Search histories, location data, text messages: How personal data could be used to enforce anti-abortion laws

New York (CNN Business) Update: This story was originally published on May 6. It has been updated to reflect the Supreme Court's final decision.

The Supreme Court's Friday ruling to overturn Roe v. Wade is almost certain to spark a wave of new state legislation taking aim at abortion rights, and to reinforce existing laws that prohibit and, in some cases, criminalize the procedure. Among the wide-ranging potential implications of the decision are concerns about the potential use of personal data to punish people who look for information about or access to abortion services online.

In some of the most restrictive states, digital rights experts warn that people's search histories, location data, messages and other digital information could be used by law enforcement agencies investigating or prosecuting abortion-related cases.

On Friday, the Supreme Court struck down Roe v. Wade, the 50-year-old ruling that guaranteed a person's Constitutional right to terminate a pregnancy before viability (usually around 24 weeks). A draft of the opinion leaked in May. Overturning the landmark 1973 court ruling is expected to transform the landscape of reproductive health in America, leaving abortion policy up to individual states and potentially paving the way for more than 20 states to pass new laws restricting abortions.

Even before the ruling, concerns about the digital privacy implications of abortion restrictions had started to arise amid a movement by Republican-controlled states, including Georgia, Texas, Mississippi and Oklahoma, in recent years to pass laws severely curtailing access to the service.

America is a much different place today than in the pre-Roe era: Because of the pervasiveness of the Internet and mobile technology, people today share vast troves of data about themselves — whether they realize it or not — opening the door to significant surveillance. The possibility of a complex patchwork of state laws following the rolling back of Roe v. Wade raises a host of new questions about the everyday technology Americans use to make health decisions and how it might be used to enforce those laws, and could create confusion about what online behavior is permitted or not.

For example, in states that make it a crime to help an abortion-seeker, data from women's period-tracking or pregnancy apps could end up being subpoenaed as evidence against the person who helped them, said Danielle Citron, a law professor at the University of Virginia and author of the forthcoming book "The Fight for Privacy." "Let's say you got your period, stopped your period and then got your period again in a short time," Citron said. "It's [potential] evidence of your own criminality, or your doctor's criminality."

Groups promoting digital rights and reproductive freedoms are now warning people in states that criminalize providing access to abortions to safeguard their digital footprints when seeking abortion information and resources online and sharing tips for how to do so.

"We are living in a much more surveilled culture than we were in 1972 and prior, so in a future where abortion rights are limited or there's not a federal right, people will be at risk for exercising their bodily autonomy," said Elisabeth Smith, director for State Policy and Advocacy at the Center for Reproductive Rights. "The consequences of those decisions are likely to fall hardest on Black, brown, Indigenous people of color."

A growing number of US lawmakers have expressed alarm about the potential misuse of advertising data to prosecute abortion-seekers. In May, dozens of congressional Democrats wrote to Google saying that the company's practice of collecting and storing vast troves of geolocation data from cellphones "will allow it to become a tool for far-right extremists looking to crack down on people seeking reproductive health care." And on June 24, the same day the Supreme Court struck down Roe v. Wade, another group of US lawmakers wrote to the Federal Trade Commission saying Apple and Google should face an agency investigation over ad practices that they said could end up harming abortion-seekers.

"Data brokers are already selling, licensing, and sharing the location information of people that visit abortion providers to anyone with a credit card. Prosecutors in states where abortion becomes illegal will soon be able to obtain warrants for location information about anyone who has visited an abortion provider," wrote the group, which included Sens. Ron Wyden, Elizabeth Warren, Cory Booker, and Rep. Sara Jacobs. "The FTC should investigate Apple and Google's role in transforming online advertising into an intense system of surveillance that incentivizes and facilitates the unrestrained collection and constant sale of Americans' personal data."

Much has also changed in the reproductive health care landscape since Roe v. Wade was decided in 1973. Self-managed abortions and online pharmacies that provide abortion medication are increasingly accessible options, especially for low-income people or those in rural areas or states that restrict access to in-person abortion services. The US Food and Drug Administration in December lifted a requirement for patients seeking abortion medications to pick them up in-person, instead allowing the pills to be sent by mail.

