GOOGLE ADVERTISING SERVICES – DoubleClick, AdWords, AdMob
Date signed: 5/9/2018
| TPWA PIA Questions | TPWA PIA Answers |
|---|---|
| OPDIV: | CMS |
| TPWA Unique Identifier (UID): | T-5775483-419703 |
| Is this a new TPWA? | Yes |
| Please provide the reason for revision. | Revised to include all CMS web properties that occasionally deliver digital advertising on third-party websites in order to reach new users and provide information to previous visitors. These additional CMS web properties include; www.CMS.gov, www.Medicare.gov, www.MyMedicare.gov, www.Medicaid.gov, www.InsureKidsNow.gov. This TPWA does not include Google Analytics or Google +. |
| Will the use of a third-party Website or application create a new or modify an existing HHS/OPDIV System of Records Notice (SORN) under the Privacy Act? | No |
| Indicate the SORN number (or identify plans to put one in place.) |
|
| Will the use of a third-party Website or application create an information collection subject to OMB clearance under the Paperwork Reduction Act (PRA)? | No |
| Indicate the OMB approval number and approval number expiration date (or describe the plans to obtain OMB clearance.) |
|
| Does the third-party Website or application contain Federal Records? | No |
| Describe the specific purpose for the OPDIV use of the third-party Website or application: | Google Advertising Services consisting of, DoubleClick, AdWords, and AdMob deliver digital advertising on third-party websites in order to reach new users and provide information to previous visitors to Centers for Medicare & Medicaid Services (CMS) websites. This outreach helps inform consumers about the variety of services CMS offers. These Google Advertising Services that CMS purchases, use behavioral targeting to identify the relevant audience by tracking user online activities across various websites, over time. Google does not collect PII in the course of these advertising activities and therefore, does not share PII with CMS. Behavioral targeting may be supplemented with third party data, such as demographic data. All of these Google advertising services provide CMS with conversion tracking reports to allow CMS to determine the effectiveness of advertising campaigns. Conversion tracking provides information about users’ activities regarding ads, including whether an ad is clicked on or a transaction is completed. |
| Have the third-party privacy policies been reviewed to evaluate any risks and to determine whether the Website or application is appropriate for OPDIV use? | Yes |
| Describe alternative means by which the public can obtain comparable information or services if they choose not to use the third-party Website or application: | If consumers do not want to click on ads served by Google, consumers can learn about CMS campaigns through other advertising channels such as TV, radio, and local partners’/counseling entities and events. |
| Does the third-party Website or application have appropriate branding to distinguish the OPDIV activities from those of nongovernmental actors? | No |
| How does the public navigate to the third party Website or application from the OPIDIV? | Not applicable |
| Please describe how the public navigate to the third-party website or application: | Not applicable. The CMS websites do not link to Google Advertising Services. Google Advertising Services are tools used to place and track advertising on third-party sites. |
| If the public navigate to the third-party website or application via an external hyperlink, is there an alert to notify the public that they are being directed to a nongovernmental Website? | No |
| Has the OPDIV Privacy Policy been updated to describe the use of a third-party Website or application? | Yes |
| Provide a hyperlink to the OPDIV Privacy Policy: | https://www.cms.gov/privacy/ Is the privacy policy for all CMS websites unless a separate one is noted below. https://www.healthcare.gov/privacy/ |
| Is an OPDIV Privacy Notice posted on the third-party Website or application? | No |
| Is PII collected by the OPDIV from the third-party Website or application? | No |
| Will the third-party Website or application make PII available to the OPDIV? | No |
| Describe the PII that will be collected by the OPDIV from the third-party Website or application and/or the PII which the public could make available to the OPDIV through the use of the third-party Website or application and the intended or expected use of the PII: | Not applicable. CMS does not collect any PII through the use of Google advertising services. |
| Describe the type of PII from the third-party Website or application that will be shared, with whom the PII will be shared, and the purpose of the information sharing: | Not applicable. Google does not share any PII. |
| If PII is shared, how are the risks of sharing PII mitigated? | Not applicable |
| Will the PII from the third-party Website or application be maintained by the OPDIV? | No |
| Describe how PII that is used or maintained will be secured: | Not applicable |
| What other privacy risks exist and how will they be mitigated? | CMS uses Google advertising services solely for the purposes of improving consumer engagement with CMS websites by directing consumers to CMS websites through the use of targeted advertising. Potential Risk: The use of cookies, pixels, and web beacons generally presents the risk that an application could collect information about a user’s activity on the Internet for purposes that the user did not intend. The unintended purposes include providing users with behaviorally targeted advertising, based on information the individual user may consider to be sensitive. Additional Background: Cookies, pixels, and web beacons allow Google advertising services to measure the performance of CMS advertisements and to report the ad performance to CMS. CMS advertising delivered by Google Advertising Services will carry persistent cookies that enable CMS to display advertising to individuals who have previously visited CMS websites. Mitigation: CMS websites and Google Advertising Services provide consumers with information about the use of persistent cookies and related technologies. This information includes what data is collected, and the data gathering choices included in CMS and Google website privacy policies, including choices related to behaviorally targeted advertising. Tealium iQ Privacy Manager offers the ability to opt out of persistent cookies. The settings can be accessed via the privacy policy on CMS websites. CMS will not implement Google Advertising Services pixels or web beacons, which enable behavioral targeting and place persistent cookies on a browser, if Tealium iQ is not available on a CMS website. In addition, Google and Digital Advertising Alliance AdChoices offers the ability to opt out of Google Advertising Services related to CMS websites on its own website. Potential Risk: Google Advertising Services tracks users across multiple sites and the resulting combined information could reveal patterns in behavior that the user may not want to disclose to Google. The consumer may consider their web behavior or search history to be sensitive. Additional Information: Google Advertising Services targets consumers based on information collected through technologies such as cookies and pixels. Behavioral targeting deploys ads to consumers whose on-site actions (e.g., clicks or sharing of various types of content) match specific attributes considered desirable. Google Advertising Services will also use conversion tracking, which allows advertisers to measure the impact of their advertisements by tracking whether users who view or interact with an ad later visit a particular site or perform desired actions on such site, such as signing up for a program or requesting further information. Mitigation: Google only collects aggregated level “interaction” data to identify consumers that are most likely to interact with an ad from a specific industry (for example, health insurance) for the purposes of improving the ability for advertisers to reach consumers who are more likely to find that ad relevant. Google does not allow for the targeting of consumers who have specifically interacted with an ad from CMS. Potential Risk: Some users of Google’s services may create accounts with Google that may include PII. Google’s access to both PII and non-PII about registered Google users presents the risk that visitors to CMS’ web site, who are also registered Google users, could be identified by Google. Mitigation: CMS does not receive any PII from Google advertising services. Google provides information on the types of information collected about users in its privacy policy, as well as choices with respect to such information collection or how it is used. For example, users can review, update, control, and adjust the types of information tied to, saved, and utilized by Google in targeted advertising and analytics, including an opt out. |
Third-Party Web and Application (TPWA) Privacy Impact Assessment (PIA) published by CMS as an Operating Division of the U.S. Department of Health and Human Services