Her cellphone.

“I couldn’t imagine before the internet, trying to navigate this,” said Jones, 26, who graduated Tuesday from the University of Baltimore School of Law. “I didn’t know if hospitals did abortions. I knew Planned Parenthood did abortions, but there were none near me. So I kind of just Googled.”

But with each search, Jones was being surreptitiously followed—by the phone apps and browsers that track us as we click away, capturing even our most sensitive health data.

Online searches. Period apps. Fitness trackers. Advice helplines. GPS. The often obscure companies collecting our health history and geolocation data may know more about us than we know ourselves.

For now, the information is mostly used to sell us things, like baby products targeted to pregnant women. But in a post-Roe world—if the Supreme Court upends the 1973 decision that legalized abortion, as a draft opinion suggests it may in the coming weeks—the data would become more valuable, and women more vulnerable.

Privacy experts fear that pregnancies could be surveilled and the data shared with police or sold to vigilantes.

“The value of these tools for law enforcement is for how they really get to peek into the soul,” said Cynthia Conti-Cook, a lawyer and technology fellow at the Ford Foundation. “It gives (them) the mental chatter inside our heads.”

HIPAA, hotlines and health histories

The digital trail only becomes clearer when we leave home, as location apps, security cameras, license plate readers and facial recognition software track our movements. The development of these tech tools has raced far ahead of the laws and regulations that might govern them.

And it’s not just women who should be concerned. The same tactics used to surveil pregnancies can be used by life insurance companies to set premiums, banks to approve loans and employers to weigh hiring decisions, experts said.

Or it could—and sometimes does—send women who experience miscarriages cheery ads on their would-be child’s birthday.

It’s all possible because HIPAA, the 1996 Health Insurance Portability and Accountability Act, protects medical files at your doctor’s office but not the information that third-party apps and tech companies collect about you. Nor does HIPAA cover the health histories collected by non-medical “crisis pregnancy centers,” which are run by anti-abortion groups. That means the information can be shared with, or sold to almost anyone.

Jones contacted one such facility early in her Google search, before figuring out they did not offer abortions.

“The dangers of unfettered access to Americans’ personal data have never been more clear. Researching birth control online, updating a period-tracking app or bringing a phone to the doctor’s office could be used to track and prosecute women across the U.S.,” Sen. Ron Wyden, D-Ore., said last week.

For myriad reasons, both political and philosophical, data privacy laws in the U.S. have lagged far behind those adopted in Europe in 2018.

Until this month, anyone could buy a weekly trove of data on clients at more than 600 Planned Parenthood sites around the country for as little as $160, according to a recent Vice investigation that led one data broker to remove family planning centers from the customer “pattern” data it sells. The files included approximate patient addresses (down to the census block, derived from where their cellphones “sleep” at night), income brackets, time spent at the clinic, and the top places people stopped before and after their visits.

While the data did not identify patients by name, experts say that can often be pieced together, or de-anonymized, with a little sleuthing.

In Arkansas, a new law will require women seeking an abortion to first call a state hotline and hear about abortion alternatives. The hotline, set to debut next year, will cost the state nearly $5 million a year to operate. Critics fear it will be another way to track pregnant women, either by name or through an identifier number. Other states are considering similar legislation.

The widespread surveillance capabilities alarm privacy experts who fear what’s to come if Roe v. Wade is overturned. The Supreme Court is expected to issue its opinion by early July.

“A lot of people, where abortion is criminalized—because they have nowhere to go—are going to go online, and every step that they take (could) … be surveilled,” Conti-Cook said.

Punish women, doctors or friends?

Women of color like Jones, along with poor women and immigrants, could face the most dire consequences if Roe falls since they typically have less power and money to cover their tracks. They also tend to have more abortions, proportionally, perhaps because they have less access to health care, birth control and, in conservative states, schools with good sex education programs.

The leaked draft suggests the Supreme Court could be ready to let states ban or severely restrict abortion through civil or criminal penalties. More than half are poised to do so. Abortion foes have largely promised not to punish women themselves, but instead target their providers or people who help them access services.

“The penalties are for the doctor, not for the woman,” Republican state Rep. Jim Olsen of Oklahoma said last month of a new law that makes performing an abortion a felony, punishable by up to 10 years in prison.

But abortion advocates say that remains to be seen.

“When abortion is criminalized, pregnancy outcomes are investigated,” said Tara Murtha, the communications director at the Women’s Law Project in Philadelphia, who recently co-authored a report on digital surveillance in the abortion sphere.

She wonders where the scrutiny would end. Prosecutors have already taken aim at women who use drugs during pregnancy, an issue Justice Clarence Thomas raised during the Supreme Court arguments in the case in December.

“Any adverse pregnancy outcome can turn the person who was pregnant into a suspect,” Murtha said.

State limits, tech steps, personal tips

A few states are starting to push back, setting limits on tech tools as the fight over consumer privacy intensifies.

Massachusetts Attorney General Maura Healey, through a legal settlement, stopped a Boston-based ad company from steering anti-abortion smartphone ads to women inside clinics there that offer abortion services, deeming it harassment. The firm had even proposed using the same “geofencing” tactics to send anti-abortion messages to high school students.

In Michigan, voters amended the state Constitution to prohibit police from searching someone’s data without a warrant. And in California, home to Silicon Valley, voters passed a sweeping digital privacy law that lets people see their data profiles and ask to have them deleted. The law took effect in 2020.

The concerns are mounting, and have forced Apple, Google and other tech giants to begin taking steps to rein in the sale of consumer data. That includes Apple’s launch last year of its App Tracking Transparency feature, which lets iPhone and iPad users block apps from tracking them.

Abortion rights activists, meanwhile, suggest women in conservative states leave their cellphones, smartwatches and other wearable devices at home when they seek reproductive health care, or at least turn off the location services. They should also closely examine the privacy policies of menstrual trackers and other health apps they use.

“There are things that people can do that can help mitigate their risk. Most people will not do them because they don’t know about it or it’s inconvenient,” said Nathan Freed Wessler, a deputy director with the ACLU’s Speech, Privacy, and Technology Project. “There are very, very few people who have the savvy to do everything.”

Digital privacy was the last thing on Jones’s mind when she found herself pregnant. She was in crisis. She and her partner had ambitious career goals. After several days of searching, she found an appointment for an abortion in nearby Delaware. Fortunately, he had a car.

“When I was going through this, it was just survival mode,” said Jones, who took part in a march Saturday in downtown Baltimore to support abortion rights.

Besides, she said, she’s grown up in the Internet age, a world in which “all of my information is being sold constantly.”

But news of the leaked Supreme Court draft sparked discussions at her law school this month about privacy, including digital privacy in the era of Big Data.

“Literally, because I have my cell phone in my pocket, if I go to a CVS, they know I went to a CVS,” the soon-to-be lawyer said. “I think the privacy right is such a deeper issue in America (and one) that is being violated all the time.”

—This story corrects the title of U.S. Sen. Ron Wyden, who is a senator, not representative.