From California to Massachusetts, state lawmakers want tougher controls on data brokers to protect privacy and prevent abuses. — Image by Freepik
WASHINGTON: With abortion bans elsewhere in the United States forcing women to travel to clinics in her state, Massachusetts lawmaker Kate Lipper-Garabedian wanted to make sure no one could trace their steps by buying their cellphone location data.
Called the Location Shield Act, state legislation proposed by Lipper-Garabedian would be the first in the country to prohibit the sale of cellphone location information to data brokers.
It reflects growing concern among abortion rights advocates that women seeking a termination could be subjected to location data surveillance, whether by law enforcement in states with bans or by anti-abortion campaigners.
“In the absence of national legislation, it’s important for the state to lead in this area,” Lipper-Garabedian, a Democrat, told the Thomson Reuters Foundation, adding that she hopes for a vote on her proposed law early next year.
According to September research, Massachusetts has seen a 38% increase in out-of-state abortions since the US Supreme Court ruled in June 2022 to overturn the national right to abortion, prompting numerous states to ban or restrict the procedure.
Massachusetts has state laws that protect access to abortion, allowing the procedure up to 24 weeks of pregnancy.
At the same time, states with total or highly restrictive bans including Idaho, Texas, Oklahoma and Tennessee have been seeking to outlaw residents from travelling to other states to have abortions.
A case in November highlighted the potential risks for abortion seekers. Media reports said an Idaho woman and her son were charged with kidnapping after police used cellphone data to establish that they had taken his minor girlfriend to another state to obtain an abortion.
Data brokers
The Massachusetts bill reflects broader privacy concerns about the availability of personal information held by data brokers or aggregators, a global industry estimated at about US$200bil (RM936.50bil) a year and comprising thousands of companies.
“This information is incredibly revealing,” said Kade Crockford, director of the American Civil Liberties Union’s Massachusetts Technology for Liberty Project, which is supporting the Location Shield Act.
“It’s pretty much everything about someone’s life, ranging from how long they spend in the gym every day ... to whether they’re having an affair, or if they’re seeking treatment for substance-use disorder.”
Tech companies say such data is useful for a variety of purposes, including aiding efforts to prevent fraud or money laundering.
But the Massachusetts bill would essentially be a blanket ban on selling cellphone location data, said Chris Mohr, president of the Software & Information Industry Association (SIIA), which represents about 450 companies.
“What’s really dangerous is that an overbroad regulation essentially ends up being a proxy war for different policy preferences,” he said.
“There are such things as abusive data practices and uses. But what is unhelpful is a debate that takes place around this atmosphere of moral panic and imprecise terms,” he added.
Invasive
For Crockford, part of the problem is that location data is often harvested by apps that people download to their phones without realising it is being collected and then made available for sale to brokers – with opting out made extremely difficult.
Often the first time most people find out about the public availability of such information “is when they Google their name, and websites come up promising home addresses or phone numbers”, said Thomas Kadri, an assistant law professor at the University of Georgia School of Law.
While location data does not appear to be the most common type of information that brokers deal with, he said, it can feel particularly invasive and can have particularly devastating effects on survivors of abuse.
Kadri, who has published a paper on how data brokerage “enables and exacerbates interpersonal abuse”, recalled how one survivor had been alarmed to find records of their traffic violations on a data broker’s website.
“Their reaction was, well, if (an abuser) can get access to the traffic tickets, that could tell them all sorts of things about where I was driving, where my car is registered,” he said.
States seek to fill gaps
Federal efforts are underway to regulate the trade in cellphone data.
In Congress, lawmakers are seeking to bar brokers from offering health and location data, and create a single mechanism by which people can request their information be removed or not collected.
Regulators with multiple agencies are also working on proposals that could place new limitations on the work of brokers, including creating additional consumer protections.
But as in Massachusetts, slow progress on nationwide legislation is driving state lawmakers to try to fill the gaps.
In October, California Governor Gavin Newsom signed the Delete Act into law, requiring data brokers to register with the state and specify if they gather location data. It also establishes a mechanism letting people request the removal of their data from brokers’ databases.
The law is “the most decisive example we’ve seen of a state legislating against the business of data brokers” and could have ripple effects nationally, said John Davisson, director of litigation and senior counsel at the Electronic Privacy Information Center, a watchdog group.
Consumers appear eager for more ways to control their data.
In October, consumer protection nonprofit Consumer Reports released a tool aimed at helping people ask companies to delete or stop selling information about them, including location data, and has already drawn more than one million requests, a spokesperson said.
Davisson said there is increasingly widespread appreciation of the sensitivity of location data and the need for industry-wide regulations.
“I’m sure it’ll be messy at times, but I think we’re moving in the right direction,” he said. – Thomson Reuters Foundation
