Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1696597062592.pdf (United States)
July 7, 2022 Mr. Jeff White Founder & Chief Executive Officer Gravy Analytics, Inc. 45610 Woodland Road, Suite 100 Sterling, VA 20166 Dear Mr. White: The Oversight Committee is investigating the collection and sale of sensitive personal data related to access to abortion and other reproductive health services.
We are alarmed by recent reports that data broker companies, which aggregate consumer data from various sources, are selling the location data of individuals who have used these services, potentially allowing the misuse of this sensitive information to invade the privacy of those seeking reproductive health care.
1 People seeking abortion care today must contend with what one commentator called “an era of unprecedented digital surveillance,” where data about their location, search history, and health is constantly being collected and potentially accessed by others, including government agencies or private citizens seeking to harass or sue, without the individual’s knowledge or consent.
2 We seek information regarding your company’s practices to ensure the sale of this type of data does not endanger individuals seeking abortion services a nd other forms of reproductive health care.
On June 24, 2022, the Supreme Court overturned nearly 50 years of legal precedent with its decision in Dobbs v. Jackson Women’s Health Organization eviscerating the right to an abortion guaranteed in Roe v. Wade.3 According to the Guttmacher Institute, 26 states are certain or likely to ban abortion entirely following th is decision.
4 As of July 3, at least six states have banned abortion, three have bans currently being litigated, ten plan to institute bans or severe restrictions soon, and the legal status of abortion is threatened in 11 additional states.5 1 Data Broker Is Selling Location Data of People Who Visit Abortion Clinics, Vice Motherboard (May 3, 2022) (online at www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood).
2 Eva Galperin (@evacide), Twitter (June 24, 2022) (online at https://twitter.com/evacide/status/1540358180789620736?s=21&t=jHMi5PGACzO_-Gby1GXaWA).

3 Dobbs v. Jackson Women’s Health Organization, 597 U.S. ____ (2022).

4 Guttmacher Institute, Press Release: US Supreme Court Overturns Roe v. Wade (June 24, 2022) (online at www.guttmacher.org/news-release/2022/us-supreme-court-overturns-roe-v-wade).
5 Tracking Where Abortion Laws Stand in Every State, The Guardian (June 28, 2022) (online at www.theguardian.com/us-news/ng-interactive/2022/jun/28/tracking-where-abortion-laws-stand-in-every-state) (accessed July 3, 2022).

Mr. Jeff White Page 2 Almost 40 million women of reproductive age live in those states, along with many transgender and nonbinary people who will also be impacted.

6 Recent anti-abortion bans have pushed people to travel to nearby states to seek reproductive care.
For example, after Texas’s six-week abortion ban took effect on September 1, 2021, an average of 1,400 women in Texas went to one of seven nearby states to seek care each month—twelve times as many as typically sought out-of-state care before passage of the law.

7 Anti-abortion lawmakers and advocates are also pursuing legislation that would restrict people from leaving their state to seek abortion care in another state, and allow private citizens to sue anyone who helped them.
8 In March 2022, the Missouri legislature considered a provision to make it illegal to “aid or abet” an abortion for a Missouri resident, regardless of where the procedure occurs.9 Similarly, Texas’s abortion ban enables residents to become so-called “bounty hunters” by providing a financial incentive to sue others involved in providing or obtaining abortion care.
10 The collection of sensitive data could pose serious threats to those seeking reproductive care as well as providers of care—not only by facilitating intrusive government surveillance, but also by putting people at risk of harassment, intimidation, and even violence.

Geographic data collected by mobile phones may be used to locate people seeking care at clinics, and search and chat history referring to clinics or medication create digital bread crumbs revealing interest in an abortion.
11 Reproductive health applications, which have experienced numerous data privacy issues, have been known to “share information with data brokers, advertisers, and other third parties that are difficult to track.”12 One application was cited by the Federal Trade Commission for sharing data with Facebook despite promising users that data 6 Id.

