Two Years Post-Dobbs: A Commercial Surveillance Landscape That is Confusing, Complicated, and Harmful to Abortion Seekers

Two years ago, the Supreme Court rescinded the constitutional right to an abortion in its Dobbs v. Jackson Women’s Health Organization decision. Reproductive privacy is an issue that encompasses bodily autonomy, decisional privacy, and—in an increasingly surveilled state in the digital age—data privacy. EPIC works to enshrine and protect a person’s right to choose abortion health care, advocates for limits on harmful consumer profiling that could reveal pregnancy status and other health conditions, and promotes strong data minimization rules that would prevent personal information related to or revealing reproductive health care from being accessed by law enforcement.

Dobbs and the Surveillance State

In a analysis published immediately following the Dobbs decision, EPIC explained how commercial surveillance undermines reproductive privacy and autonomy. Companies and government entities collect vast amounts of data about people, including highly sensitive location information. Location data can reveal intimate characteristics about a person, including religion, sexual orientation, sexual activities, gender identity, union membership, political affiliation, and conditions—including pregnancy status. This personal information, including location information, is purchased by the government, data brokers, and advertisers. Data brokers operate in opaque ways to use secret algorithms to profile consumers. They use these profiles to target consumers with advertisements, fed by information that could reveal pregnancy status, among other attributes. Data brokers can collect information from health-related applications, including period tracking apps. Unbeknownst to most consumers, much of this health-related data falls outside of the scope of HIPAA and is therefore not protected.

In the past two years since the Dobbs decision, several states have criminalized abortion or the act of helping a person obtain an abortion. This threatens the privacy of patients and physicians alike, leads to confusion and anxiety, and prevents individuals from searching for abortion-related information online. Patients live in confusion about whether seeking an abortion, traveling to obtain care, or driving a friend to another state to obtain care is illegal. Physicians in states that have criminalized abortion practice in fear, often unsure of whether they must turn records over to law enforcement, if they are able to direct patients to obtain pills online, or if a patient’s condition is sufficiently serious enough to be considered life-threatening such that an abortion becomes legal. In some states, the number of doctors practicing obstetrics and gynecology has dropped significantly since the Dobbs decision. Across the country, clinics have closed, which leaves patients without access to vital health care.

As commercial surveillance increases, the threats to privacy—including reproductive privacy—follow suit. For example, the explosion of Generative AI (GAI) in recent years poses a threat to health privacy. GAI systems are fed data that is scraped indiscriminately from the internet or collected by online platforms. Hospitals’ websites may transmit individuals’ health information via tracking technologies: Facebook’s pixel was found on 1/3 of the top hospitals’ websites which had sent patient data to Facebook. People’s sensitive health information, including pregnancy status, may be used to train a GAI system. When this happens, the outputs that the system produces may contain some of the information that was fed into the system, revealing a person’s private health information. Because GAI is often built on indiscriminately scraped information, it frequently produces inaccurate results. ChatGPT incorrectly described medication abortion as dangerous with an increased risk of complications. Without meaningful limitations on the collection, use, and retention of personal information, surveillance capitalism will continue to threaten reproductive privacy and autonomy.

The Continued Degradation of Privacy Rights

The erosion of privacy rights by the Supreme Court in its Dobbs decision has had a ripple effect on other health care related choices. For example, Alabama’s Supreme Court held that embryos created through in vitro fertilization (IVF) were considered children. Until the Alabama legislature narrowly overrode the court’s decision through legislation, the court’s decision meant that a person in Alabama who destroyed an embryo—a typical practice when IVF treatments are finished—could have been liable for wrongful death. Anti-abortion advocates have advocated for this type of fetal personhood standard, which carries the disastrous effect of criminalizing abortion care and IVF. People who cannot to conceive children for myriad reasons, like cancer patients or same-sex couples, suddenly became afraid that they could not undergo IVF treatment or move embryos to another state for fear that they would be destroyed in transport. The decision was widely unpopular, prompting the Alabama legislature to pass a law protecting IVF patients and providers from liability. Yet fears remain in Alabama and for IVF patients across the country surrounding the uncertainty of the safety and accessibility of the practice in the future.

State legislatures have also been emboldened by Dobbs to restrict access to gender-affirming care. 24 states across the country have enacted laws that prevent access to gender-affirming care to transgender youth. Similar to the trend in reproductive health care, state legislatures and courts have encroached upon the private medical decisions between a patient and their doctor with respect to gender affirming care. The Dobbs decision has enabled states to usurp decision-making from patients. These harmful and invasive bans limit an individual’s ability to make their own medical decisions and discourage youth from seeking out health care from a professional. This leads to health risks—including depression, anxiety, and suicidality—and encourages youth to obtain information about their health and bodies elsewhere, which may be inaccurate or harmful. Physicians in states that have banned gender-affirming care must worry about criminalization and may practice in fear or stop providing some treatments entirely. These invasions of privacy are a dangerous trend. When legislatures and courts overstep to make medical decisions on behalf of an individual, it opens the door to more and more extreme invasions of privacy, including limits on gender affirming-care for adults and “bathroom bills,” which prohibit transgender people from using bathrooms that correspond with their gender.

