Data Broker Sold Data From 600 Planned Parenthood Visits to Anti-Abortion Group

According to a letter sent to government agencies on Tuesday by Sen. Ron Wyden (D-Oregon), a U.S. company tracked people’s visits to 600 Planned Parenthood locations in 48 states and sold that data to anti-abortion group the Veritas Society, which used the location data to orchestrate one of the largest anti-abortion ad campaigns in U.S. history.

“My office began to investigate Near in May 2023, after an investigation by the Wall Street Journal revealed that an anti-abortion organization used location data from Near to target anti abortion messaging and ads to people who had visited reproductive health clinics,” Wyden says in the letter. “The ad campaign reportedly ran from November 2019 through the summer of 2022, after the Supreme Court issued its decision in Dobbs v. Jackson Women’s Health Organization, permitting states to criminalize abortion.”

In a meeting with Jay Angelo, Near’s Chief Privacy Officer, Angelo confirmed that as of summer 2022, the company had not implemented any technical controls to prevent its customers from targeting individuals who visited sensitive facilities such as reproductive health clinics. Additionally, although the Federal Trade Commission (FTC) has said that data brokers are only permitted to sell location data that is obtained with informed consent, the people whose data was sold to the anti-abortion group did not consent or know that their private information was being sold.

“In the October 18, 2023, call with my staff, Mr. Angelo revealed that while he had put a stop to the company’s sale of data about Europeans, which is subject to Europe’s strong privacy law, the company was still selling location data about Americans,” the letter says. “He also confirmed that the data it sold about Americans was obtained without consent, which is generally the case with data from advertising exchanges.”

In 2018, the European Union enacted a strong privacy law called the EU General Data Protection Regulation (GDPR). In the absence of a similar federal privacy law in the U.S., multiple U.S. states, including California, Virginia, Connecticut, Colorado, Utah, Iowa, Indiana, Tennessee, Oregon, Montana, Texas and Delaware have enacted comprehensive data privacy laws.

While federal law has lagged behind these states, the FTC does have the power to prosecute companies for unfair or deceptive conduct, which can include the sale of consumers’ sensitive location data. Wyden has asked the FTC and the Securities and Exchange Commission (SEC), which can prosecute companies that misrepresent their business practices, to investigate Near for potential violations of the FTC Act and federal securities laws.

While Near is currently also under a criminal investigation for fraud, Wyden says in the letter that “prosecuting those individuals for engaging in financial fraud will not address Near’s corporate abuses, which harmed both the public and investors, nor protect consumers from further harm caused by the use of their data that was illegally collected, stored and sold by Near.”

In December 2023, Near announced that it was filing for bankruptcy and confirmed that it had entered into an agreement to sell its business. Wyden has urged the FTC to intervene in the company’s bankruptcy proceedings to ensure that Near destroys its illegally collected location and device data, in order to prevent the sale of the private data to another data broker.

“Given the sensitivity of the ill-gotten data sold by Near, the FTC must act to protect consumers from further harm,” Wyden said.

Protecting patient information has become increasingly important after the conservative-leaning Supreme Court undermined the constitutional right to an abortion in 2022.

“I discovered that data brokers are helping anti-abortion extremists exploit location data to target patients,” Wyden said on social media. “The prospect of how red-state prosecutors could abuse this information should terrify every single American with a smartphone.”

Several states, such as Washington, Connecticut and New York, have enacted abortion safe haven statutes as a preventive measure. These protective laws safeguard the privacy of location data, which could potentially reveal individuals’ visits to abortion clinics. Conversely, California and other states have implemented legislation restricting out-of-state law enforcement agencies’ ability to access specific data collected by major tech conglomerates such as Alphabet Inc. and Meta Platforms Inc. to combat this issue. However, no such laws currently exist at the federal level, which endangers the safety of people seeking abortions across the country.

“Federal watchdogs should hold the data broker accountable for abusing Americans’ private information. And Congress needs to step up as soon as possible to ensure extremist politicians can’t buy this kind of sensitive data without a warrant,” reads a press release about Wyden’s investigation into Near.

Last July, Wyden and other lawmakers introduced the Fourth Amendment Is Not For Sale Act, which would strengthen federal privacy protections. The bill would require that the U.S. government obtain court orders to compel data brokers to disclose information, and would prohibit law enforcement and intelligence agencies from purchasing data on individuals in the U.S. and American citizens abroad if it was acquired from a user’s account or device, or through deceptive means.

“The continued sale of our most sensitive information to and by shady data brokers not only fuels harmful surveillance advertising systems, but enables government agencies — from local police departments to state attorneys general to the FBI — to sidestep the Fourth Amendment,” Electronic Privacy Information Center counsel Sara Geoghegan said in a statement. “We urgently need to rein in data brokers and enact comprehensive privacy rules to protect us from these grave harms in the post-Roe era we live in.”