7 Most Women Denied Abortions by Texas Law Got Them Another Way, New York Times (Mar.
6, 2022) (online at www.nytimes.com/2022/03/06/upshot/texas-abortion-women-data.html).

8 Antiabortion Lawmakers Want to Block Patients from Crossing State Lines, Washington Post (June 30, 2022) (online at www.washingtonpost.com/politics/2022/06/29/abortion-state-lines/).

9 Missouri House Blocks Effort to Limit Access to Out-Of-State Abortions, Missouri Independent (Mar.
29, 2022) (online at https://missouriindependent.com/2022/03/29/missouri-house-blocks-effort-to-limit-access-to-out- of-state-abortions/).

10 The Texas Abortion Law Creates a Kind of Bounty Hunter.

Here’s How It Works, New York Times (Sept. 10, 2021) (online at www.nytimes.com/2021/09/10/us/politics/texas-abortion-law-facts.html).
11 For People Seeking Abortions, Digital Privacy Is Suddenly Critical, Washington Post (June 24, 2022) (online at www.washingtonpost.com/technology/2022/05/04/abortion-digital-privacy/).
12 See, e.g., Cycle-Tracking Apps Stand Behind Their Privacy Policies as Roe Teeters, The Verge (May 6, 2022) (online at www.theverge.com/2022/5/6/23060000/period-apps-privacy-abortion-roe-supreme-court); Federal Trade Commission, Press Release: FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others (June 22, 2021) (online at www.ftc.gov/news- events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data- facebook-google); Period Apps Are A Privacy Nightmare—Should You Still Use Them?
An Expert Explains the Risks, Business Insider (Jan. 28, 2021) (online at www.businessinsider.com/period-apps-privacy-risks-ad-targeting- 2021-1).

Mr. Jeff White Page 3 would be kept private.


13 In a recent study, researchers found that 87% of the 23 most popular women’s health apps—including reproductive health apps—shared user data with third parties, yet just over 50% requested consent from their users.14 Data Brokers Provide Access to Extremely Sensitive Location Data Recent reporting indicates that data brokers have sold mobile phone location data from individuals who have visited health care clinics that provide abortions.
15 One data broker reportedly sold data revealing detailed information about people who visited clinics providing family planning and abortion services, including the origin of their trip, the clinic they visited, how long they stayed, and their destination afterwards.16 According to an investigation by Motherboard, reporters were able to obtain a week of mobile phone location data information for more than 600 Planned Parenthood locations for just over $160 from the data broker SafeGraph.17 Another location data firm, Placer.ai, offered access to mobile phone location data and heat maps that show approximately where people visiting Planned Parenthood clinics live.
18 Companies such as SafeGraph and Placer.ai obtain location data from apps installed on mobile phones and often do so without the knowledge of the app user.

19 Placer.ai, for example, has stated they have access to more than 500 apps and more than 20 million active devices.

20 13 Id.
20 13 Id.

14 Najd Alfawazan et al., Privacy, Data Sharing, and Data Security Policies of Women’s mHealth Apps: Scoping Review and Content Analysis, JMIR Mhealth Uhealth (June 5, 2022) (online at https://mhealth.jmir.org/2022/5/e33735).

15 Data Broker Is Selling Location Data of People Who Visit Abortion Clinics, Vice Motherboard (May 3, 2022) (online at www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood).

16 Safegraph Is Under Fire for Selling Abortion Data.
Its CEO Says More Changes Are Coming, Protocol (May 4, 2022) (online at www.protocol.com/enterprise/safegraph-auren-hoffman-abortion-data).

17 Id.

While not all 600 Planned Parenthood locations offered abortion services, Motherboard verified that facilities in the dataset do.