Although a number of states, including Texas, prohibit receiving medication abortions through telehealth, that does not necessarily stop online pharmacies and services in other countries, such as the European-based Aid Access, from mailing the medications to people in those states. Web traffic to online abortion resource site Plan C — which offers information on how to find abortion medications and how to use them — increased from 500 people per day to 25,000 per day immediately after Texas banned most abortions after six weeks in September, before leveling out to about 2,500 a day, according to Elisa Wells, Plan C's co-founder and co-director.

"Most people go directly to our 'Find Abortion Pills' directory that we have," Wells told CNN Business. "Disproportionately these people are from states that have laws on the books that restrict access."

Various online behaviors could become part of investigations and court proceedings in states where helping to provide access to abortions is criminalized, including internet searches, location history, call and text logs, emails and financial records, according to Cynthia Conti-Cook, a civil rights attorney and tech fellow at the Ford Foundation. Any part of a person's digital footprint is fair game once a device is in law enforcement's possession, she said.

"As long as abortion and abortion-seeking related conduct is what is criminalized, all of that information can be totally fair game," Conti-Cook told CNN Business. She added that law enforcement has the forensic tools at their disposal to view virtually everything a person does on their device — but only once the device is in their possession. Unless voluntarily handed over, a phone and all its data typically cannot be accessed without a search warrant.

Various state-by-state laws governing abortion care raise novel questions about what role an abortion-seeker's internet usage might play. "In a state like Texas, Oklahoma, Mississippi, if someone orders pills online, they are doing so outside of the laws of that state," Smith said. "Because they have prohibited telemedicine and more states are passing laws prohibiting the possession of medication abortion, there is the risk of criminalization when people do not follow the laws of their state."

Some lawmakers have even put forward proposals that would effectively ban citizens from getting out-of-state abortions. Missouri state representative Elizabeth Coleman is pushing a provision that would allow citizens to sue anyone who "aids or abets" a Missouri resident in getting an abortion, including out of state doctors, friends who help arrange transportation or even hosting a website that "encourages or facilitates efforts" of Missouri residents to get elective abortions. And other states could follow suit.

Law enforcement could also use so-called geofence warrants, which request from internet companies a list of devices within a certain boundary at a certain time. Such warrants are gaining popularity as a law enforcement tool for various alleged crimes — the number of geofence warrants submitted to Google by US police departments rose from 982 in 2018 to 11,554 in 2020, according to the company's latest transparency report. (For its part, Google says that in some cases, it requests to provide less information or declines to provide such information at all.)

In at least one case, search history data has already been used to prosecute people who seek information about abortion services. In 2018, Latice Fisher was indicted by a Mississippi Grand Jury for second degree murder after an at-home pregnancy loss. While the criminal charges against Fisher were ultimately dropped, law enforcement pointed to alleged internet search results such as "buy abortion pills, mifeprisone online, misoprostol online" to argue their case. (Mifepristone and misoprostol are the two pills frequently taken together by women performing self-managed abortions.)

In anticipation of the passage of more restrictive laws, advocacy groups are promoting education on digital privacy and sharing information on how to seek reproductive health services safely online.

The Digital Defense Fund created a guide for women on how to keep digital footprints protected when seeking information on abortions. It includes tips such as opting out of personalized ads on Google and social media sites to minimize tracking, turning off location sharing and using privacy-focused browsers like DuckDuckGo or Firefox Focus that do not save search data, collect personal information or allow third-party trackers.

When seeking abortion information, the guide also recommends using end-to-end encrypted messaging apps like Signal or WhatsApp to keep calls and messages private (these apps also offer timed auto-delete features for messages). Unlike a phone company with access to SMS text messages, the developers of such apps can't access the content of encrypted messages, and therefore could not be compelled by a court to share them.

Other privacy steps individuals seeking abortion information can take to protect their internet browsing include using anonymous browsing service Tor or Virtual Private Networks (VPNs) and using incognito search windows, according to the Digital Defense Fund. While it is nearly impossible to completely hide digital history, experts say such methods can help to minimize risk and make it difficult for law enforcement to seize data.