Give Now

We must close the loophole that allows law enforcement to buy our personal data without a warrant.

Protecting Civil and Human Rights
|
Investigation

Policing Gender: How Surveillance Tech Aids Enforcement of Anti-Trans Laws

(Illustration: Renzo Velez / POGO; Photos: Getty Images)

A vast trove of documents are housed within the Florida governor’s Office of Policy and Budget: fiscal analyses, budget reports — the usual suspects. As of February, this office also holds a detailed list of the number of Florida college students who have been diagnosed with gender dysphoria or who have sought gender-affirming medical care at state university medical clinics. That’s because Governor Ron DeSantis recently required universities to surrender transgender patients’ health data for what one state lawmaker called a “borderline registry of trans people.” 

Andy Pham, a senior at the University of South Florida who studies pre-med, was one of the numbers on his university’s list. Pham called the governor’s order “extraordinarily alarming” and voiced concerns about the privacy of the supposedly anonymized student health data.

“You could definitely identify individual patients,” he said. “And unfortunately, if we get to a point where people’s health care data is compromised ... for someone with the know-how and someone with the resources, it would not be hard to locate people.”

Florida is not alone in focusing surveillance efforts on trans people. In Missouri, a Kansas City hospital sued the state’s attorney general this April rather than comply with 54 requests for patient health data about gender-affirming care procedures. Last year in Texas, Attorney General Ken Paxton requested that the Texas Department of Public Safety provide a list of every person who had changed their gender on a Texas driver’s license during the previous two years. (The office ultimately compiled a list of over 16,000 Texans; it was not provided to the Office of the Attorney General because of accuracy concerns.)

But according to data privacy and trans rights advocates, surveillance of trans people could extend far beyond data requests.

From student spyware to reverse search warrants, surveillance technology may be a significant tool for enforcing the barrage of new state anti-trans laws. As many of these laws go into effect, ambiguity around enforcement leaves the full data privacy implications — and potential harms — unknown. “We just don’t know, and unfortunately we may not find out until some of the harms are out there, because of the newness of these laws,” said Hayley Tsukayama, senior legislative activist at the Electronic Frontier Foundation. “What we do know is that there’s a huge surveillance apparatus that could be used, and we see a lot of potential for it to be used in ways that are really scary.”

Calling 2023 a record-breaking year for anti-trans legislation is an understatement. A veritable avalanche of laws have hurtled through state legislatures at stunning speed, all centered on restricting the behavior of trans people: what bathrooms they can use, what health care they can receive, what public resources they can access, and how they can express their identity in educational and public spaces. Over 550 anti-trans bills have been introduced in state legislatures this year so far, according to Trans Legislation Tracker, an independent and volunteer-led research project. That’s three times as many as were introduced in all of 2022, which was also a record-breaking year. Many anti-trans laws have already passed — 18 were passed in 2021, 26 in 2022, and 83 laws have passed in 23 states in the first half of 2023.

Privacy experts point to digital surveillance — including location tracking, online student monitoring tools, the buying and selling of personal data, facial recognition software, and automatic gender recognition technology — as a key way that police, school and health officials, and private citizens could enforce these laws on the ground. The absence of federal data privacy laws, regulations, and oversight makes the likelihood of surveillance tools being abused even greater, they warn.

“It is a national embarrassment and a travesty that we have no basic national data privacy law in the United States,” said Evan Greer, director of digital rights advocacy group Fight for the Future. “That is one of the single biggest things that lawmakers could do to protect, not just trans folks, but everyone, by simply restricting and limiting how much data corporations can collect and store about all of us in the first place.”

Policing Gender in Health Care

Gender-affirming care bans are now the law of the land for millions of Americans — limiting access for both transgender minors and adults — with many new laws set to take effect in the coming months. Twenty states have passed laws banning or restricting access to gender-affirming care for transgender minors, based on analysis and tracking by POGO. Additionally, a ban passed in Louisiana has yet to be signed into law and is expected to survive a veto by the governor. Many of the laws also functionally limit access to care for trans people of all ages: Some new state laws ban the use of public funds for gender-affirming care or add restrictions for state health insurance coverage of such care.

Twenty states have passed laws banning or restricting access to gender-affirming care for transgender minors, based on analysis and tracking by POGO.

The term “gender-affirming care” encompasses a range of treatments that affirm a person’s gender identity, including medications like puberty blockers, which are reversible and suppress the onset of puberty; hormone therapy; and surgical interventions. Surgical procedures are rare for minors and involve a lengthy and complicated process to access, despite claims by some politicians to the contrary.

