cross-posted from: https://lemmygrad.ml/post/239508

A story that unfolded on the EFF Twitter.

Protecting your data from data brokers is an important component of the fight to protect reproductive rights. One example—though far from the only one—is data broker @Safegraph, whose disingenuous framing masks the real risks of location data sales. Thread:https://www.eff.org/deeplinks/2022/05/safegraphs-disingenuous-claims-about-location-data-mask-dangerous-industry​

Tuesday, Motherboard reported that data broker SafeGraph was selling location information “related to visits to clinics that provide abortions including Planned Parenthood facilities,” including where visitors came from and where they went. https://www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood​

In response, SafeGraph agreed to stop selling data about Planned Parenthood visitors. It also defended its behavior, claiming that SafeGraph “only sell[s] data about physical places (not individuals.)” https://www.vice.com/en/article/88gyn5/data-broker-safegraph-stops-selling-location-data-of-people-who-visit-planned-parenthood​

But SafeGraph absolutely has sold individualized data in the past. Last year, EFF reported how SafeGraph had sold 2 years worth of “disaggregated, device-specific” location data about millions of people to the Illinois government, starting in January 2019. https://www.eff.org/deeplinks/2021/08/illinois-bought-invasive-phone-location-data-banned-broker-safegraph https://t.co/CQ6XXgYTOM​

Older materials about SafeGraph also indicate that it used to offer a product called “Movement Panel.” A 2017 blog post by two people from Safegraph describes it as a “database of ultra-accurate GPS-location data that comes from anonymized mobile devices.” https://medium.com/@natasha_18377/less-than-10-of-bid-stream-location-data-is-high-quality-and-we-know-how-to-find-it-3a2c0df35475#---198-453​

It also describes how SafeGraph used “the bidstream” - data siphoned from the millions of apps that solicit ads through real-time bidding. Use of bidstream data is considered ethically dubious even within marketing circles. https://www.toolbox.com/marketing/customer-data/guest-article/data-privacy-the-next-jumpshot-like-controversy-is-lurking-in-the-bidstream/​

It’s possible that SafeGraph itself no longer sells this kind of data. But that’s not the whole story.

In 2019, SafeGraph spun off a company called Veraset. In 2020, Quartz reported that “[SafeGraph] says it gets mobility data from providers like its spin-off Veraset, which own the relationships with the apps that gather its data [.]” https://qz.com/1934587/who-is-safegraph-the-company-giving-your-location-data-to-covid-researchers/​

Also, founder Auren Hoffman and other SafeGraph employees have used SafeGraph forums to direct potential customers to Veraset for specific data needs. https://www.safegraph.com/community/t/i-am-looking-for-mobility-data-for-africa-most-specifically-sub-saharan-africa/407​ https://www.safegraph.com/community/t/news-and-geolocated-social-media-accurately-measure-protest-size-variation/1794​

Veraset sells raw, disaggregated, per-device location data. Last year, EFF received records showing how Veraset gave a free trial of such data to Washington, DC, as well as other unnamed agencies. https://www.eff.org/deeplinks/2021/11/data-broker-veraset-gave-bulk-device-level-gps-data-dc-government​

And Veraset offers a product called “Movement.” It “delivers the most granular and frequent GPS signals available in a third-party dataset,” and sources from “thousands of apps and SDKs”. https://www.veraset.com/products/movement/​

In sum, Veraset is in the business of selling precise, ping-level location data from the smart phones of millions of people. Safegraph itself was in this business until it spun it off to Veraset. And Safegraph continued to acquire data from Veraset and steer business there.