In July, the Home Oversight Committee sent letters to knowledge brokers SafeGraph, Digital Envoy, Placer.ai, Gravy Analytics, and Babel Avenue in addition to 5 private well being apps interrogating their assortment and sale of individuals’s reproductive well being data. Earlier than that, Sen. Elizabeth Warren, D-Mass., wrote letters to SafeGraph and Placer.ai about their gross sales of location knowledge pertaining to abortion clinics—after which each corporations pledged to cease making that data obtainable on the market.
Amid intensifying conversations concerning the post-Dobbs v. Jackson Women’s Health Organization privateness surroundings in the US, notably for these with the capability to turn out to be pregnant, these congressional letters are hardly the primary time knowledge brokers have been accused of exploiting the info of pregnant individuals. Not too long ago, the Federal Commerce Fee (FTC) announced a lawsuit alleging that knowledge dealer Kochava offered location data linked to particular units that might hint people’ actions to reproductive well being clinics and different delicate places—data that additionally might “be used to determine medical professionals who carry out, or help within the efficiency of, abortion providers.”
However knowledge brokers have been beneath scrutiny for related conduct since lengthy earlier than Dobbs. In 2017, the Massachusetts lawyer common reached a settlement with the info dealer Copley Promoting—which surveilled girls and different individuals visiting abortion clinics, geofenced promoting round these clinics, after which enabled anti-abortion organizations to run anti-abortion advertisements to individuals sitting in clinic ready rooms. The settlement ensured that the corporate wouldn’t use geofencing applied sciences close to Massachusetts well being care services once more. For policymakers, authorized students, and residents making an attempt to guage knowledge privateness and knowledge brokerage dangers following the overturning of Roe v. Wade, this dangerous assortment and monetization of well being data underscores how knowledge privateness legal guidelines centered on these harms are sorely wanted—and the way state attorneys common might be able to punish and even preempt these abuses.
Knowledge Dealer Operating Anti-Abortion Advertisements to Individuals in Clinic Ready Rooms
Copley Promoting, LLC, in keeping with the settlement agreement, was an organization that offered geofencing know-how and promoting providers to its purchasers. Particularly, its know-how
usually encompasses the method of figuring out whether or not an internet-enabled system, equivalent to a smartphone, enters, exits, or is current inside a geographic space by way of using any data saved, transmitted, or acquired by the system, together with however not restricted to latitude, longitude, GPS (International Positioning System), data, IP (Web Protocol) tackle, wi-fi Web entry data, so-called Bluetooth know-how, Close to-Area Communication (‘NFC’) data, or system identification data.
Copley Promoting would “tag” smartphones or different units coming into or leaving an space after which would run ads on sure system purposes—which might run for as much as 30 days—based mostly on that location data.
In 2015, Copley Promoting and its one proprietor and worker John Flynn offered these capabilities to Bethany Christian Companies, an anti-abortion, Michigan-based, evangelical Christian group that gives adoption providers—although till 2021, to not LGBTQ+ dad and mom—and whose web site options articles about girls deciding to not get an abortion. In keeping with the settlement with the Massachusetts lawyer common, Copley Promoting geofenced medical services for Bethany Christian Companies, together with reproductive well being clinics, in New York Metropolis; Columbus, Ohio; Richmond, Virginia; St. Louis, Missouri; and Pittsburgh, Pennsylvania. It then enabled Bethany Christian Companies to run advertisements to units inside a geofenced space—together with abortion clinic ready rooms.
The advertisements had been titled “Being pregnant Assist,” “You Have Selections,” and “You’re Not Alone,” amongst others. Individuals who clicked on the advert had been “taken straight to a touchdown web page or webpage full with being pregnant choices data and entry to a reside cell chat with a Bethany being pregnant assist specialist”—in different phrases, a person who might attempt to speak or presumably manipulate the particular person out of receiving an abortion. Copley Promoting additionally offered these sorts of providers to RealOptions, an anti-abortion, so-called disaster being pregnant middle community in California, although the settlement didn’t present particulars concerning the providers that Copley offered to RealOptions. In each circumstances, the aim was to allow the anti-abortion organizations to focus on “abortion-minded girls” who “had been both near or entered the ready rooms of ladies’s reproductive well being clinics.”
Flynn said to the Massachusetts lawyer common that it could be attainable for him to “tag all of the smartphones coming into and leaving the almost 700 Deliberate Parenthood clinics within the U.S.”
The Massachusetts Legal professional Common’s Preemptive Motion
In 2017, the Massachusetts lawyer common entered right into a settlement settlement with Copley Promoting and Flynn. Whereas Copley Promoting, in keeping with the settlement, had not offered this sort of geofencing service in Massachusetts, the lawyer common believed it could be illegal for the person to take action beneath Massachusetts General Law Title XV, Chapter 93A § 2, which makes unlawful “unfair strategies of competitors and unfair or misleading acts or practices within the conduct of any commerce or commerce.” It’s because, in keeping with the settlement, this sort of geofencing “intrudes upon a client’s non-public well being or medical affairs or standing and/or leads to the gathering or dissemination of personal well being or medical info concerning the client with out his or her data or consent.”