Health experts say gender-affirming care bans are based on inaccurate information. Major medical associations, including the American Medical Association, the American Academy of Pediatrics, the American Psychiatric Association, and the Endocrine Society, agree that such care is medically necessary and can be life-saving.

The fear of losing gender-affirming care can prompt devastating mental health crises, according to Dr. Colleen Kuhn, a child and adolescent psychologist based in Utah, where a gender-affirming care ban recently passed. “The message to the kids is that they’re not seen, they’re not wanted, they’re not valid,” they said.

The message to the kids is that they’re not seen, they’re not wanted, they’re not valid.

Dr. Colleen Kuhn

More than half of transgender and non-binary young people have considered suicide in the past year, according to recent research by The Trevor Project, with Black transgender and nonbinary youths at disproportionate risk. Access to gender-affirming care is strongly linked to improved mental health and reduced suicidality.

As that access is increasingly constrained across the nation, privacy experts warn that surveillance technology may play a key role in enforcement: not only when wielded by law enforcement but also by health care officials, school officials, and private citizens who may seek to report members of their communities.

A huge array of personal information is derived from our digital footprints. Location data from apps that track our physical whereabouts, communications through popular apps like Facebook and Instagram, health data from apps that monitor and track our physical well-being, and browser search histories paint a detailed picture of our inner lives, our interests, and our patterns of behavior. This data has become a valuable commodity and is bought and sold on a minimally regulated marketplace by data brokers in the absence of federal regulation.

Digital surveillance techniques have clear applications for police investigations around gender-affirming care, experts say. Law enforcement agencies can access personal data in a number of ways when conducting criminal investigations. They can get geofence warrants (which allow police to obtain location data from cellular devices within a specified geographic area), they can obtain warrants for digital communications and keyword searches, and they can purchase personal data without a warrant. Experts warn that law enforcement using personal data provided by tech companies like Google, Meta, and others, could identify people who have obtained, provided, or “aided and abetted” in providing gender-affirming care.

Police could “basically do a fishing expedition for anybody who may have been, for example, near a certain clinic or near a certain community center or near a certain medical facility at a certain time, and use that as evidence as they’re building their case,” according to Tsukayama of the Electronic Frontier Foundation.

The number of data warrants issued by law enforcement has risen dramatically in recent years. Google data from 2018-2020 shows a steep increase in the frequency, with police in several states that now have gender-affirming care bans among the top issuers of geofence warrants.

Although Google declined to provide updated data on state-by-state geofence warrants, updated national figures in its transparency report show that the trend continued in 2021 and the first half of 2022. Government requests for user data at Facebook have seen a similar upward trend, according to Meta’s transparency center. Meta’s public data does not distinguish between warrants and other data requests, and the company has not responded to a request for state-by-state data.

Police in states with new anti-trans laws are well aware of the surveillance tools at their disposal, Tsukayama said. “We know that there are thousands of warrants issued from states that now have gender-affirming care or reproductive criminalization laws on the books.”

There are concerning parallels in the application of surveillance technology to enforce abortion bans and gender-affirming care bans, according to Greer from Fight for the Future. She highlighted a Nebraska case where police obtained Facebook messages for evidence against a teen who sought to end her pregnancy as an example of how communications data could be used by law enforcement.

The potential weaponization of patient health data is another area with similarities to abortion bans, experts say. Patient data could be shared from one health care provider to another, and anonymized patient health care data could be purchased and used to identify medical providers, particularly in communities where there are limited numbers of physicians who provide gender-affirming care, according to Os Keyes, a University of Washington researcher and Ph.D. candidate who is currently authoring a book on the history of transgender science and medicine.

Medical providers could also use health data to report one another, or to report parents, based on their observations about treatment a transgender person has received elsewhere. Tsukayama shared a hypothetical scenario where a patient could travel out of state to access gender-affirming care, and then return to their home state and see a doctor for unrelated care. That doctor may then feel they have a duty to report based on their state law. “The way that data flows can really reveal things about your health, and that now unfortunately can be considered a crime depending on where you are,” she said.

Confidential health data has already been shared by a medical provider in an effort to halt gender-affirming care performed by colleagues: A provider in Texas leaked data to a far-right think tank, prompting an investigation into the hospital by the state’s attorney general.

The disproportionate impacts of gender-affirming care bans also mirror those of abortion bans, Greer said. “Just like with abortion, where wealthy white folks are often generally still able to access abortion … we’ll see an exact parallel of that with enforcement of these anti-trans laws,” she said. “It will be the most marginalized members of our communities that will be hurt the most,” Greer said.

Socially, it’s not acceptable for us to be visible already; the police already target us ... and now the general public is being really trained to see us as criminal on multiple levels.

