Overturning Roe v. Wade Sparked a Number of Privacy Bills, but None Are a Quick Fix

When the news of the leaked draft opinion on the Supreme Court’s decision to strike down Roe v. Wade broke out in May, it set off a flurry of bills to regulate the future of data privacy. Introduced in April, the Fourth Amendment is Not for Sale Act closes the legal loophole that allows data brokers to sell people’s personal information to law enforcement without any court oversight. In June, Rep. Sara Jacobs (D-Calif.) introduced the My Body, My Data Act to limit how much personal reproductive health data firms can collect, store and share. At the same time, data companies swore off tracking, collection, use and transfer of precise location data from sensitive places, including health care services. This came as an attempt to self-regulate in the absence of a federal privacy law. Outside of Roe v. Wade, the House of Senate and committee leaders released a bipartisan federal privacy bill to regulate the tech industry and give people more power over their privacy through frameworks like opt-in consent. Data companies sit on a mine of personal information and—legally—law enforcement has access. Although the bills intend to minimize the impact of Roe and shift more responsibility on tech companies for data collection, loopholes still exist. The ultimate solution lies in the right to be forgotten at a federal level, according to sources. “Because this is a very highly charged issue, you're going to have law enforcement in states where abortion is illegal to get extremely aggressive,” said Gary Kibel, a privacy and data security lawyer of Davis and Gilbert. “Because they want to make a political point.” In light of the Roe ruling, here's a run-down of the scope of these bills and their impact on the ad-tech industry. Different bills, similar loopholes Currently, government agencies are able to purchase data, such as the location of a person, without getting court warrants from a third-party source. The Fourth Amendment is Not for Sale Act intends to put an end to that. “The bill is drafted in a way to say that getting some of this digital data could be an unreasonable search and seizure,” said Kibel, thereby setting “limits in terms of what you can collect and do [with data].” However, the bill lacks standards to determine what information should be accessible to law enforcement. For example, law enforcement could come after data companies with a court warrant where they want to look at a woman's location information from her phone—and companies may have to comply since there is no basis regarding why law enforcement would need that data. Similarly, the federal privacy bill does not directly affect Roe, but data—such as geolocation—would be subject to opt-in consent under the bill. This could create a problem from a data privacy standpoint, according to Matt Voda, CEO of OptiMine, where the federal proposal does not address the patchwork state-wide abortion ruling. In that case, “websites and apps offering information on abortion services might avoid collecting location data, since they don’t want to have that sensitive data on their potential patients,” said Kibel. Ultimately the onus lies on companies, according to Klover CEO Brian Mandelbaum, where companies need to be transparent with people about their data collection practices. “Collecting geolocation data just to sell it to somebody else and not provide a service, that is where consumers and government want to draw the line,” said Mandelbaum. Google Quietly Cuts Access to API Exposing Sensitive User Data Self-regulation is a safe bet, not the solution Digital period tracker apps like Flo, with 200 million users worldwide, doubled down on their privacy efforts with an anonymous mode where people don’t have to provide their name or email address. The company also said it does not sell peoples' personal data and users can delete it at any time. But this does not protect the company from having to oblige if law enforcement makes a demand for information they have, according to Kibel. Similarly, Google announced it would auto-delete location entries from people’s accounts shortly after visiting “particularly personal” medical facilities, including abortion clinics, Google senior VP Jen Fitzpatrick wrote in a blog post last week. The change will take effect in the coming weeks. “It’s a good first step but doesn’t fix the problem,” said Voda. “There is a substantial risk with other kinds of data stored.” Meanwhile, data companies like Cuebiq and Foursquare have implemented a self-regulation framework that entirely restricts data use tied to sensitive locations. “Until there’s a right to be forgotten at a federal level and have that data eliminated, there is an untold risk for people,” said Voda.