I became eligible to get the coronavirus vaccine on February 15. Hoping to get an edge on the millions of other newly eligible New Yorkers I’d be competing with for an appointment, I spent a few days before the big day figuring out how and where to sign up for a vaccine between the many portals for my state, my city, health care providers, and retail pharmacies that were distributing them.
And that’s when I noticed something about Walgreens:
Last November, the Trump administration announced a partnership with retail pharmacies to distribute coronavirus vaccines, which would provide people across the country with more places to get vaccines and people to administer them. That’s a good thing. The other side of it is, as the Wall Street Journal reported this week, some pharmacies are taking advantage of the program to make some extra money off of their new customers.
If you schedule a Covid-19 vaccine appointment with major pharmacy chains such as Walgreens or CVS, your data may be used to bulk up those companies’ own significant marketing apparatuses, giving them a source of income even beyond what they’re paid for administering the vaccines and whatever you might decide to buy while you’re in the store to get one. In some cases, you’re forced to make an account with the store to get a vaccine at all, and deactivating your mandatory account after the fact isn’t easy.
“To schedule vaccination appointments, we ask people to create a Walgreens account to fulfill data and reporting requirements online before arriving at a store location,” a Walgreens spokesperson told Recode. “This enables a safer and more streamlined in-store experience — reducing lines and in-store wait times that can be a by-product of collecting this information at the pharmacy counter.”
When you go to the Walgreens vaccine scheduler, you can find out if there are vaccines available in your area, but you can’t see where and when appointments are available — let alone schedule one — without first making a Walgreens account. And that means giving Walgreens the information it considers necessary to make that account, including your name, date of birth, phone number, address, gender (male or female are the only options), and email address. You’re also automatically signing up to receive marketing emails, which you can only opt out of later through your account settings. Oh, and you’re encouraged to join the myWalgreens loyalty program, which gives Walgreens even more data about your purchases and automatically signs you up for even more marketing emails.
This doesn’t apply to all the data you provide: Any information you give for the purposes of getting a vaccine at a pharmacy is protected by the Health Insurance Portability and Accountability Act (HIPAA).
But the data that isn’t protected can be valuable to the retail pharmacies you give it to. Walgreens, for instance, will use your data to target ads to you on its website, on social media, and in marketing emails — as detailed in Walgreens’ own privacy policy:
Walgreens makes it easy to sign up for all of this, and it’s particularly aggressive when it comes to data demands in general. For instance, it now forces customers to provide a valid email address to enroll in its myWalgreens loyalty program, which tracks all purchases made using your myWalgreens card. By the way, Walgreens also recently announced its Walgreens Advertising Group, a “modern, full-service, personalization-driven advertising offering rooted in insights and rich first-party data” advertisers can use to target ads to you. The source of that “rich first-party data”? That’d be the loyalty program.
What’s not so easy is deactivating your Walgreens account if you so choose after you’ve gotten your vaccine. In fact, you can’t even do it online. You have to call Walgreens customer service at 1-877-250-5823.
The Centers for Disease Control and Prevention (CDC) told Recode that its agreement with participating pharmacies asks them to use an online scheduling system for vaccine appointments for social distancing purposes, and it lets pharmacies use their own. So Walgreens used its existing system, which requires patients to make an account. Walmart did the same, though it at least offers patients the ability to opt out of receiving marketing emails when they register, and doesn’t require anything beyond a name and email to create the account.
As was the case with Walgreens, getting rid of your Walmart account once you no longer need it is a more onerous process than creating it. In its instructions for how to close your account, Walmart simply says to “contact our Customer Care team for assistance” without providing instructions on how to do that. But if you scroll down the page a bit, you’ll see a “contact us” button. Click that, and tell the chatbot that will pop up that you want to deactivate your account, and then pick your preferred method of contact (online chat, phone, or email). This will take several minutes, but your account will be deactivated.
Rite Aid and CVS, who, along with Walgreens and Walmart, get the majority of the vaccines distributed through the program, told Recode that they don’t require patients to sign up for an account to get a vaccine, but neither responded to follow-up questions about if they collect data from patients for non-vaccine purposes, how it might be used, and if there’s a way to opt out of data collection or delete whatever data has already been collected. CVS did tell the Wall Street Journal that it would “stay in touch” with customers after they received their second shot and hoped to market products to them. The company also said it would encourage patients to join CVS’s loyalty program while they were at their vaccine appointments. Similar to Walgreens, CVS has an advertising arm, announced last August, which relies on data collected through its loyalty program.
Recode also reached out to several other companies that the federal government has partnered with to provide vaccines, including Albertsons, Costco, Kroger, and Publix, for comment on if and how they were collecting data on their patients. Costco was the only one to respond, saying that it appreciated my “interest and support” and had no comment.
All that said: Get the vaccine. Yes, you might have to sign up for a store account first and that’s not ideal. Yes, it would be nice if the government had put some restrictions in place so retail pharmacies weren’t allowed to collect and use your data in this way. And yes, some pharmacies are taking advantage of a terrible situation to profit off of you, because most businesses will do absolutely everything they can to make money and your data is valuable. But your life and your health are even more valuable — even if you have to make some privacy compromises to preserve them.
Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.