Jaelynn Scott, executive director of the Lavender Rights Project

LGBTQ+ people are already overrepresented throughout the criminal justice system and the juvenile justice system. The trend is amplified by racial inequities in patterns of criminalization, with the incarceration rate of Black trans women nearly 10 times greater than that of the general population, according to the most recent national survey conducted by the National Center for Transgender Equality. New anti-trans laws add yet another layer of criminalization onto Black trans women — who already face disproportionate risk of violence — and create a “deadly mix,” said Jaelynn Scott, executive director of the Lavender Rights Project, a Black trans advocacy organization based in Washington. “Socially, it’s not acceptable for us to be visible already; the police already target us ... and now the general public is being really trained to see us as criminal on multiple levels,” she said.

Among some transgender young people, fears around enforcement are leading to “DIY” methods of gender-affirming care. Pham explained how trans people he knows have resorted to purchasing medication from other countries on the grey market, and to self-rationing medication. “For obvious reasons, that is not a good idea. But unfortunately, many people are starting to see it as our only viable option,” he said.

There is much more the federal government could be doing to mitigate the harms of state anti-trans laws being enforced by digital surveillance, according to privacy experts.

Federal legislation like the Fourth Amendment is Not for Sale Act — which would create clear government standards for data purchases and prohibit law enforcement from buying personal and location data without a court order — would be a meaningful step in that direction, advocates argue. The bill was introduced in 2021, and has not yet been reintroduced in the current legislative session.

Another way the federal government could take action is through the Federal Trade Commission, Greer explained. “The Federal Trade Commission has tremendous authority to crack down on commercial surveillance,” she said. “They should use every ounce of their authority to protect vulnerable communities by cracking down on data collection practices and abuse of our personal data.”

The commission has said it is looking into new rules around commercial data and online privacy, and it has taken a recent enforcement action against the health tech company GoodRx for sharing personal data with companies like Facebook and Google. But there’s much more the agency could be doing, according to Jay Stanley, a senior policy analyst at the American Civil Liberties Union. “The FTC could take action against phone makers to help cut off the flow of unethical location tracking in people’s phones, in people’s cars, which are increasingly coming to resemble phones in the extent to which they are vehicles for privacy violation,” he said. The FTC has not responded to a request for comment.

Finally, increased federal regulation is also needed to protect patient health data, Keyes argued. They said opt-in should be required for health data to be shared for commercial purposes, and that standards are needed around how that data gets anonymized. “Patients really never have a choice, not only because it’s in the same paperwork you have to sign to get treatment if it’s mentioned at all, but also because a lot of the time ... even the doctors don’t know where the patient data is going,” Keyes said. Stanley highlighted additional areas of concern for patient health data: broad law enforcement exceptions in the Health Insurance Portability and Accountability Act (HIPAA), and the rise of large electronic health databases. “The idea, of course, is to eliminate friction in the sharing and retention of medical records, but friction could be a good thing for your privacy,” he said.

The Department of Health and Human Services recently announced new proposed rules for limiting out-of-state sharing of reproductive health data, if the reproductive health care was legal in the state in which it was obtained. They have not announced any similar proposed rule changes for gender-affirming care.

Policing Gender in Public Spaces

On December 26, 2022, “A Drag Queen Christmas” was performed at the Broward Center of the Performing Arts in Fort Lauderdale, Florida. Soon thereafter, DeSantis announced his office would be investigating the event for violations linked to allegedly exposing children to sexually explicit content. “Thank you to those who flagged the event for us,” said the governor’s press secretary in a tweet, where he explained that photos and video footage from the event would be used in the investigation.

In Florida and more than a dozen states around the country, lawmakers have introduced measures restricting public expression of gender identity in the presence of children that doesn’t conform to heterosexual and cisgender norms, often referred to as “drag bans.” Other new laws bar transgender people from using public bathrooms that align with their gender identity — including a recently passed Florida law that makes entering such bathrooms a criminal offense.

Some laws are even more sweeping. A new Kansas law creates a state definition of men and women based on the sex assigned at birth, functionally denying the existence of trans people. A female, the law says, is “an individual whose biological reproductive system is developed to produce ova,” and the words “women” and “girls” are defined as exclusively referring to “human females.” The law defines the category of “men” and “boys” along similar lines, based on their bodies’ capacity to fertilize eggs. “It feels like a concerted effort to try and erase trans folks from public life,” said Alex Binsfeld, director of legal at the California-based Transgender Gender-Variant & Intersex Justice Project.

