Intimate privacy: the fight for cyber civil rights
There’s growing concern in Virginia and across the nation about who should have access to the vast amount of private health information compiled on our phones and online.
“Your [phone’s] location data ... tells the story of who you love, where you worship, what you're thinking, who you're sleeping with, the doctors you visit, tells the story of your intimate life,” said Danielle Citron, a professor at the University of Virginia School of Law.
Citron helps lead a national effort to enact laws to protect intimate privacy as a civil right: the Cyber Civil Right Initiative. In her recently published book, The Fight for Privacy, Protecting Dignity, Identity and Love in the Digital Age, she wrote, “I work to help us understand why intimate privacy matters and how its denial amounts to a massive legal, social, and moral failing.”
Citron said one of her key concerns is protecting the intimate privacy of women and girls who use period-tracking apps. One-third of women and girls in the U.S. use these “Femtech” apps, according to Citron's book, which collect billions of data points for subscribers.
After the U.S. Supreme Court’s Dobbs v. Jackson decision last June gave states the right to ban abortion, abortion rights advocates warned that users' private health data from these apps could be used to prosecute women and their doctors if they violate state restrictions. Virginia law allows prosecutors to charge doctors who violate the state’s abortion restrictions, but not their patients.
During Virginia’s 2023 General Assembly legislative session, Sen. Barbara Favola (D–Arlington) sponsored SB 852, a bill that would prohibit law enforcement from issuing search warrants for menstrual health data stored on digital devices. The bill's supporters warn that millions of women and girls use mobile apps to track their cycles, and that information is not protected by HIPAA, the federal health privacy law.
The Youngkin administration helped to defeat the bill, arguing that the measure could restrict subpoena powers. Maggie Cleary, Youngkin’s deputy secretary of public safety and homeland security, told members of the General Assembly the bill “would set a limit on what search warrants can do. … Currently any health information or any app information is available via search warrant. And we believe that should continue be the case.”
Citron warned that if digital privacy is not protected, there will be dire consequences for people of all gender identities.
“I'm just trying to think of all the ways that we share information about our innermost fantasies, or sex lives or activities and that includes the Alexa in the kitchen. It's the period-tracking app that you have on your phone,” Citron said. “It’s the dating apps that so many people use — young, old — dating apps that collect an enormous amount of information. ... And you look for diseases and chronic conditions on WebMD.”
All of those apps collect a tremendous amount of intimate data that is often shared with advertisers and marketers and then sold to data brokers.
Women who use health apps are particularly vulnerable because the apps collect detailed personal health data that can be used against them, according to Citron.
“Women and girls’ right to privacy in their reproductive decisions means that online searches, app use," she said, "and location data will not only be used in decisions about employment and life insurance but also in criminal investigations.”
Citron said the privacy policies on apps most often share that information with third parties — often including advertisers and marketers: “Companies may say to us, the information is anonymized, but it’s often accompanied with your mobile device ID number, which is your name.”
If someone in a state where abortion is criminalized searches the web for reproductive health information, abortion clinics locations or how to obtain certain medications, Citron said, state law might criminalize the actions of doctors, people who help and perhaps even the pregnant person.
“There are three central actors that worry me and that implicate our intimate privacy,” said Citron, “That’s the corporate surveillance of intimate life. It's individuals surveilling and exploiting intimate privacy. And it's governments invading intimate privacy."
According to Citron, when people take their phone to a women’s health clinic, tracking apps can provide “circumstantial evidence of an abortion. So, all of those data points help enable law enforcement to get a warrant to get our phone that can be then used as a predicate to arrest a physician or a pregnant individual who's terminated a pregnancy.”
"I've learned from [Citron], that we tend to think of privacy in these silos,” said Laura Faas, one of Citron’s law students. “We have the law — HIPAA — that protects health data in certain contexts, but in much more limited context than a lot of people think. And we also have some consumer protection and privacy laws. But we don't have a comprehensive piece of legislation that protects privacy, in all respects. And I think that is a goal.”
Virginia’s legal protections around intimate privacy are “woefully inadequate” because the state lacks a comprehensive approach, so Citron wants legislators in Virginia and nationwide to respect and protect intimate privacy as a civil right.
“We all deserve intimate privacy. We all want it, we all expect it, and we all deserve it,” Citron said. “And so, I think we need to bring our moral chops to the table and say this is for all of us and stop it.”
Correction: An earlier version of this article misspelled Laura Faas's last name.