In a letter to FTC Chair Lina Khan, Democratic Sens. Elizabeth Warren of Massachusetts, Cory Booker of New Jersey and Ron Wyden of Oregon, along with Rep. Sara Jacobs of California, accused Apple and Google of "engaging in unfair and deceptive practices by enabling the collection and sale of hundreds of millions of mobile phone users' personal data."
The lawmakers alleged that the companies have "knowingly facilitated these harmful practices" by developing unique tracking identifiers for their iOS and Android operating systems that they've specifically marketed for advertising purposes. These identifiers contain information about users' movements and web browsing activities that can be purchased or acquired from app developers and online advertisers and be combined with other personal information that data brokers hold to identify and build detailed profiles on specific users, according to the lawmakers.
"The FTC should investigate Apple and Google's role in transforming online advertising into an intense system of surveillance that incentivizes and facilitates the unrestrained collection and constant sale of Americans' personal data," the lawmakers wrote. "These companies have failed to inform consumers of the privacy and security dangers involved in using those products. It is beyond time to bring an end to the privacy harms forced on consumers by these companies."
While Apple and Google both now allow consumers to opt out of this device tracking, the lawmakers noted in their letter that, until recently, Apple had enabled its tracking ID by default and "required consumers to dig through confusing phone settings to turn it off."
Google continues to enable its tracking identifier by default, and "until recently did not even provide consumers with an opt-out," the lawmakers added.
"By failing to warn consumers about the predictable harms that would result by using their phones with the default settings that these companies chose, Apple and Google enabled governments and private actors to exploit advertising tracking systems for their own surveillance and exposed hundreds of millions of Americans to serious privacy harms," the lawmakers added.
The lawmakers voiced particular concern over the privacy harms that they're anticipating will flow from the Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, which the high court handed down Friday.
In the highly anticipated ruling, the court's conservative majority wiped out the constitutional right to abortion established in its 1973 decision in Roe v. Wade, with six justices voting to uphold a Mississippi law banning most abortions after 15 weeks and five of those justices finding that Roe was wrongly decided and nullifying its holding that the Constitution protects a woman's right to an abortion.
The Democratic lawmakers said in their letter Friday that they feared that individuals seeking abortions and other reproductive health care would become "particularly vulnerable to privacy harms, including through the collection and sharing of their location data," in the wake of the decision to overturn abortion rights.
"Data brokers are already selling, licensing, and sharing the location information of people that visit abortion providers to anyone with a credit card," the lawmakers wrote. "Prosecutors in states where abortion becomes illegal will soon be able to obtain warrants for location information about anyone who has visited an abortion provider."
Additionally, individuals and entities that operate independently are also likely to be "incentivized by state bounty laws to hunt down women who have obtained or are seeking an abortion by accessing location information through shady data brokers," the lawmakers said.
A Google spokesperson said that the company "never sells user data, and Google Play strictly prohibits the sale of user data by developers" and the use of this data for purposes other than advertising and analytics.
"The advertising ID was created to give users more control and provide developers with a more private way to effectively monetize their apps," the spokesperson said in a statement provided to Law360. "Any claims that advertising ID was created to facilitate data sales are simply false."
The company added that, on top of the existing protections it offers, including the ability for users to delete their advertising ID at any time, it's also introduced the Privacy Sandbox on Android "to enable new, more private advertising solutions that limit sharing of user data with third parties and operate without cross-party identifiers, including advertising ID."
The FTC declined to comment on Friday's letter, and Apple didn't respond to a request for comment.
The Democrats who penned the letter to Khan also separately issued statements on Friday criticizing the high court's "radical" decision to overturn abortion rights and vowing to work to codify Roe into law.
Wyden also urged Congress to pass privacy legislation to protect individuals' data "so that their web searches, text messages and location tracking aren't weaponized against them" and called on tech companies to take "immediate steps to limit the collection and retention of customer data so that they don't become tools of persecution."
Anticipating the high court's decision, which largely echoed a leaked draft version of the majority opinion that Politico published in May, Wyden, Jacobs and Sen. Mazie Hirono, D-Hawaii, earlier this month introduced the My Body, My Data Act to create a new national standard to protect personal reproductive health data that would be enforced by the FTC.
The bill aims to counter the currently limited protections for personal reproductive health information collected by apps and websites by minimizing the gathering and retention of this data to only what's necessary to deliver a product or service.
Wyden also teamed up with Warren and three of their colleagues in the Senate to float legislation on June 15 that would ban data brokers from selling Americans' sensitive health and location data.
In responding to the Supreme Court's decision Friday, groups such as the Center for Democracy and Technology also highlighted the impact that the ruling was likely to have on the privacy rights of people seeking reproductive care, while echoing the lawmakers' call for action.
"Data about a person's reproductive health decisions can be revealed from sources like their browser and search histories, email and text message logs, use of reproductive health apps, and other commercial products with which many users interact daily," CDT President and CEO Alexandra Reeve Givens said. "In this new environment, tech companies must step up and play a crucial role in protecting women's digital privacy and access to online information."
--Editing by Rich Mills.
Update: This article has been updated to add a comment from Google.
For a reprint of this article, please contact reprints@law360.com.
