To help identify trends in privacy representations, BCLP reviewed the websites and privacy notices of each pharmaceutical company listed within the Fortune 500.
The following summarizes current industry trends:
- Privacy notices are, on average, less than 2 months old, and have been updated more recently than other industries in the Fortune 500.
- The pharmaceutical industry universally updated their privacy notices for the CCPA; the rate of update far exceeded that found within most other industries.
- Unlike the Fortune 500 generally, pharmaceutical company privacy notices that reference enumerated categories are predominantly using lists (instead of tables or charts) to convey information.
- While a slight majority of companies state that they do not sell personal information, a significant percentage (nearly one in three) are silent or unclear about their selling practices which, itself, could be alleged to violate the CCPA.
- The vast majority of websites and privacy notices do not include a “Do Not Sell” option.
- Those companies that are disclosing the sale of information are complying with the CCPA’s requirement to provide a “Do Not Sell” option.
- Disclosure of access and deletion rights is universal.
- As an industry, pharma companies are not heavy users of behavioral advertising cookies. Within the sector, however, there is significant divergence between companies.
- The average quantity of behavioral advertising cookies on a corporate homepage is 5.7.
- 31% of pharma companies are deploying a cookie notice or banner, and a significant portion of those are attempting to obtain opt-in consent.
- The deployment of a cookie notice only marginally correlates to the use of advertising cookies.