We extend a special thanks to our external reviewer Sara Geoghegan from the Counsel Electronic Privacy Information Center (EPIC) reviewer for their feedback.

EXECUTIVE SUMMARY

• A year and half post-Roe, ad tech companies continue to surveil abortion seekers on abortion scheduling and abortion advocacy websites.

• While ad tech companies make it incredibly difficult to avoid tracking, medical providers and advocacy organizations should take steps to minimize tracking on abortion scheduling and patient-facing informational pages.

• Abortion seekers should not let these concerns stop them from seeking care, and the risk to any one individual is likely low at this stage, but the long-term implications are dire.

I.    PR Instead of Privacy

Soon after the U.S. Supreme Court eliminated constitutional abortion rights in 2022’s Dobbs decision, Google’s parent company Alphabet proclaimed that it would protect abortion seekers by deleting abortion clinic location data rather than letting it fall into the hands of police.[1] “Privacy matters to people—especially around topics such as their health,” Google declared.[2] But nearly two years later, the company’s actions raise questions about how much our health privacy matters to Google.[3]

Despite aggressive public relations efforts, Google, Meta (owner of Facebook, Instagram, and WhatsApp), and fellow ad tech companies have continued to track traffic to abortion websites, collecting data that could be easily weaponized by police against abortion seekers and providers. The companies even track abortion appointments booked online. On Planned Parenthood’s website, abortion seekers are asked: where are you, how long have you been pregnant, and what medical service are you seeking?[4] Questions like these may be routine in most medical intake forms, but when captured by ad tech platforms, they provide police a digital dragnet for identifying thousands of abortion seekers.

Tech companies routinely snap up data from abortion scheduling webpages on an enormous scale and without patients’ consent to monetize our health data. A full year and a half after Dobbs, this problem persists, with ad tech firms still lurking on abortion advocacy sites and scheduling pages, quietly collecting user data and putting abortion seekers at risk.

II.    Trackers, Trackers Everywhere

Shortly after Dobbs, many abortion advocates were shocked to find out that Planned Parenthood, the nation’s largest, most trusted provider of abortion care, had embedded commercial trackers that could identify visitors to its website.[5] But rather than this being an effort to “tell” Google and Facebook about abortion seekers, as some framed the issue, it spoke to the breadth of commercial surveillance built into modern internet platforms.[6] Regardless of the cause, the importance of the tracking is hard to overstate. Prosecutors in abortion-banning states could subpoena ad tech companies for abortion-related data to confirm that individuals sought abortions and to identify yet-unknown abortion seekers. Easier yet, they could buy that data from brokers known for selling compromising lists identifying pregnant people.[7] Overnight, Planned Parenthood moved to boot ad tech companies from its appointment scheduling pages.[8] But sadly, eluding surveillance capitalism isn’t that easy.

While Planned Parenthood was able to remove a large number of commercial trackers for a time, a follow up review in January 2024 found that they and many other leading abortion providers were leaking visitor data. In fact, S.T.O.P.’s survey of nine major abortion advocacy organizations’ websites reveals trackers on every group’s website (see Table 1 below). This includes both ad trackers, which send data on a website’s visitors to advertisers, and third-party cookies, which build personal profiles on a website’s visitors as they continuing to browse the internet.

Table 1. Ad Tech on Abortion Advocacy Websites

Google collects data on nine out of nine organizations’ websites, and even on two organizations’ abortion-finding pages.[9] Facebook Pixel, which serves targeted ads on people’s Facebook pages, comes in second, with five of nine websites. Everyone from household names like X (formerly Twitter) and Microsoft to more obscure ad-tech players pile onto the “all you can track” cookie buffet. Planned Parenthood’s website interacts with the most ad tech companies, likely reflecting the scale of its healthcare operations (providing more than 374,000 abortions and 9 million individual health services in 2022) and its national advocacy work (which may involve outreach to website visitors).[10]

Alarmingly, trackers appear on the most sensitive website pages: sites’ abortion finders and patient-focused abortion resources. Google Analytics’ ad tracker appears on Planned Parenthood’s abortion finder, where prospective patients reveal their zip codes, pregnancy dates, and desire to book an abortion.[11] Such details likely have little value to the vast majority of advertisers, but they are priceless to abortion seekers. Notably, other organizations we evaluated avoid this issue by hosting abortion finders on separate domains without trackers. Facebook Pixel and Google Analytics also lurk on less sensitive but potentially incriminating pages such as Planned Parenthood’s “Abortion: Information About Your Options” and the National Women’s Health Network’s detailed abortion resources page. [12] Police and prosecutors can use visitor data for these webpages to make a circumstantial case that someone sought or obtained an abortion.

III.   Ad Tech on Anti-Abortion Websites

Notably, some of the first groups in line to buy data identifying abortion seekers are anti-abortion organizations. Far too frequently, abortion seekers searching for help find promoted content for “crisis pregnancy centers” instead: facilities that can provide propaganda and pressure, but no medical services.[13] Historically, crisis pregnancy centers targeted abortion seekers with deceptive ads in college newspaper ads and on roadside billboards.[14] Today’s bait-and-switch happens online and is much more profitable. Google made over $10 million in two years by showing ads for crisis pregnancy centers to people searching online for abortion pills and abortion resources.[15] These centers also embed ad tech on their own websites, with 300 such clinics using Facebook’s Pixel.[16] As of January 2024, we found Google on every single crisis pregnancy center website that we checked (see Additional Ad Tech column in Table 2 below).

