Data Broker Is Selling Location Data of People Who Visit Abortion Clinics

It costs just over $160 to get a week’s worth of data on where people who visi­ted Plan­ned Parent­hood came from, and where they went after­wards.

A loca­tion data firm is selling infor­ma­tion rela­ted to visits to clinics that provide abor­ti­ons inclu­ding Plan­ned Parent­hood faci­li­ties, showing where groups of people visi­ting the loca­ti­ons came from, how long they stayed there, and where they then went after­wards, accor­ding to sets of the data purcha­sed by Mother­bo­ard.

The data sale is obvi­ously more impor­tant in the context of a leaked Supreme Court draft opinion in which Justice Alito indi­ca­ted that the court is ready to repeal the deci­sion in Roe v. Wade, the deca­des-old prece­dent that has provi­ded fede­ral protec­ti­ons to those seeking an abor­tion. If that draft does become a formal deci­sion, it would imme­di­a­tely fully or partly ban abor­tion rights in at least 13 states.

How data collec­ting inter­sects with abor­tion rights, or the lack thereof, is likely to gather more atten­tion in the wake of the draft. The country may also see an incre­ase in vigi­lante acti­vity or forms of survei­llance and harass­ment against those seeking or provi­ding abor­ti­ons. With this aggre­ga­ted loca­tion data avai­la­ble to anyone on the open market, custo­mers could include anti-abor­tion vigi­lan­tes as well. Anti-abor­tion groups are alre­ady fairly adept at using novel tech­no­logy for their goals. In 2016, an adver­ti­sing CEO who worked with anti-abor­tion and Chris­tian groups sent targe­ted adver­ti­se­ments to women sitting in Plan­ned Parent­hood clinics in an attempt to change their deci­sion around getting an abor­tion. The sale of the loca­tion data raises ques­ti­ons around why compa­nies are selling data based on abor­tion clinics speci­fi­cally, and whet­her they should intro­duce more safe­guards around the purchase of that infor­ma­tion, if be selling it at all.

“It’s bonkers dange­rous to have abor­tion clinics and then let some­one buy the census tracks where people are coming from to visit that abor­tion clinic, ” Zach Edwards, a cyber­se­cu­rity rese­ar­cher who closely tracks the data selling market­place, told Mother­bo­ard in an online chat after revi­e­wing the data. “This is how you dox some­one trave­ling across state lines for abor­ti­ons—­how you dox clinics provi­ding this service.”

In the wake of a near-total abor­tion ban in Texas, for exam­ple, people in Texas seeking abor­ti­ons have incre­a­singly had to travel to other states where abor­tion access is easier to get the care they need. With Roe set to fall, people seeking abor­ti­ons who live in conser­va­tive states and can afford to are likely to start trave­ling to get an abor­tion. Loca­tion data could play into whet­her and how that travel is iden­ti­fied, making it even more urgent for regu­la­tors and lawma­kers to consi­der how loca­tion data is collec­ted, used, and sold.

The company selling the data is Safe­Graph. Safe­Graph ulti­ma­tely obtains loca­tion data from ordi­nary apps insta­lled on peoples’ phones. Often app deve­lo­pers install code, called soft­ware deve­lop­ment kits (SDKs), into their apps that sends users’ loca­tion data to compa­nies in exchange for the deve­lo­per recei­ving payment. Some­ti­mes app users don’t know that their phone—be that via a prayer app, or a weat­her app—is collec­ting and sending loca­tion data to third parties, let alone some of the more dange­rous use cases that Mother­bo­ard has repor­ted on, inclu­ding trans­fer­ring data to U.S. mili­tary contrac­tors. Plan­ned Parent­hood is not the orga­ni­za­tion perfor­ming the data collec­tion nor bene­fi­ting from it finan­ci­ally.

Safe­Graph then repac­ka­ges that loca­tion data and other data into vari­ous products. On Tues­day Mother­bo­ard repor­ted that the CDC bought $420,000 worth of Safe­Graph data for a laundry list of COVID-19 and non-COVID-19 use cases. Google banned Safe­Graph from the Google Play Store in June.

Safe­Graph clas­si­fies «Plan­ned Parent­hood» as a «brand» that can be trac­ked, and the data Mother­bo­ard purcha­sed inclu­des more than 600 Plan­ned Parent­hood loca­ti­ons in the United States. The data inclu­ded a week’s worth of loca­tion data for those loca­ti­ons in mid-April. Safe­Graph calls the loca­tion data product “Patterns.” In total, the data cost just over $160. Not all Plan­ned Parent­hood loca­ti­ons offer abor­tion servi­ces. But Mother­bo­ard veri­fied that some faci­li­ties inclu­ded in the purcha­sed data­set do. 

Mother­bo­ard also sear­ched the Safe­Graph website for “Family Plan­ning, ” which retur­ned a rele­vant result of “Family Plan­ning Centers” that people could then buy data rela­ted to.

Safe­Graph’s Patterns data aims to answer ques­ti­ons like “how often people visit, how long they stay, where they came from, where else they go, and more, ” accor­ding to Safe­Graph’s website. Safe­Graph calcu­la­tes where it beli­e­ves visi­tors to a loca­tion live to the census block level. Safe­Graph does this by analy­zing where a phone is commonly loca­ted over­night, the company’s docu­men­ta­tion suggests.

Safe­Graph’s data is aggre­ga­ted, meaning it isn’t expli­citly specifying where a certain device moved to. Instead, it focu­ses on the move­ments of groups of devi­ces. But rese­ar­chers have repe­a­tedly warned about the possi­bi­li­ties of unmas­king indi­vi­du­als contai­ned in alle­gedly anony­mi­zed data­sets. 

Secti­ons of the Safe­Graph data­set Mother­bo­ard purcha­sed handle a very small number of devi­ces per record, theo­re­ti­cally making deanony­mi­za­tion of those people easier. Some had just four or five devi­ces visi­ting that loca­tion, with Safe­Graph filte­ring the data by whet­her the person used an Android or an iOS device as well.

On the data showing where people trave­led to a certain clinic based on their census block, poten­ti­ally across state borders, Edwards said “Safe­Graph is going to be the weapon of choice for anti-choice radi­cals attemp­ting to target ‘out of state clinics’ provi­ding medi­cal care.” Missouri is consi­de­ring a law to make it ille­gal to “aid or abet” abor­ti­ons in other states.

Trac­king visi­tors to abor­tion clinics has long been a staple in showing the threat posed by loca­tion data. In a 2018 inves­ti­ga­tion, The New York Times took loca­tion data and follo­wed multi­ple people inside it, and unmas­ked some of those. One of the people follo­wed visi­ted a Plan­ned Parent­hood faci­lity, accor­ding to the report.

Recently, a Chris­tian-focu­sed outlet The Pillar publis­hed a piece that used loca­tion data to track the move­ments of a speci­fic priest and then outed him publicly as poten­ti­ally gay without his consent.

Plan­ned Parent­hood did not respond to a request for comment. Safe­Graph did not respond to a request for comment either, which inclu­ded the speci­fic ques­tion of whet­her the company would conti­nue to sell loca­tion data rela­ted to abor­tion clinics.