As with other nascent anti-trans laws, the ubiquity of surveillance technology raises troubling questions around enforcement, according to Greer. “When you think about how would you actually enforce something like [a drag ban], like if someone is giving a performance and you don’t know who they are — how would you even know if they are wearing clothes of the opposite gender for a purpose of appealing to the prurient interest?” she asked. “Well, one way you could do that would be using facial recognition analysis that supposedly can identify people’s sex based on their face, which is something that facial recognition vendors have certainly claimed or promised they can do.”

As with other forms of surveillance, the harms of video surveillance tend to be more acutely felt by those with marginalized status.

From the grocery store to a sporting event, the airport to the shopping mall, facial recognition software has become increasingly widely used by a variety of vendors and entities in public spaces. The Automated Gender Recognition technology baked into many facial recognition software programs could be used for enforcing anti-trans laws, according to Keyes.

“The main scenario ... that you can imagine is cameras — either pre-existing ones or ones that are newly placed on the outside of gendered bathrooms — being loaded with software that has them flag anyone who goes into those bathrooms or appears to be who is incongruent with the expectation. So someone who the system classifies as a man goes into a woman’s bathroom,” they said.

Keyes pointed to a report by the National Institute of Standards and Technology, a federal agency that oversees government technological development and innovation, as evidence of this possibility. The report includes a section titled “Gender Verification,” where it details how this technology could be used: “Gender-targeted surveillance,” the report notes, “can assist with monitoring” areas including the “entrance to female restrooms or locker rooms.” It has already been used with blanket applications for gender-specific marketing at a London bus stop, and in Berlin was used to automatically give women subway discounts on Equal Pay Day.

Jake Laperruque, deputy director of the Security and Surveillance Project at the Center for Democracy and Technology and former POGO senior policy counsel, thinks blanket uses of facial recognition, such as scanning the face of every person entering a bathroom, are less likely than particularized use by law enforcement in investigations, such as using facial recognition to identify a specific performer in a drag show based on photos or videos. He said this is especially the case for performers who may seek to avoid identification by using a pseudonym — facial recognition technology makes it that much harder to avoid being surveilled. “If you’re actually trying to take defensive measures against surveillance, you can leave your phone at home. If you’re going to a place where you’re worried about surveillance, you cannot leave your face at home,” Laperruque said.

As with other forms of surveillance, the harms of video surveillance tend to be more acutely felt by those with marginalized status. Communities of color have long been exposed to heightened police surveillance, from FBI tracking of members of the civil rights movement to CIA spying on Muslim communities in the wake of 9/11. More recently, public housing residents have experienced heightened video surveillance, with footage used to punish and sometimes evict residents — 45% of public housing households are Black, according to a 2012 report.

Surveillance technology can also have disproportionate impacts on communities and people of color on city streets: A ProPublica analysis found that people who lived in Chicago zip codes with majority Black and Latino residents were twice as likely to receive traffic camera-related tickets than those who lived in primarily white zip codes.

These impacts can be compounded for transgender people of color, and laws targeting trans people in public spaces have clear racial dimensions, according to Scott from the Lavender Rights Project. “I think about drag as a Black queer and trans art,” she said, explaining drag’s origins in ballroom culture. “Drag is really rooted in Blackness, Black transness, and Black queerness. … It is one of the few places, socially, that it has been acceptable for us to show up as we are, to show our art and creativity and have it appreciated and not be harassed, targeted, and harmed.”

Scott said bathroom bills will also disproportionately impact Black transgender women by ramping up criminalization. Binsfeld echoed this concern. “Trans visibility has always been a double-edged sword, because for many trans people visibility hasn’t meant safety, especially folks who are multiply marginalized,” they said.

Increased federal regulation around facial recognition would be a meaningful way to blunt some of the potential harms of surveillance technology with anti-trans laws, Keyes and Laperruque agree. There are currently no federal regulations on law enforcement use of facial recognition technology, even as it has become widely used by police and federal agencies. “Facial recognition — we have some state laws and a few city bans — but for the most part it’s the Wild West in terms of how it’s used,” Laperruque said. “I’d be very worried that these types of tools do not have the guardrails they need on them, and that can lead to abuse, that can lead to large-scale monitoring. And when we’re talking about these types of laws that are designed and targeted at vulnerable communities, that creates a lot of risk.”

He pointed to the Facial Recognition Act of 2022, a bill introduced by lawmakers to add limits to the use of facial recognition by police, as a measure that could have counteracted some potential enforcement harms of anti-trans laws linked to video surveillance. The law would only permit facial recognition technology to be used by law enforcement in serious violent felony investigations: Most of the anti-trans laws that carry criminal penalties are designated as lower degree felonies or misdemeanors. The measure has not been reintroduced in the current session.

