The post-Roe data privacy nightmare is way bigger than period tracking apps
Multiple iOS apps are reportedly sharing sensitive data with Facebook (updated)
An ovulation app tells Facebook when users have their period, according to the WSJ.
At least 11 popular apps are reportedly sharing people’s sensitive data with Facebook, even if they don’t have an account on the social network. The Wall Street Journal found that apps which can help track personal information such as body weight, menstrual cycles and pregnancy are sending such details to Facebook.
The apps that were found to share personal data include Flo Period & Ovulation Tracker, BetterMe: Weight Loss Workouts, Breethe, Realtor.com and Instant Heart Rate: HR Monitor. The report suggests none of these apps had an option for users to prevent them from sharing personal data with Facebook, nor do they necessarily make it clear to people their data is making its way to Facebook’s servers. The publication was only able to specifically decipher the types of data that iOS apps send Facebook, but a third-party test determined at least one Android fitness app shares weight and height data too.
Thousands of apps use a Facebook analytics tool called App Events that lets developers track user activity. Developers can set up “custom app events,” which can be used for ad targeting. That’s how the apps identified in the report are sending data to Facebook. While the data is apparently anonymized in some cases, there are sometimes markers that could let Facebook match some of it to users.
The social network doesn’t seem to be directly at fault here. It instructs developers not to share “health, financial information or other categories of sensitive information” with it. The company told the WSJ developers have to make it clear to users what data they’re handing Facebook, and that some of the reported information-sharing practices seem to violate its terms.
Facebook said it will force the apps mentioned in the report to stop sharing sensitive data and take action against developers if they don’t comply. It also claimed it doesn’t use sensitive data captured in custom app events to personalize products like ads and the News Feed, and it automatically deletes some types of intimate data it receives, including social security numbers.
Meanwhile, Apple requires app developers to obtain consent from users before collecting their data and to take measures to stop unauthorized third parties from gaining access to that information. Google’s policies state apps have to “disclose the type of parties to which any personal or sensitive user data is shared.” The app-makers might also face repercussions under privacy rules like the European Union’s General Data Protection Regulation.
Update 2/24 2:20PM ET: Flo Health has provided a response, stressing that it takes security “extremely seriously” and that it has “never sold any data point” or relied on sensitive info for ads. It has, however, deleted the Facebook developer kit from its app and asked to delete user data from Facebook Analytics. It’s conducting an external privacy audit as well. You can read the full statement below.
“We take users’ privacy and data security extremely seriously which is why Flo has never sold any data point to Facebook as well as we never used sensitive data from Facebook Analytics for advertisement. We utilized Facebook Analytics tool, as many other apps do, for us to ensure our app offers the best experience for our users. To clarify, any use of these tools was for internal development only to improve our functionality and service to our users. We also adhere to all legislation around data privacy and security. As a precaution, we have deleted the Facebook SDK from the app and have requested to delete all user data from Facebook Analytics. We will also be conducting a comprehensive data privacy external audit and would encourage any user with concerns to contact us via our dedicated email privacy@flo.health.”
After midnight, her husband called 911. EMTs rushed to Fisher’s home to find a blue and unresponsive fetus in the toilet, covered in feces and blood. The child was eventually pronounced dead at OCH Regional Medical Center.
What seemed like the end of a tragic story was only the beginning—and technology played a pivotal role.
For prosecutors, the central question was whether or not Latice Fisher gave birth to a stillborn or a living baby. Did Fisher have a tragic accident or was she a neglectful murderer?
A state medical examiner determined that the baby had been born alive through what’s called a “lung flotation” test, a controversial and unreliable method likely developed in the 1600s in which a baby’s lung is placed in water. But prosecutors still needed a motive, and for that, they turned to Fisher’s cellphone data. On it, they found internet search results for inducing a miscarriage and terms like “buy misoprostol abortion pill online.” Fisher admitted to investigators that she didn’t want any more children, according to court documents as reported by the Starkville Daily News. EMTs said the child appeared to be “greater than 35 weeks in gestation,” later than it is medically recommended to take the abortion pill.
In January 2018, a grand jury in Oktibbeha County indicted Latice Fisher on a charge of second-degree murder. If convicted, she faced up to 40 years in prison.
A combination of old world medicine and new world technological policing helped indict Latice Fisher. With respect to the latter, she’s not alone.