18 Location Data Firm Provides Heat Maps of Where Abortion Clinic Visitors Live, Vice Motherboard (May 5, 2022) (online at www.vice.com/en/article/g5qaq3/location-data-firm-heat-maps-planned-parenthood- abortion-clinics-placer-ai).
19 Data Broker Is Selling Location Data of People Who Visit Abortion Clinics, Vice Motherboard (May 3, 2022) (online at www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood); Location Data Firm Provides Heat Maps of Where Abortion Clinic Visitors Live, Vice Motherboard (May 5, 2022) (online at www.vice.com/en/article/g5qaq3/location-data-firm-heat-maps-planned-parenthood-abortion-clinics- placer-ai).
20 Location Data Firm Provides Heat Maps of Where Abortion Clinic Visitors Live, Vice Motherboard (May 5, 2022) (online at www.vice.com/en/article/g5qaq3/location-data-firm-heat-maps-planned-parenthood- abortion-clinics-placer-ai); Placer.ai, We’re All About the Data (online at www.placer.ai/resources/our-data/) (accessed May, 6, 2022).
Mr. Jeff White Page 4 Recently, both SafeGraph and Placer.ai have announced that they plan to limit access to this location data following reporting on these features, and other companies, such as Google, have updated their privacy practices and committed to purging the location data of users who visit abortion clinics.

21 However, there are still few safeguards against these practices.
In 2019, SafeGraph sold the Illinois Department of Transportation two years’ worth of raw location data for over 5 million monthly-active users that included “precise latitude and longitude, a timestamp, a device type, and a so-called ‘anonymized’ device identifier.”22 In 2021, Google banned SafeGraph from its Android app store over SafeGraph’s selling of users’ location data.23 This data could also be used by private “bounty hunters” that have been authorized in some states to sue others involved in providing or obtaining abortion care.
24 These bounty hunters could target individuals seeking abortion care by purchasing location data from data brokers.

While this data is generally aggregated when sold, researchers have warned that it is possible to identify specific individuals even with allegedly “anonymized” data sets.

25 Sensitive location data has already been used to target individuals seeking abortions.
In 2015, an advertising firm in Massachusetts used a tactic called “mobile geo-fencing,” to target “abortion-minded” patients sitting in Planned Parenthood clinics with advertisements for RealOptions, a network of crisis pregnancy centers in California, and Bethany Christian Services, an evangelical adoption agency.26 The firm claimed to have reached more than 800,000 18-to-24-year-old women with this tactic.
27 Another anti-abortion marketing firm, 21 SafeGraph, Press Release: Demystifying the SafeGraph Facts (May 3, 2022) (online at www.safegraph.com/blog/demystifying-the-safegraph-facts); Placer.ai, Press Release: Placer.ai Statement on Planned Parenthood News Reporting (June 16, 2022) (online at www.placer.ai/blog/placer-statement/); Google, Press Release: Protecting People’s Privacy on Health Topics (July 1, 2022) (online at https://blog.google/technology/safety-security/protecting-peoples-privacy-on-health-topics/); Health Tech Companies Are Scrambling to Close Data Privacy Gaps After Abortion Ruling, STAT News (July 2, 2022) (online at www.statnews.com/2022/07/02/roe-abortion-flo-clue-data-privacy/).
22 Electronic Frontier Foundation, Illinois Bought Invasive Phone Location Data from Banned Broker Safegraph (Aug. 19, 2021) (online at www.eff.org/deeplinks/2021/08/illinois-bought-invasive-phone-location-data- banned-broker-safegraph).

23 Google Bans Location Data Firm Funded by Former Saudi Intelligence Head, Vice Motherboard (Aug. 12, 2021) (online at www.vice.com/en/article/5db4ad/google-bans-safegraph-former-saudi-intelligence).

24 The Texas Abortion Law Creates a Kind of Bounty Hunter.
Here’s How It Works, New York Times (Sept. 10, 2021) (online at www.nytimes.com/2021/09/10/us/politics/texas-abortion-law-facts.html).
25 Data Broker Is Selling Location Data of People Who Visit Abortion Clinics, Vice Motherboard (May 3, 2022) (online at www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood); Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret, New York Times (Dec. 10, 2018) (online at www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html).
26 Anti-Choice Groups Use Smartphone Surveillance to Target “Abortion-Minded Women” During Clinic Visits, Rewire News Group (May 25, 2016) (online at https://rewirenewsgroup.com/article/2016/05/25/anti-choice- groups-deploy-smartphone-surveillance-target-abortion-minded-women-clinic-visits/).

