NJ urges better privacy protection for reproductive health apps
Stronger measures are needed to ensure the privacy of data from smartphone apps that track menstrual periods, fertility and other reproductive health information so that it is not used by abortion opponents to target people seeking abortion services, 10 attorneys general told Apple Inc. on Monday.
Led by New Jersey Attorney General Matt Platkin, the top law enforcement officers in nine states that protect abortion rights, along with the District of Columbia, wrote to Tim Cook, the Apple CEO.
“Apple has not done enough,” the letter said, requesting that the company take additional steps to ensure that third-party apps that use the Apple platform adhere to the same privacy standards as Apple. People downloading the apps from the App Store expect the same standards of privacy and security that Apple provides, the letter said.
“You say, ‘What happens on your iPhone stays on your iPhone.’ We intend to hold you to that,” Platkin tweeted Monday.
Some commonly used apps that track reproductive health information are Flo, Ovia and Bellabeat.
The Supreme Court’s June 24 decision overturning Roe v. Wade gave the states the power to restrict or protect abortion services. Currently, most abortions are outlawed in 13 states, while court challenges of new restrictions are underway in others. Sixteen states protect the right to an abortion.
The letter to Apple was signed by attorneys general from California, Connecticut, Illinois, North Carolina, Oregon, Vermont, Washington and the District of Columbia, as well as New Jersey. Maura Healey, the current attorney general and governor-elect of Massachusetts, also signed it.
More:More patients come to NJ for abortions after Roe reversal. And that number could grow
More:NJ creates ‘strike force’ to protect abortion rights, personal health data
Apps that track fertility or menstrual periods can be “weaponized” against people when the data is combined with location information and a user’s search history to identify — and potentially prosecute — people who seek abortion, birth control or other reproductive health services, the letter said.
It cited the example of an Indiana woman who was convicted and sentenced in 2015 for terminating her pregnancy, based in part on her texts and web-browsing history, as well as an email from a website that provided abortion-inducing medications. The conviction was subsequently overturned.
“Private purchasers of this sensitive data can use this information to harass, intimidate, or deter individuals who seek or provide reproductive health care,” the letter said. In states that have imposed abortion restrictions since the U.S. Supreme Court’s Dobbs v. Jackson Women’s Health Organization decision, prosecutors could potentially make use of such data to bring cases against people who buy abortion-inducing medications online or who travel to another state for an abortion.
Abortion is legal and protected in New Jersey. The letter did not mention any cases in New Jersey where private data had been misused.
President Joe Biden in July signed an executive order about protecting data privacy online, and assigned responsibility to the Federal Trade Commission and the Department of Health and Human Services.
Many apps don’t meet minimum security standards, such as use of encryption, automatic security updates, strong password requirements and a clear and accessible privacy policy, according to a recent survey by the Mozilla Foundation. It said some apps lack even basic privacy policies, let alone policies that addressed the use of sensitive information.
The letter from the attorneys general asks Apple to require app developers to:
● Certify to Apple that they will delete data that is not needed for the app, such as search history and location for period-tracking apps.
● Post clear and conspicuous privacy notices on their websites that spell out the circumstances under which personal information will be shared with law enforcement or others. These are especially important for people who have little experience “understanding and navigating the complex data collection and sharing economy,” the letter said.
● Refuse to provide personal information to a third party unless a valid subpoena or court order is served.
● For apps that sync with user health data stored on Apple devices, implement the same privacy and security standards that Apple uses with regards to data. For example, encrypt the data and limit the app’s access to certain information.
The letter also asks Apple to audit the third-party apps so that they continue to comply with Apple’s standards.
A spokeswoman for Apple highlighted the company’s privacy policy. “When your phone is locked with a passcode, Touch ID, or Face ID, all of your health and fitness data in the Health app, other than your Medical ID, is encrypted,” according to the policy. “Any health data synced to iCloud is encrypted both in transit and on our servers.
“This means that when you use the Cycle Tracking feature and have enabled two-factor authentication, your health data synced to iCloud is encrypted end-to-end and Apple does not have the key to decrypt the data and therefore cannot read it.”
Users have “fine-grained control” over the information they share with health-related apps, the spokeswoman said: “The user must explicitly grant each app permission to read and write data to the HealthKit store. Users can grant or deny permission separately for each type of data.”