Copley Promoting and Flynn denied breaking any regulation and went a step additional to “deny that they engaged in any wrongdoing.” Regardless of that declare, Copley Promoting and Flynn entered into an settlement with the state that they might not geofence, “both straight or not directly by way of others, the Neighborhood of any Medical Heart situated in Massachusetts to deduce the well being standing, medical situation, or medical remedy of any particular person.” Neighborhood was outlined within the settlement textual content as “a distance of 250 toes from the Perimeter of a Medical Heart.” A medical middle was outlined as “any facility that gives psychological or bodily well being care, remedy, counseling, or remedy by or beneath the authority or supervision of licensed well being care professionals,” together with hospitals, pressing care services, well being clinics, and household planning clinics. Apparently, the class of “Retail Retailer Pharmacy” was excluded from this definition, “even when such Retail Retailer Pharmacy administers vaccinations, performs blood stress screening, supplies drug prescription counseling, or engages in different such well being care actions.”
Zooming out for a second, there are simply 5 states within the U.S. with client privateness legal guidelines, as neatly summarized by the Worldwide Affiliation of Privateness Professionals:
- California—California Consumer Privacy Act, signed 2018, efficient January 1, 2020; California Privacy Rights Act, signed 2020, absolutely operative January 1, 2023
- Colorado—Colorado Privacy Act, signed 2021, efficient July 1, 2023
- Connecticut—Connecticut Data Privacy Act, signed 2022, efficient July 1, 2023
- Virginia—Virginia Consumer Data protection Act, signed 2021, efficient January 1, 2023
- Utah—Utah Consumer Privacy Act, signed 2022, efficient December 31, 2023
What the Copley Promoting case demonstrates, nonetheless, is that state attorneys common don’t essentially want a state client knowledge privateness regulation on the books to behave in opposition to exploitative knowledge assortment and use. Actually, robust privateness legal guidelines are wanted in the US—ideally, a complete federal privateness regime for all residents—and added sources and authorities for punishing privateness violations and knowledge abuses would go an extended method to stopping and mitigating hurt in opposition to people. Within the meantime, state attorneys common can nonetheless look to current laws on client safety and unfair or misleading acts or practices to strategy corporations with particular settlement agreements to cease their dangerous behaviors. Certainly, the Massachusetts lawyer common did precisely that—though the current phone-tracking and ad-targeting didn’t happen inside Massachusetts itself.
A lot of the coverage dialog about knowledge brokers and abortion- and pregnancy-related data has centered on direct gross sales of that data. That is actually an space for concern. The US’ federal well being privateness regulation, the Health Information Portability and Accountability Act (HIPAA), applies solely to a couple sorts of “lined well being entities,” equivalent to hospitals, and does not apply to a variety of corporations that may additionally gather people’ well being data—together with knowledge brokers, cell apps, web service suppliers, and social media platforms. These noncovered entities are subsequently free to gather, promote, license, or share this data as they see match. Additional, the sale of health- and pregnancy-related knowledge is of nice concern in a policing context, as a result of regulation enforcement does not require warrants to buy data on People—starting from location knowledge to particular data on individuals’s medical-related situations and actions. Legislation enforcement organizations imposing legal guidelines that criminalize abortion, notably on the state degree, might exploit this vector of information gathering as nicely, along with surveillance mechanisms like following people, tailing autos, monitoring state border crossings, utilizing facial recognition know-how, and deploying license plate readers.
This case research underscores that knowledge brokers’ exploitation of well being knowledge can also be regarding in a post-Dobbs surroundings. If knowledge brokers, advertisers, and plenty of different corporations can legally gather, analyze, and monetize people’ well being data with out substantial or any restrictions, they will allow anti-abortion actors to focus on individuals with ads. These ads might embrace misinformation. Journalistic reporting and academic scholarship have underscored the ways in which anti-abortion “disaster being pregnant facilities” unfold misinformation about abortions and being pregnant that endanger pregnant individuals’s well being. Knowledge brokers might additionally allow anti-abortion teams to run outright coercive ads to people who find themselves not too long ago pregnant or visiting care services—utilizing language, content material, and even direct communication (like by way of a chat field) that intimidates people and interferes with their potential to make selections freely and safely about their very own physique. Operating an advert to somebody sitting in an abortion clinic ready room can itself sign to the individual that an unknown third celebration, or a identified anti-abortion actor, is conscious of their location, which can also be fear-inducing.
Basically, this sort of surveillance can also be invasive. Residents don’t moderately have any data of third-party corporations that quietly surveil their places after which monetize the info on the open market. The argument made by the Massachusetts lawyer common underscores this level. Even when customers had been conscious this was taking place, it doesn’t imply they perceive how corporations and different actors are utilizing their knowledge—and it doesn’t change the truth that these corporations and actors can use the info to hurt individuals.
American policymakers and privateness students alike should push for stronger, short-term controls on knowledge brokerage practices that invade people’ privateness and place their well being, bodily autonomy, and bodily security in danger. This might embrace, for instance, outright bans on non-HIPAA-covered entities’ surveillance and sale of People’ well being situations, whether or not associated to being pregnant or regarding psychological well being situations, HIV/AIDS standing, surgical histories, and present drug prescriptions. Ready for a complete privateness regulation solely continues to go away people in danger. The hazard to pregnant individuals is in and of itself motive to behave, but failure to legislate round knowledge brokers additionally continues to pose dangers to elderly Americans and those with Alzheimer’s, survivors of domestic and intimate partner violence, and different weak communities. Within the interim, states can move their very own knowledge dealer rules, and state attorneys common ought to pay attention to this instance from Massachusetts—the place the federal government didn’t have to attend for hurt to happen in its personal state to behave.
Understanding the complete scope of information brokerage practices round well being knowledge, from surveillance to knowledge gross sales to enabling focused promoting, will solely higher inform regulatory responses and calibrate essentially the most pressing locations for speedy reform.