New challenges to getting a legal abortion online
The internet has opened up an entire world for self-managed abortion, when a person chooses to have an abortion outside of a medical setting. As abortion clinics become less accessible, it can be a lifeline for those who live in places with little or no access to a clinic. Commonly called the “abortion pill,” medication abortion, a combination of mifepristone and misoprostol, is available for purchase online and can be shipped directly to a prospective patient’s front door. Women on Web, a nonprofit organization that provides online information and access to abortion, has an online service that can connect visitors in highly restricted countries with a licensed doctor who can provide them with medication abortion. Some sites, like Plan C, will connect people with medication abortion suppliers online. Costs range from $90 to $430.
While most abortions happen at a clinic or hospital, self-managed medication abortions are still legal and the drugs are approved by the U.S. Food and Drug Administration and are recommended by the World Health Organization. The technology used to access them can be a much-needed friend. But for some women, like Fisher, it can also be their very serious foe.
That’s because Roe v. Wade, the landmark Supreme Court Ruling that legalized abortion nationwide in 1973, is at serious risk. Since 2011, states have passed more than 400 restrictions on abortion. This spring, the Supreme Court is set to hear a challenge to a Louisiana law that requires abortion providers in the state to have admitting privileges at a local hospital, a seemingly benign requirement that is both medically unnecessary and designed to force abortion clinics to close. The Court could uphold the law, leaving Louisiana with only one abortion clinic, or worse: It could overturn Roe v. Wade entirely.
The very technology they turned to for assistance has helped to prosecute them.
For now, abortion, whether in a clinic or at home, is protected by law. But abortion’s technical legality hasn’t meant legal protection for every woman seeking an abortion. States have banned abortion before Roe v. Wade technically allows; in Mississippi, Fisher’s home state, it’s illegal to perform an abortion past 20 weeks (a six-week abortion ban is currently blocked by a federal judge). These unconstitutional bans create a murky gray area for those who may choose later abortions.
The bans are coupled with what advocates say are overzealous prosecutors misusing “feticide” laws, which were initially passed as a form of protection for pregnant women and their fetuses against assault and battery during pregnancy. The danger in these laws is that they elevate a fetus to a person in the eyes of the state. In that spirit, they have been used to criminalize pregnant women like Latice Fisher.
And the very technology they turned to for assistance has helped to prosecute them.
When paging Dr. Google becomes a nightmare
Internet search histories can give law enforcement a supposed map to your intent. In Fisher’s case, her internet search results gave prosecutors a motive—if she wanted to be pregnant, why was she looking up medication abortion? District Attorney Scott Colom ultimately accused Fisher of purchasing misoprostol online and trying to induce her own abortion, resulting in the death of her child.
“The most harmful type of digital evidence is online search browsing history,” says Cynthia Conti-Cook, a technology fellow who studies how technology is used to criminalize abortion at the Ford Foundation. “At least as it’s presented by the prosecution, it gives them evidence of intent, when otherwise they’re trying to piece it together through circumstantial evidence.”
The most harmful type of digital evidence is online search browsing history.”
Cynthia Conti-Cook
Without a search warrant, Fisher wasn’t legally required to give law enforcement access to her phone, but she did anyway. Ultimately, her digital footprint became a crucial piece of prosecutorial evidence.
“There is a sort of assumption that it’s safe to share your digital devices with law enforcement, with nurses, with doctors, with anyone who would potentially refer you to a prosecutor,” Conti-Cook says. “I think people really need to realize how much of their lives is digitally captured in their phone and can potentially expose them to risks that they are not prepared for.”
It’s not just internet search results that can lay the groundwork for overzealous prosecutors seeking to punish women for what happens to their pregnancies. It can sometimes be as simple as the texts you send your friends.
In 2015, Purvi Patel, a South Bend, Indiana, woman, was convicted of feticide and child neglect and sentenced to 30 years in prison after she took medication abortion while pregnant. Central to her conviction was a series of text messages between her and a friend in which Patel confided that she was pregnant and that she had searched for medication abortion online.
When she began to have complications, Patel and her friend texted back and forth until Patel went to an emergency room with heavy vaginal bleeding. She later admitted that she had miscarried a stillborn fetus and left it in a trash bag in a nearby dumpster. Patel, the daughter of conservative Indian immigrants who did not believe in premarital sex, was afraid of their reaction when they found out she was pregnant.
Unlike Fisher’s case, law enforcement did obtain a search warrant for Patel’s phone. The unencrypted text messages between friends served as the basis of the prosecution’s case against her, and helped lead to her ultimate conviction of feticide and child neglect in 2015.
