In a July 11 blog post to businesses, the acting associate director of the FTC's Privacy and Identity Protection Division said the misuse of location and health information can expose individuals to significant harm.
"The exposure of health information and medical conditions, especially data related to sexual activity or reproductive health, may subject people to discrimination, stigma, mental anguish, or other serious harms," said the FTC's Kristin Cohen.
The FTC will "vigorously" enforce the law if it uncovers illegal conduct that exploits Americans' location, health or other sensitive data, Cohen wrote.
Electronic devices — such as smartphones and wearable fitness trackers — can connect a person's precise location and information about their health, Cohen noted.
"This isn't the stuff of dystopian fiction," Cohen said.
Technology companies collect that data, combine it, and sell or monetize it, she said.
The companies and others can also build profiles on individuals and draw inferences about them based on the places they've visited — including determining that a person is an "expectant parent," Cohen noted.
There is also information stored online that could be misused related to an individual's reproductive health, including products that "track women's periods, monitor their fertility, oversee their contraceptive use, or even target women considering abortion," the FTC official stated, adding that concerns about the risk of misuse are not theoretical.
In 2017, for example, the attorney general of Massachusetts reached a settlement with a marketing company that used location technology to identify when people approached an abortion clinic. Based on that data, the company sent targeted ads to their phones steering them to information about alternatives to abortion, Cohen said.
The FTC official said in the blog post there needs to be more public discussion and transparency about "the extent to which highly personal information that people choose not to disclose even to family, friends, or colleagues is actually shared with complete strangers."
"These strangers participate in the often shadowy ad tech and data broker ecosystem where companies have a profit motive to share data at an unprecedented scale and granularity," Cohen wrote.
Smart devices send signals to cell towers, which create a record of a user's whereabouts, and apps store information from millions of people who track information about their own health.
"The marketplace for this information is opaque and once a company has collected it, consumers often have no idea who has it or what's being done with it," Cohen wrote.
Recently, the FTC reached a settlement with Flo Health, alleging the company illegally shared information collected from its period and fertility tracking app to third parties.
The statement from the FTC comes days after Biden signed an order that looks to federal agencies to implement policies that will ensure women's access to reproductive health services. The order also addresses patient privacy, like ensuring sensitive data from patients is protected. It also follows a letter that members of Congress sent to the FTC, urging the agency to investigate how smartphone giants Apple and Google track mobile phone users and also expressing concern about third parties' ability to access this location data in the wake of the U.S. Supreme Court's decision to overturn Roe v. Wade
.--Additional reporting by Allison Grande, Grace Dixon and Adam Lidgett. Editing by Andrew Cohen.
For a reprint of this article, please contact reprints@law360.com.
