Pausa: A Mood App, an Insurer, and a Four-Second Consent Screen
Pausa is a free mood-tracking app with 2.1 million users; 16% are under 18. Users log daily mood, sleep, medication adherence, and free-text journal entries. Only 4% pay for the $6.99/month premium tier, and revenue is falling.
The growth team has negotiated a $1.4 million annual contract with a regional health insurer. Pausa would deliver weekly mood-index aggregates at ZIP-code level for the insurer's 340,000 members in the state, to support "population risk stratification and network design." The insurer says it will not use the data for individual underwriting.
The privacy notice accepted at signup reads: "We may share aggregated, de-identified information with partners to improve health services." Internal usability testing found 12% of users open that notice, with a median time on the page of 4 seconds. A staff engineer flagged that 61 ZIP codes in the state have fewer than 20 Pausa users. Legal says the arrangement is defensible because no individual is named. The head of growth argues that refusing the deal means layoffs in Q3.
1. Is the existing privacy notice a valid basis for this disclosure? Work through the standard you would apply rather than jumping to the conclusion.
Read the worked answer
Apply four tests: specificity, comprehension, voluntariness, vulnerability.
Specificity. "Aggregated, de-identified information with partners to improve health services" names neither the category of recipient (an insurer), the purpose (network design and risk stratification), nor the granularity (ZIP-weekly). No user could have predicted this deal from that sentence. Under GDPR Art. 5(1)(b) and 6(4) the new use is incompatible with the original one; under FTC-style unfairness analysis it is a material omission.
Comprehension. 12% open the notice and the median reader spends 4 seconds. Consent that is formally available and practically unread is not informed consent; it is a liability shield with a check box attached.
Voluntariness. The free tier is effectively the product, and there is no meaningfully chosen alternative, so consent to sharing is bundled with access to the service itself.
Vulnerability. 16% of users are minors logging mood and medication adherence - the most sensitive content the app holds. Their consent is at best parental and at worst nonexistent.
And the technical claim. 61 ZIP codes contain fewer than 20 users. An insurer that already holds its members' home addresses can intersect a 12-person mood index with its own roster. That is not de-identification; it is a join waiting to happen. "No individual is named" is not the standard, and legal's conclusion rests entirely on that standard.
2. Recommend a course of action, and address the growth lead's layoff argument explicitly.
Read the worked answer
Reject the contract as scoped; counter-offer at a granularity and population that survives scrutiny.
Counter-offer terms:
- State or multi-county level only, with a published minimum cell size (e.g., 50 contributing users) and complete exclusion of minors' data.
- Exclude free-text journal entries and medication fields entirely; limit delivery to the mood index and sleep.
- Explicit bar on use for underwriting, premium setting, or individual outreach, audited annually, with a termination right on breach.
- Independent expert determination of re-identification risk by a party the insurer pays for but does not select.
- A public transparency report naming the counterparty and the payment.
On the layoffs. The growth lead is making one empirical claim ("no deal, no jobs") and one normative claim ("therefore we should do it"). The empirical claim is testable: $1.4M against 2.1M users is roughly $0.67 per user per year, a rounding error next to fixing a 4% conversion rate - the alternatives should be priced before the principle is conceded. The normative claim proves too much: on that logic, any revenue shortfall licenses any data sale. If the deal proceeds, it should be because the revised version is defensible, not because Q3 is frightening. Minuting that reasoning matters, because a worse offer will arrive within a year.
3. Design a governance mechanism that would make future secondary uses defensible. Explain why notice-and-choice alone is insufficient here.
Read the worked answer
Notice-and-choice fails at 12% readership, so the mechanism must work without depending on users reading.
A workable structure:
- Purpose-based internal review. Every new secondary use goes to a standing data-ethics panel (clinical, legal, engineering, two user representatives) against a written test: necessity, proportionality, affected population, alternatives, named beneficiary. Decisions published in summary.
- A DPIA trigger list - minors, health data, insurer counterparties, granularity below county level. Any single trigger forces full review before signature.
- Just-in-time consent for genuinely optional uses. Not a wall at signup: a prompt at the moment the new use appears, with a one-tap decline that does not degrade the core product.
- Benefit sharing. If users' data generates revenue, define a return - free premium months, a research fund - rather than asserting the vague benefit of "improving health services."
- An independent steward holding the de-identification keys and approving each release.
Why. Consent is legitimate when it is a real choice about a described act. When the act is undescribed, the reader is 12%, and the alternative is losing the app, consent is a ritual that transfers risk to the user while transferring nothing back. Governance that constrains the company before the contract is signed is the only version that scales past the first deal.