Patel was eventually released after the feticide conviction was overturned by a judge. In his ruling, Judge Terry A. Crone criticized prosecutors for charging Patel with feticide, stating that there was “no evidence that lawmakers intended the [feticide] law to punish pregnant women.”
Whether or not they’re using an ancient form or pills on the internet, none of it should be criminalized. It’s just that simple.”
Renee Bracey Sherman
Many cases that criminalize self-managing an abortion or having a stillbirth target women of color. In 2001, the first woman in the United States to be arrested, prosecuted, and convicted for experiencing a stillbirth was Regina McKnight, a black woman experiencing homelessness in South Carolina. In 2015, a 23-year-old black Georgian woman named Kenlissia Jones faced the death penalty after she delivered a stillborn fetus at five and a half months. A social worker at the hospital where Jones was taken told police officers that Jones had purchased Cytotec, the name-brand for misoprostol, online. Ultimately, after a national public outcry, the murder charge was dropped.
“We are criminalizing folks of color who are taking their healthcare into their own hands, either by choice or because the state and this nation are barring them from access in other ways,” says Renee Bracey Sherman, executive director of We Testify, an organization of abortion storytellers. “And then we are punishing them for making that decision. Whether or not they’re using an ancient form or pills on the internet, none of it should be criminalized. It’s just that simple.”
The dark side of technological policing
Reviewing text messages, call logs, and internet searches is fairly standard police protocol, and the tech industry’s collaboration with law enforcement is a source of much debate. What happened to Fisher and Patel is reflective of law enforcement bringing its more common investigative tactics to criminalizing self-managed abortion, critics say.
“People just may not be familiar with [these tactics] because they’re not already thinking about the ways that law enforcement [is] using people’s personal data,” says Farah Diaz-Tello, a senior counsel at the reproductive justice legal organization If/When/How. “The fact is, technology is already being used in the criminalization of pregnancy outcomes.”
This could extend beyond Google searches and text messages. Take “geofencing,” the micro-targeting advertising tactic that uses GPS to send messages directly to your mobile device when you enter a designated area. According to Cynthia Conti-Cook of the Ford Foundation, geofencing offers a distinct way to surveil pregnant women.
The fact is, technology is already being used in the criminalization of pregnancy outcomes.”
Farah Diaz-Tello
In fact, geofencing has already been weaponized against abortion. In 2015, John Flynn, the CEO of Copley Advertising in Boston, became a hero to abortion opponents for creating a geofencing strategy in which he sent advertisements with messages like “You Have Choices” and “You’re Not Alone” directly to patients’ mobile devices while they were waiting in a Planned Parenthood clinic. In a 2017 settlement with the state of Massachusetts, Flynn agreed to stop using the geofencing technology at Massachusetts healthcare facilities. But that prohibition only applies to Massachusetts.
As advertisers become more adept at targeting consumers using a plethora of data available about our locations, and as we ourselves become ever-more digitally connected, our online footprint could easily form the basis of a prosecution’s case. If a pregnant woman is at a substance abuse center, for example, her phone will know. Pregnant women who struggle with substance abuse have already been targeted for criminalization, particularly in anti-abortion states such as Tennessee and Alabama. Armed with granular location data, prosecutors could follow a similar path.
“We remain hopeful because we have to be”
While the full dystopian hellscape of complete and total reproductive surveillance may not be here yet, abortion’s legality has meant little for those who have already been criminalized for their pregnancy outcomes.
According to Diaz-Tello, the criminalization of women of color will likely continue from law enforcement and prosecutors, rather than the legislature. “The likelihood that we’re going to see a state pass one of these horrible ‘abortion murder’ bans that makes it a crime for a person to have an abortion still seems quite low,” she explains. “But the possibility that people are going to continue to be arrested, that feels like it’s increasing.”
As for Latice Fisher, after a wave of criticism from reproductive rights advocates and substantial questioning of the validity of the lung float test, Scott Colom dropped the charges against her in the spring of 2018. “I dismissed the charge based on new evidence about whether the child was born alive,” Colom says.
However, it’s possible that Fisher could be charged with second-degree murder again. When asked about whether he planned to bring her case before a grand jury again, Colom indicated that he wasn’t sure. For now, Fisher is free. For how long depends on Colom and a potential grand jury.
“We remain hopeful because we have to be,” says Fisher’s lawywer Aarin Williams, senior staff attorney of National Advocates for Pregnant Women. “And we know that the law is on Ms. Fisher’s side.”
(37)