27 Id.

In 2017, Copley Advertising reached a settlement with the Attorney General of Massachusetts that prohibited the company from targeting around Massachusetts healthcare facilities.
See Office of the Attorney General of Massachusetts, Press Release: AG Reaches Settlement with Advertising Company Prohibiting “Geofencing” Around Massachusetts Healthcare Facilities (Apr.

4, 2017) (online at www.mass.gov/news/ag- reaches-settlement-with-advertising-company-prohibiting-geofencing-around-massachusetts-healthcare-facilities).
Mr. Jeff White Page 5 Choose Life Marketing, suggested: “Be creative with your geofencing—you can set it up around … abortion clinics.” 28 The Committee has long been focused on the collection and sale of sensitive mobile phone location data.

29 In June 2020, the Committee launched a bicameral investigation into the selling of consumer location data to federal agencies.
30 As Congress considers legislative reforms to ensure the privacy of personal reproductive and sexual health information, we are examining the practices of data brokers and other companies regarding the collection, dissemination, and sale of this private data.

For these reasons, please provide the following documents and information to the Committee by July 21, 2022: 1.

2.

3.

4.

5.

6.
All policies, procedures, and practices related to the collection or purchase of location data information surrounding specific locations, including geo-fencing; All policies, procedures, and definitions relating to the collection, purchase, and use, or transfer of “anonymized data” with respect to location data; The number of individuals from whom your company collects or purchases location data, including a list of all demographics collected; A list of all mobile phone applications your company has used to gather location data, including those that utilize your company’s or a third party’s software development kit; A list of all your company’s trusted partners who have provided location data to your company or received location data from your company; For each year from 2017 to present, your company’s revenue and profits related to the sale of location data; 28 Choose Life Marketing, All About GeoFencing (Oct. 22, 2019) (online at www.chooselifemarketing.com/all-about-geofencing/) (accessed June 28, 2022).
29 See, e.g., Committee on Oversight and Reform, Hearing on Geolocation Technology and Privacy, 114th Cong.

(Mar.
(Mar.

2, 2016) (online at https://republicans-oversight.house.gov/hearing/geolocation-technology-and- privacy/); Committee on Oversight and Reform, Press Release: Members Launch Bicameral Investigation into Company Tracking, Collecting, and Selling Consumers’ Location Data (June 24, 2020) (online at https://oversight.house.gov/news/press-releases/members-launch-bicameral-investigation-into-company-tracking- collecting-and).
30 Letter from Chairwoman Carolyn B. Maloney, Committee on Oversight and Reform, et al.

to Chris Gildea, Venntell, Inc. (June 24, 2020) (online at https://oversight.house.gov/sites/democrats.oversight.house.gov/files/2020-06- 24.CBM%20Warren%20Wyden%20DeSaulnie%20to%20Venntel%20re%20Mobile%20Phone%20Location%20Da ta.pdf).

Mr. Jeff White Page 6 7.

8.


A list of all purchasers of information relating to family planning clinics or abortion services, including when the purchase was made, for what amount, and what type of data was sold; and All documents and communications related to the collection or selling of location data related to reproductive health care clinics, including Planned Parenthood or other clinics.
The Committee on Oversight and Reform is the principal oversight committee of the House of Representatives and has broad authority to investigate “any matter” at “any time” under House Rule X.

An attachment to this letter provides additional instructions for responding to the Committee’s request.

If you have any questions regarding this request, please contact Committee staff at (202) 225-5051.
Sincerely, __________________________ Carolyn B. Maloney Chairwoman Committee on Oversight and Reform __________________________ Raja Krishnamoorthi Chairman Subcommittee on Economic and Consumer Policy __________________________ Sara Jacobs Member of Congress Enclosure cc: The Honorable James Comer, Ranking Member Committee on Oversight and Reform The Honorable Michael Cloud, Ranking Member Subcommittee on Economic and Consumer Policy