Restrictions on access to abortion care have long inflicted the greatest harms on marginalized communities, a problem which a majority of the Supreme Court exacerbated in the Dobbs decision. The harms of Dobbs are felt most acutely by Black, Latino, and Indigenous people, people with low incomes, transmen, nonbinary folks, immigrants, youth, and people living with disabilities. Incarcerated persons and people on probation or parole are subjected to further barriers, including delay and the humiliation of asking permission to obtain an abortion. The Prison Policy Institute found that 82% of women on probation or parole nationwide are impacted by abortion and supervision restrictions. In other words, “the ability to seek abortion care out-of-state is left not to the pregnant person, but to the discretion of a correctional authority, typically their probation or parole officer.” States continue to erode privacy rights virtually unchecked, threatening the safety of everyone, but the burden falls hardest on the most vulnerable people.

A Patchwork Cannot Fix This

While courts have made decisions to strike down or uphold abortion-related laws, and state legislatures have worked to pass laws criminalizing or protecting abortion, people across the country have been left in a confusing legal patchwork. Reproductive health care advocates, abortion funds, and activists have worked tirelessly to help people obtain abortion care across the country. Meanwhile, states, policymakers, and government agencies have passed confusing and often contradictory rules, legislation, and policies. This leaves people across the country scrambling for care, uncertain of what actions are legal where they live, and anxious of what rights will be eroded next. For example, the Department of Health and Human Services published a rule that extends the HIPAA Privacy Rule to protect reproductive privacy by prohibiting covered entities from using or disclosing personal health information related to lawful reproductive health care. While parts of this updated rule are promising, EPIC has explained that this rule falls short of adequately protecting abortion patients across the country by limiting the scope of its protections to lawful care. This leaves people in states where the reproductive care they are seeking has been criminalized without the protection of the HIPAA Privacy Rule.

While many states have worked to ban abortion, some states have enacted shield laws that aim to protect abortion seekers and physicians. Unfortunately, one strong state law cannot provide help for people elsewhere in the country struggling to obtain abortion care—which is why we need comprehensive protections. Washington recently enacted its pioneering health privacy law, the My Health, My Data Act. EPIC’s Suzanne Bernstein analyzed the current legal landscape and the effect of Washington’s law, available here. She wrote:

Although Congress has yet to pass a comprehensive privacy law, over a dozen states have passed comprehensive privacy laws, and there is momentum for other states to enact similar laws. While these laws vary in many ways, basic state-level regulation of how companies manage data collection, retention, and sharing with third parties can be a boon to safeguard reproductive privacy. In addition to comprehensive state privacy bills, Washington state has enacted the landmark My Health My Data Act, which specifically governs health data privacy. This law also prohibits geofencing around any entity that provides health care services, like an abortion clinic or reproductive health care facility. Geofencing is the use of technology like Wi-Fi or cell tower data to create a boundary around a physical location or to locate a consumer within that boundary. This provision of the law could play an important role in limiting the collection and use of location data for criminalizing abortion care or other reproductive health care. Following Washington, Nevada also passed a health privacy law, illustrating the momentum to protect consumer health data, including reproductive information.

As EPIC has previously explained, most of the enormous volume of heath data collected by devices and applications, as well as personal information collected online that could reveal a person’s health conditions, fall outside of the scope of HIPAA. This data is largely unprotected. Without a federal general comprehensive privacy law, this collection of this information leaves people vulnerable to harmful commercial profiling and law enforcement access. A law that includes a strong data minimization framework can prevent these harms by limiting the collection, use, and retention of personal information to the extent necessary for the purpose for which the data was collected. This means that using personal information in out of context ways, like to create a consumer profile to target a user with ads or retaining personal information indefinitely (such that it may be misused or accessed by law enforcement agencies), would be unlawful. Companies like Google have recognized the harm from retaining users’ location information when it could reveal whether a person visited an abortion clinic. But as EPIC and Accountable Tech pointed out in our complaint to the FTC concerning Google’s harmful location data practices, Google has repeatedly failed to uphold promises to protect users’ privacy. People deserve more privacy protections than a pinky promise from a tech company. In the last two years since the Dobbs decision, it has become even more urgent that we need to protect access to reproductive health care and cement strong safeguards for digital privacy. Congress must act to pass comprehensive privacy legislation with meaningful limitations on the collection, use, and retention of our personal information to mitigate some of the most harmful effects of Dobbs.

Upcoming Event

If you are interested in learning more, please join us for dinner, drinks, and a discussion of Two Years Post-Dobbs: The legal landscape of reproductive data privacy hosted by EPIC and GW’s Ethical Tech Initiative (ETI). Panelists include Professor Sonia Suter, Sara Geoghegan, and Suzanne Bernstein, moderated by Co-Director of ETI Professor Dawn Nunziato. The event will be held on Wednesday 6/26 at 6pm in Lisner Hall at 2023 G St NW.

Date/Time: Wednesday, June 26th 6-8pm. 

Place: GW Law, 2023 G St NW, Lisner Hall, Second Floor, Student Conference Center (SCC)

RSVP here.