love to give my personal data to Walgreens in order to get a potentially life-saving vaccine (and 1% off all in-store purchases!) pic.twitter.com/7XYU5KDN3u— Sara Morrison (@SaraMorrison)
Last November, the Trump administration announced a partnership with retail pharmacies to distribute coronavirus vaccines, which would provide people across the country with more places to get vaccines and people to administer them. That’s a good thing. The other side of it is, as the Wall Street Journal reported this week, some pharmacies are taking advantage of the program to make some extra money off of their new customers.
If you schedule a Covid-19 vaccine appointment with major pharmacy chains such as Walgreens or CVS,your data may be used to bulk up those companies’ own significant marketing apparatuses, giving them a source of income even beyond what they’re paid for administering the vaccines and whatever you might decide to buy while you’re in the store to get one. In some cases, you’re forced to make an account with the store to get a vaccine at all, and deactivating your mandatory account after the fact isn’t easy.“To schedule vaccination appointments, we ask people to create a Walgreens account to fulfill data and reporting requirements online before arriving at a store location,” a Walgreens spokesperson told Recode. “This enables a safer and more streamlined in-store experience — reducing lines and in-store wait times that can be a by-product of collecting this information at the pharmacy counter.”
Vox’s German Lopez is here to guide you through the Biden administration’s unprecedented burst of policymaking. Sign up to receive our newsletter each Friday.
When you go to the Walgreens vaccine scheduler, you can find out if there are vaccines available in your area, but you can’t see where and when appointments are available — let alone schedule one — without first making a Walgreens account. And that means giving Walgreens the information it considers necessary to make that account, including your name, date of birth, phone number, address, gender (male or female are the only options), and email address. You’re also automatically signing up to receive marketing emails, which you can only opt out of later through your account settings. Oh, and you’re encouraged to join the myWalgreens loyalty program, which gives Walgreens even more data about your purchases and automatically signs you up for even more marketing emails.
This doesn’t apply to all the data you provide: Any information you give for the purposes of getting a vaccine at a pharmacy is protected by the Health Insurance Portability and Accountability Act (HIPAA).
Under the CDR program, the NSA has collected information about millions of Americans’ phone calls. Ever since USA FREEDOM reformed the CDR program in 2015, the civil liberties community and members of Congress have repeatedly asked the NSA for information about how widespread the CDR program is, but the NSA has been unable or unwilling to provide that information.
What’s not so easy is deactivating your Walgreens account if you so choose after you’ve gotten your vaccine. In fact, you can’t even do it online. You have to call Walgreens customer service at 1-877-250-5823.The Centers for Disease Control and Prevention (CDC) told Recode that its agreement with participating pharmacies asks them to use an online scheduling system for vaccine appointments for social distancing purposes, and it lets pharmacies use their own. So Walgreens used its existing system, which requires patients to make an account. Walmart did the same, though it at least offers patients the ability to opt out of receiving marketing emails when they register, and doesn’t require anything beyond a name and email to create the account.
As was the case with Walgreens, getting rid of your Walmart account once you no longer need it is a more onerous process than creating it. In its instructions for how to close your account, Walmart simply says to “contact our Customer Care team for assistance” without providing instructions on how to do that. But if you scroll down the page a bit, you’ll see a “contact us” button. Click that, and tell the chatbot that will pop up that you want to deactivate your account, and then pick your preferred method of contact (online chat, phone, or email). This will take several minutes, but your account will be deactivated. Rite Aid and CVS, who, along with Walgreens and Walmart, get the majority of the vaccines distributed through the program, told Recode that they don’t require patients to sign up for an account to get a vaccine, but neither responded to follow-up questions about if they collect data from patients for non-vaccine purposes, how it might be used, and if there’s a way to opt out of data collection or delete whatever data has already been collected. CVS did tell the Wall Street Journal that it would “stay in touch” with customers after they received their second shot and hoped to market products to them. The company also said it would encourage patients to join CVS’s loyalty program while they were at their vaccine appointments. Similar to Walgreens, CVS has an advertising arm, announced last August, which relies on data collected through its loyalty program.
The former requires providing your mobile phone number which is immediately tied to your real-life identity — more on that soon. So it seems that having your accounts linked to your real-life identity via your mobile phone number is usually unavoidable even if it’s not the same number you normally use.
Recode also reached out to several other companies that the federal government has partnered with to provide vaccines, including Albertsons, Costco, Kroger, and Publix, for comment on if and how they were collecting data on their patients. Costco was the only one to respond, saying that it appreciated my “interest and support” and had no comment.
U.S. intelligence officials have asked Congress to permanently extend a controversial program that has allowed the National Security Agency to collect millions of telephone records.Since the call records program was voluntarily suspended, there’s no legal impediment to the NSA resuming collection before Section 215 of the Patriot Act expires in December.
All that said: Get the vaccine. Yes, you might have to sign up for a store account first and that’s not ideal. Yes, it would be nice if the government had put some restrictions in place so retail pharmacies weren’t allowed to collect and use your data in this way. And yes, some pharmacies are taking advantage of a terrible situation to profit off of you, because most businesses will do absolutely everything they can to make money and your data is valuable. But your life and your health are even more valuable — even if you have to make some privacy compromises to preserve them.
Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.