Table 2. Ad Tech on Crisis Pregnancy Center Websites

Google’s ad trackers and analytics and other companies’ creepy cookies aren’t just invasive—they are the most powerful marketing technologies on the internet. These trackers are built into many of the tools that make digital organizing possible, enabling the mass movements that can drive millions to take action.[17] For those both providing abortion services and fighting abortion restrictions, this creates a catch-22. The exact same technology that helps power protests and push through abortion protections is also collecting data that can be used to put your patients in jail. And even for medical providers who don’t engage in activism, these platforms help engage with prospective and current patients digitally, turning an unwieldy mess of web traffic data into useable insights.[18]

Unfortunately, the digital deck is stacked against reproductive rights groups. Abortion advocates always have to operate under the threat police will target them or their clients, whereas crisis pregnancy centers work hand in hand with police, expanding the criminalization of evidence-based medicine. Because crisis pregnancy centers have less to lose than abortion advocates and providers if their data is leaked, purchased, or even seized with a warrant, they operate online with a structural advantage, able to leverage invasive marketing tools without the fear of harming those they seek to talk out of getting care.

IV.   $250 per Health Care Record

Notably, ad tech’s appetite for our health data goes far beyond abortion. Google tracks over 98% of U.S. hospitals’ homepages, while Facebook monitors 55%.[19] Facebook even collects appointment scheduling data from an estimated third of hospital websites.[20] Even worse, when these trackers are found to violate federal or state privacy protections, it is health providers (not tech companies) who have been left holding the bag. In 2022, two Massachusetts hospitals settled with patients for $18.4 million after Google, Facebook and other ad tech companies scooped up private patient data.[21]

If Google and Facebook had to buy health records on the open market, their cost would be prohibitive. An identified individual’s healthcare record cost $250, on average, in 2021—50 times the cost of an identified individual’s credit card data (~$5) and 500 times the cost of an identified person’s social security number (~50 cents).[22] Free, tracker-sourced data is an essential component of these companies’ business models.

V.   Harm/Surveillance Reduction Strategies

Mass digital communications almost always involve privacy and usability tradeoffs. Unfortunately, many of the most usable, scalable platforms are also inextricably intertwined with tracking technologies that leak users’ data to third parties.[23] Simply abandoning these platforms is completely unworkable for most smaller organizations, and even the largest advocacy groups would struggle to completely cut out these technologies. The same exact tools that are a threat to abortion seekers are invaluable to advocates organizing political campaigns and public communications strategies. Without these systems, many would be left completely cut off from any understanding of how their messaging resonates with the public.

As a starting point, organizations can audit their websites, minimizing the number of trackers throughout. This process should be repeated frequently throughout the year to look for new plugins and features that might inadvertently leak users’ information. Advocacy groups that provide abortion services should go a step further, specifically protecting information on the portions of their websites that are used for obtaining abortion access or which otherwise demonstrate the intent to obtain an abortion.

The National Network of Abortion Funds and Power to Decide both accomplish this by completely siloing abortion-finding resources on a second, tracker-free website. Both organizations use the types of trackers that are common for all political advocacy organizations on their main websites but redirect users to a second tracker-free domain for help finding and paying for an abortion. Other organizations stop short of creating an entirely separate domain for abortion access but limit the number of trackers on pages dedicated to abortion scheduling and access.

VI.   Health Privacy Laws

American privacy laws are notoriously lax, but a growing array of new privacy laws, regulations, and administrative interpretations of existing protections could create liability for organizations that fail to adequately protect user data. Both tech companies and abortion advocacy and provider organizations could face litigation and fines.

The 2022 settlement with two Massachusetts hospitals is far from the only case.[24] The same year, two proposed class actions alleged that Facebook illegally captured users’ medical information, with one naming a hospital as a defendant.[25] Separately, a proposed class action targets Google for tracking Planned Parenthood’s abortion-scheduling website.[26] Planned Parenthood is not a defendant, but plaintiffs still claimed it illegally “disclosed Plaintiff’s and Class members’ medical information.”[27] Notably, California’s Confidentiality of Medical Information Act requires patients’ written consent prior to releasing their medical records.[28]

Providers could minimize liability by obtaining informed consent for sensitive health data. Such an approach would satisfy new regulatory guidance on the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).[29] Alternatively, providers can use HIPAA-compliant trackers that don’t collect health information. However, such trackers cannot magically detect what information is and is not protected by HIPAA. Instead, it is a labor-intensive task for website operators to ensure that they are only providing the tracker the appropriate non-health data.[30]

Unfortunately, many of these strategies are far more effective at limiting website operators’ liability than they are at protecting users’ data. If providers choose instead to reduce the data collected and shared, particularly health data from abortion scheduling pages, they can much more effectively eliminate the need to obtain users consent for specialized trackers in the first place. For the most sensitive uses, the best practice would seem to be doing away with trackers entirely, eliminating the possibility of errant trackers creeping back onto an abortion scheduling page. A number of abortion-finding resources, including those mentioned previously, demonstrate that it is possible to provide abortion information without ad tech and completely separate from any abortion advocacy organization’s primary website.

VII.   Conclusion

Surveillance capitalism has baked tracking into nearly every element of our digital lives, making it slow and expensive for organizations to engage online in privacy-preserving ways. While there are no easy answers for those providing life-saving medical services and crucial campaigns against the rollback of reproductive rights, there are harm reduction strategies to mitigate the risk of tracking.

More importantly, this is a moment of accountability for the tech giants that built the web as we know it. Either we can continue to put profit above privacy, or we can protect democracy. While these companies have been quick to make press releases about their “values,” they are slow to make any changes that impact their profits. While Google has taken some steps to reduce geolocation data in response to Dobbs, Google and Facebook must urgently reassess every type of data they collect from abortion providers. In addition, states can go much further to enforce health privacy protections against the ad tech industry overall. Ultimately, the only safe way, for abortion seekers and their advocates, is to take on health surveillance capitalism entirely.

Social Media Graphics