked at. A follow-up test we performed this week showed notably improved performance scores and loading times now firmly in the middle of the pack.
More than half of the adult population in the United States has had at least one dose of a vaccine, but barriers to access have left some people—including Nevadans—struggling to sign up for a shot in recent months.
As vaccine distribution took off this spring, Americans around the country complained about crashing websites and confusing interfaces. Several independent Facebook groups popped up locally to help people navigate the systems.
The bill has been referred to the legislature’s Committee on Commerce and Labor and does not yet have hearings scheduled. Titus said she’s hopeful the bill will be taken up before the legislature adjourns at the end of the month.
“The public needs to be able to trust their government,” Titus wrote to The Markup. “No one wants to be tracked let alone with taxpayer dollars for commercial purposes involving a sensitive and private health concern during a pandemic.”
