By Geoffrey A. Fowler and Tatum Hunter
Washington - When someone gets an abortion, they may decide not to share information with friends and family members. But chances are their smartphone knows.
The leak of a Supreme Court draft opinion proposing to overturn Roe versus Wade raises a data privacy flash point: If abortion becomes criminal in some states, might a person's data trail be treated as evidence?
There is precedent for it, and privacy advocates say data collection could become a major liability for people seeking abortions in secret.
Phones can record communications, search histories, body health data and other information.
On Tuesday, there was new evidence that commercial data brokers sell location information gathered from the phones of people who visit abortion clinics.
"It is absolutely something to be concerned about – and something to learn about, hopefully before being in a crisis mode, where learning on the fly might be more difficult," said Cynthia Conti-Cook, a technology fellow at the Ford Foundation.
It is now common for law enforcement to make use of the contents of people's phones, including location and browsing information. One case against an alleged January 6 insurrectionist drew upon thousands of pages of data from the suspect's phone as well as Facebook records, prosecutors said.
A major data source is our digital surveillance economy – Facebook, Google and apps galore – in which companies track consumers to figure out how to sell to them. The data may change hands several times or seep into a broader marketplace run by data brokers. Such brokers can amass huge collections of information.
That data is an easy target for subpoenas, or court orders, and many tech companies do not give straight answers about what information they would be willing to hand over. Google, for one, reports that it received more than 40 000 subpoenas and search warrants in the United States in the first half of 2021.
Police and private citizens alike could buy data and use it to investigate suspected abortions. Phone location information has been used by activist groups to target ads at people in abortion clinics to try to dissuade them.
Crunching all that data isn't easy, and law enforcement agencies have plenty of "lower-hanging fruit" to pursue, says Alan Butler, the executive director and president of the Electronic Privacy Information Center. Those more traditional methods include checking credit card records, collecting data from cellphone towers, and talking to friends and family members.
But it is tough to predict how restrictive state abortions laws would become if Roe versus Wade were overturned.
"Even a search for information about a clinic could become illegal under some state laws, or an effort to travel to a clinic with an intent to obtain an abortion," Butler said.
No matter what happens, the possibility of mass data-collection to enforce abortion bans will hang over the heads of people seeking abortions or helping others get them, said Nikolas Guggenberger, the executive director at the Yale Information Society Project. "People want to be on the safe side, so even if the law doesn't apply to what they're doing, it has a chilling effect."
Several groups have published citizen guides to avoiding surveillance while seeking an abortion or reproductive health care. The groups include the Digital Defense Fund, the Repro Legal Helpline and the Electronic Frontier Foundation.
Here are three potential contributors to the data trail on people seeking abortions – and how they might be used.
Location
Phones can collect precise information about your whereabouts – right down to the building – to power maps and other services. Sometimes, though, the fine print in app privacy policies gives companies the right to sell that information to other companies that can make it available to advertisers, or whoever wants to pay to obtain it.
On Tuesday, Vice's Motherboard blog reported that for $160 (about R2 500), it bought a week's worth of data from a company called SafeGraph, showing where people who visited more than 600 Planned Parenthood clinics came from and where they went afterwards.
This kind of data could be used, for example, to identify clinics that provide abortions to people from out of state in places where that is illegal.
SafeGraph CEO Auren Hoffman said on Tuesday that his company was discussing whether to stop offering aggregated data on physical traffic to abortion providers.
SafeGraph and companies like it do not usually sell the location information linked to names or phone numbers, although the company has come under fire from privacy advocates before and has changed some of its practices to make it harder to tie data to specific people.
"You can find someone to say they can de-anonymise the data, but if it could be done, someone would have written a paper by now," Hoffman said.
But privacy watchdogs say you can learn a lot by connecting the dots on multiple places a person has visited. For example, last year, a Catholic blog obtained location information originally generated by the dating app Grindr to out a priest as gay. Those behind the blog were able to infer that a person at a church-related location was also visiting gay bars.
Apple and Android phones offer settings to turn off location services for individual apps – or entirely for the phone. But doing so might prevent the operation of certain functions, such as transportation apps.
Search and chat histories
Searching for information about clinics and medications can leave a trail of records with Google, which in some cases saves queries to a user's profile.
In 2017, prosecutors used internet searches for abortion drugs as evidence in a Mississippi woman's trial for the death of her foetus.
A grand jury ultimately decided not to pursue charges, according to National Advocates for Pregnant Women. And last year, the Supreme Court of Wisconsin decided that detectives did not violate the rights of the convicted murderer George Burch when, operating without a warrant, they accessed downloaded data from his phone, including his internet search history.
Private messages also can become evidence. In 2015, text messages about getting an abortion helped convict a woman of child neglect and foeticide.
A 2020 report by Upturn, a non-profit organisation focused on technology and justice, found that law enforcement agencies use "mobile device forensic tools", which can give them access to internet histories as well as to unencrypted emails and texts, when investigating matters as varied as marijuana possession and graffiti.
People can take some steps to keep their search and chat histories private. Ford Foundation's Conti-Cook said people did not have to volunteer their phones when police asked, and they could opt for encrypted messaging apps and a virtual private network, or VPN, to obscure their identities while conducting searches.
Reproductive health apps
Millions of people use apps to help track their menstrual cycles, logging and storing intimate data about their reproductive health. Because that data can reveal when periods, ovulation and pregnancy stops and starts, it could become evidence in states where abortion is criminalised.
There is evidence that the companies play fast and loose with privacy. In 2019, the period tracker, Ovia, got pushback for sharing aggregate data on some users' family planning with their employers.
Last year, the Federal Trade Commission settled with the period-tracking app, Flo, after the app promised to keep users' data private but then shared it with marketing firms including Facebook and Google.
A recent investigation by Consumer Reports found shortcomings in the way five popular period-tracking apps handle the sensitive user data, including sending it to third parties for targeted advertising.
Period-tracking apps aren't defined as covered entities, so they can legally share data.
The Washington Post's Joseph Menn contributed to this report.