Juul 2: Facebook merges with a drug cartel

E-cigarette company Juul has applied to the FDA for permission to market its Juul 2 e-cigarette, which allows two-way communication with the device, nominally to prevent youth use. Juul reports that the Juul 2 pairs with a phone app to verify a user’s age: “The user must upload their photo ID and take a real-time photo, then allow a third-party database to verify their identity.”

This may sound great, but this communication capability creates serious problems.

The first is the obvious invasion of privacy. Uploading verifiable photo IDs (such as driver’s licensees or passports) creates instant data security problems and raises the risk of identity theft. So does the use of third-party databases of photographs tied to specific people.

But, the even more pernicious issue is that it opens the possibility of two-way communication between the Juul device and Juul. Such communication would allow Juul to collect detailed information about the user’s puffing behavior, including how often they use Juul, how long the puffs are, the interpuff interval, perhaps even how hard they suck on the device, what flavor they use. This so-called smoking topography affects the nicotine delivery.

Cigarette companies have collected massive data on smoking topography and use that information to design analog cigarettes to manipulate topography and nicotine delivery to maximize addictive potential of their products.

With this detailed information in real time or near-real time, the Juul company could feed back information to the Juul device manipulate topography in ways that conventional cigarette companies could only dream about. Why? It would allow Juul to maximize addiction, consumption, sales and profits.

This is not a fantasy: as Jamie Ducharme points out in her book The Big Vape, Juul co-inventor James Monsees‘ worked on two-way communication with the Juul device that would allow Juul to collect data on details of user puffing patterns. The communication would allow Juul to remotely adjust the device to make it more addictive.   Ducharme reports that the new Altria-installed management stopped that work to avoid further controversy, it is not gone.  (Philip Morris’ heated tobacco product IQOS has bluetooth capability.)

Juul 2 is already being sold in England. In their marketing, Juul even says, “JUUL allows you to personalise your experience, because every JUUL journey is unique. Your needs might evolve through your journey, so try different flavours to find the most satisfying one today.” Indeed, they brad about the fact that the app the Juul device links to will

• Get insights into your usage and liquid levels
• Use data to understand your usage patterns

The problem is that once the data are on a cell phone, they can easily be sent to Juul, who can send commands back.

When Monsees (I think) and another Juul executive, Ashley Gould, met with Pam Ling and me as part of their charm offensive on kids several years ago, they asked what we thought of programming the device not to work in schools.  That means they can sense where it is and remotely control it.  Very scary.  I told them it was like Facebook merging with the Medellín drug cartel.

The Medellin cartel may be gone, but the combined risks of s invasion of privacy and consumer microtargetting combined with businesses who profit on delivering an addictive drug remains.

There is no way that handing this capability to Juul would be “appropriate for the protection of public health,” the standard the law requires FDA to apply when deciding whether to authorize the sale of Juul 2 in the USA. FDA should deny Juul’s application and applications for any other nicotine delivery systems that communicate with the internet.