Washington Gov. Jay Inslee (D) on Thursday signed a first-of-its-kind bill into law that creates new protections for reproductive data, responding to concerns that sensitive data collected and sold by tech companies could be used to aid prosecutions related to abortions.
The “My Health, My Data Act” will require search engines and health trackers to add more privacy disclosures for consumers when they’re handling their sensitive health data, and it will require companies to get authorization in plain language from customers before they sell such data. It also gives Washington residents the new rights to force a company to delete their health data.
Data processors will have to comply with the law by March 31, 2024, though small businesses will have several additional months to come into compliance.
It also bars the use of “geofences” — virtual perimeters that sweep up data about cellphones around a physical location, to send unsolicited messages to people at health facilities.
Texts, web searches about abortion have been used to prosecute women
The law is an early signal of the trickle-down impact of the Supreme Court’s Dobbs v. Jackson Women’s Health Organization decision last year, which overturned Roe v. Wade and could usher in a patchwork of different state laws governing consumers’ health data and access to abortion information.
Other Democratic-led states could follow Washington’s lead in passing legislation with protections for sensitive health data. Meanwhile, Republicans could consider other restrictions on tech companies. South Carolina last year considered a bill that would outlaw websites that explain how to get an abortion, but the proposal ultimately did not become law amid concerns about that it might infringe on free speech.
The Dobbs ruling sparked new fears among privacy advocates who have warned that data from apps that track menstrual cycles and Google search histories could become a gold mine for prosecutors pursuing cases related to abortion.
Already there have been instances where such data was used in prosecutions of pregnant individuals. In one high-profile case last year, Facebook faced political blowback after it shared private messages between a young woman and her mother with Nebraska authorities investigating the death and disposal of a fetus.
Seeking an abortion? Here’s how to avoid leaving a digital trail.
State attorneys generals and consumers can bring lawsuits against companies who don’t comply, which can carry fines of up to $7,500 per violation.
“My Health, My Data protects the independence and dignity of individuals when they make health care decisions,” said bill sponsor Rep. Vandana Slatter. “It prevents vulnerabilities in the technological era that are being used to target and exploit consumers who may not be aware of the vast data that everything from our watches and phones collect.”
The law was one of a package of bills that Inslee signed on Thursday seeking to affirm Washington residents’ rights to access abortion.
TechNet, an industry group that represents Apple, Google, Meta and other major companies, said it agreed with “the underlying intent of the bill” but opposes the law that was passed. Ashley Sutton, an executive for the group, said the new measure will lead to a “deluge of opt-in notifications.”