To help identify trends in privacy representations, BCLP reviewed the websites and privacy notices of each pharmaceutical company listed within the Fortune 500.

The following summarizes current industry trends:

  • Privacy notices are, on average, less than 2 months old, and have been updated more recently than other industries in the Fortune 500.
  • The pharmaceutical industry universally updated their privacy notices for the CCPA; the rate of update far exceeded that found within most other industries.
  • Unlike the Fortune 500 generally, pharmaceutical company privacy notices that reference enumerated categories are predominantly using lists (instead of tables or charts) to convey information.
  • While a slight majority of companies state that they do not sell personal information, a significant percentage (nearly one in three) are silent or unclear about their selling practices which, itself, could be alleged to violate the CCPA.
  • The vast majority of websites and privacy notices do not include a “Do Not Sell” option.
  • Those companies that are disclosing the sale of information are complying with the CCPA’s requirement to provide a “Do Not Sell” option.
  • Disclosure of access and deletion rights is universal.
  • As an industry, pharma companies are not heavy users of behavioral advertising cookies. Within the sector, however, there is significant divergence between companies.
  • The average quantity of behavioral advertising cookies on a corporate homepage is 5.7.
  • 31% of pharma companies are deploying a cookie notice or banner, and a significant portion of those are attempting to obtain opt-in consent.
  • The deployment of a cookie notice only marginally correlates to the use of advertising cookies.