Your Location History Is a Prosecution Witness: How Data Brokers Became the Enforcement Arm of Post-Dobbs America
The New Geography of Reproductive Surveillance
When the Supreme Court returned abortion regulation to the states in June 2022, the legal conversation focused primarily on clinic closures, travel burdens, and the patchwork of state bans that followed. What received far less attention was the question that has since become urgent: in a digital economy where the average American generates hundreds of data points per day simply by carrying a smartphone, how would anti-abortion states enforce their laws against residents who crossed state lines to obtain care?
The answer, increasingly, is that they would buy the data.
Investigative reporting by Wired, The Markup, and the Electronic Frontier Foundation has documented the existence of a commercial data broker ecosystem that aggregates precise location information, app usage data, search histories, and in some cases medication prescription records — and sells it to government agencies, law enforcement bodies, and private litigants with minimal legal constraint. The legal framework governing this market is fragmentary, decades-old, and almost entirely unequipped for the surveillance capabilities that now exist.
How the Data Flows
The mechanics are worth understanding in detail, because the architecture of this surveillance is less dramatic than a government wiretap and far more difficult to challenge legally. Mobile advertising networks collect precise location data from smartphone apps — often through permissions users grant without reading, for purposes entirely unrelated to location tracking. Data brokers aggregate this information, strip nominal identifiers, and sell the resulting datasets as "anonymized" consumer intelligence.
In practice, anonymization provides almost no privacy protection. Research published in Nature in 2019 demonstrated that knowing just four location data points is sufficient to re-identify 95 percent of individuals in a supposedly anonymous mobility dataset. A woman's location history — showing her home address, her workplace, and a clinic in a neighboring state — is not anonymous. It is a map of her private medical decisions.
Beyond location data, the surveillance infrastructure includes pharmacy records accessible through data brokers who aggregate prescription information, search query data sold by ad-tech intermediaries, and period-tracking app data that has been the subject of specific privacy concerns since the Dobbs decision. The FTC issued a report in 2024 documenting the scope of the commercial data broker industry and its sale of sensitive health information, finding that the market operated with what the agency described as "a shocking lack of accountability."
The Legal Vacuum at the Center
The constitutional questions raised by this surveillance architecture are profound, and courts have barely begun to grapple with them. The Fourth Amendment's protections against unreasonable search and seizure have historically applied to government collection of information — but the third-party doctrine, established in cases like Smith v. Maryland (1979), holds that information voluntarily shared with third parties carries no reasonable expectation of privacy. Under a strict reading of that doctrine, location data shared with a mobile advertising network — however involuntarily, however opaquely — may not receive Fourth Amendment protection at all.
The Supreme Court's 2018 decision in Carpenter v. United States created a partial exception for historical cell-site location information, holding that the third-party doctrine did not apply to the kind of comprehensive location surveillance that a week's worth of cell tower records provides. But Carpenter was explicitly narrow, and lower courts have reached inconsistent conclusions about whether it extends to the commercial data broker context.
The result is a legal landscape in which states can potentially purchase commercially available data about their residents' movements, cross-reference it against known abortion clinic addresses in neighboring states, and build enforcement cases — all without triggering the constitutional protections that would apply if law enforcement had directly surveilled those same individuals. The surveillance is privatized. The enforcement is public. The rights violation falls in the gap between them.
The Strongest Defense of the Current System
The most credible argument against sweeping data broker regulation is not that reproductive surveillance is acceptable — it is that the commercial data ecosystem serves legitimate purposes, and that blunt regulatory intervention risks disrupting advertising markets, public health research, and fraud prevention systems that depend on aggregated data flows. The data broker industry has argued, with some legal support, that it operates within existing frameworks and that the problem is one of enforcement, not structure.
This argument deserves a serious response rather than dismissal. The solution to surveillance capitalism is not to pretend that data aggregation has no legitimate uses. But the specific sale of location and health-adjacent data to government actors for the purpose of enforcing laws that impose criminal liability on women seeking constitutionally contested medical care is not a marginal use case that responsible regulation would accidentally capture. It is the central harm. Legislation can be — and must be — precise enough to prohibit it without dismantling the entire commercial data ecosystem.
Who Is Targeted, and How
The women most vulnerable to this surveillance architecture are not, in general, those with the resources to protect themselves. Wealthy women can travel discreetly, pay in cash, use burner phones, and retain privacy attorneys. The women most exposed are those who lack the time, resources, or technical knowledge to navigate a surveillance environment they may not even know exists. They are young women in rural states with limited access to legal counsel. They are low-income women of color who are disproportionately targeted by law enforcement. They are women in abusive relationships whose location data is accessible to partners as well as prosecutors.
The geography matters too. States with the most aggressive post-Dobbs enforcement — Texas, Idaho, Missouri, and others — are precisely the states that have shown the greatest willingness to use novel legal theories to extend their jurisdiction beyond their borders. Texas's Senate Bill 8 deputized private citizens to sue anyone who "aids or abets" an abortion, creating a private enforcement mechanism that operates entirely outside traditional law enforcement channels. The combination of private civil liability and commercially purchased surveillance data creates an enforcement ecosystem that does not require a single prosecutor to pick up a phone.
The Legislative Response — Such As It Is
Congress has not passed comprehensive federal data privacy legislation. The American Data Privacy and Protection Act came closer than any previous effort in 2022, passing the House Energy and Commerce Committee with bipartisan support before stalling in the full House. It has not been revived in the current Congress.
At the state level, California, Colorado, and a handful of other states have enacted data privacy laws that include some protections for health-related information. But these laws are inconsistent, riddled with exceptions, and — critically — do not bind the states that are doing the surveillance. A Texas law enforcement agency purchasing data from a commercial broker is not constrained by California's Consumer Privacy Act.
The most targeted federal response would be legislation specifically prohibiting the sale of location data, health data, and reproductive-health-adjacent information to government entities for law enforcement purposes — paired with a private right of action allowing individuals to sue brokers who violate those protections. Senator Ron Wyden has introduced versions of this approach in multiple congressional sessions. None have passed.
What the Silence Means
The absence of federal action is not neutral. Every month that passes without data privacy legislation is a month in which the surveillance infrastructure deepens, the data accumulates, and the enforcement precedents harden. Courts that have not yet ruled on the constitutionality of data-broker-facilitated reproductive surveillance will eventually have to do so — and they will do so in a legal environment shaped by years of unchallenged practice.
Progress in this space requires naming the problem precisely: this is not merely a privacy issue or a technology regulation issue. It is a civil rights issue. The targeted surveillance of women making reproductive health decisions — using data purchased from private companies to circumvent constitutional protections that would apply to direct government monitoring — is a form of state control over bodily autonomy that the framers of the Fourteenth Amendment would have recognized as a profound violation of liberty, whatever their views on abortion itself.
A government that cannot surveil you directly has simply outsourced the job — and until Congress closes the data broker loophole, reproductive freedom and digital privacy will continue to be dismantled one purchased dataset at a time.