Policing Gender in Schools

While many of the new anti-trans laws, such as bathroom and locker room bans, carry provisions focused on facilities in public schools, a host of other new laws are centered on restricting how gender identity and sexual orientation are discussed in the classroom. Enforcement possibilities for these laws are compounded by the complex surveillance apparatus that already exists in schools throughout the nation.

Tools like student spyware and video surveillance track the digital and in-person behaviors of students. Privacy experts and trans right advocates argue that weak federal protections around commercial data and facial recognition could not only worsen existing privacy risks for transgender youth but also present new risks linked to nascent laws restricting gender and sexuality in schools.

Video surveillance has become widely used in educational settings in recent years, with 91% of public schools using security cameras during the 2019-2020 school year. Facial recognition technology is already being equipped in school cameras in Montana, Kentucky, and West Virginia, justified as an added measure for promoting campus safety. Meanwhile, schools in Pennsylvania, Massachusetts, Virginia, and elsewhere have already or will soon install cameras outside of school bathrooms in order to catch students vaping, meaning that much of the infrastructure for using such cameras to enforce bathroom bans is already in place.

School-based legislation focused on gender and sexual orientation comes in a variety of forms. Many of the new laws restrict the ways educators and school professionals can talk about gender and sexual identity with students, and mandate grade limits for classroom study of topics related to human sexuality and gender. Some require educators to alert parents of changes in a student’s gender identity, including which pronouns or name the student uses at school. Some permit educators to refuse to use the pronouns of trans and nonbinary students, and others require bathrooms and locker rooms to be segregated by “biological sex,” a term the laws use to indicate the sex a person is assigned at birth. For many of the laws, how they will be enforced and who could face penalties is unclear.

In Arizona, where some anti-trans laws have recently passed, a Tucson middle school teacher said they know that students and teachers are being surveilled, but doesn’t know much beyond that. “For the most part, whatever technology they use isn’t talked about,” said the teacher, who asked that POGO not publish their name. They described situations where students would be mysteriously penalized because of their online conduct, with no information provided to the teachers as to why.

More than 80% of U.S. schools use online monitoring software to track students’ virtual activities. This software often amasses far-reaching data beyond educational records, and can include digital communications and browser search history information. Federal law requires schools to conduct a degree of online monitoring of students in order to receive funding from the Federal Communications Commission E-Rate Program, and over 30,000 U.S. schools received E-Rate funding in 2019.

While proponents argue that online monitoring tools are needed to keep students safe from harmful content online and to help teachers better understand student engagement with classroom material, critics warn of the potential for privacy abuses linked to student spyware.

I would give the U.S. a failing grade when it comes to protecting children online.

Hye Jung Han, a researcher and advocate in the Children’s Rights Division at Human Rights Watch

Constant surveillance in schools carries implications for how different anti-trans laws may intersect and overlap, Tsukayama says. For example, a school staffer in a state with both a law requiring school employees to report changes in a student’s gender identity and a law restricting gender-affirming care for minors may feel they have a duty to report if, based on information they obtain from student spyware, they suspect a student is receiving gender-affirming care.

“We’ve clearly seen that schools are looking at chats, they’re looking at search histories, they’re looking at all sorts of things,” Tsukayama said. “I do think that anyone who has concerns about being turned in or being flagged really should be extremely careful on school devices.”

Anti-trans laws notwithstanding, student spyware is already used more harshly and intrusively with LGBTQ+ students than with their straight, cisgender classmates. The prominent online monitoring software company Gaggle has come under fire for the way it tracks and monitors gender and sexuality among students — and for its potential use to out students. A 2022 report by the Center for Democracy and Technology found that through online monitoring, LGBTQ+ students were more likely to get in trouble with their teacher than students who don’t identify as LGBTQ+, and were more likely to be contacted by law enforcement about a potential crime.

Almost 30% of LGBTQ+ students surveyed reported that “they or another student they know who is LGBTQ+ has been outed” because of online monitoring tools, a problem that a majority of parents and teachers agreed was a significant concern with the spyware.

Laws requiring educators to report changes in a student’s sexual orientation or gender identity amplify the existing risks of being outed by student spyware, increasing incentives for educators to out students to avoid potential penalties and professional repercussions. Being forcibly outed to one’s classmates, parents, or community can create myriad additional potential harms; the link between forced outing and harassment, bullying, homelessness, and physical violence is well-documented.

Meanwhile, talking to students about gender and sexuality has become increasingly fraught for teachers amid new state legislation, a trend that could be intensely felt by LGBTQ+ students who rely on support systems at school to help navigate a challenging time. A recent national survey by RAND found that new laws focused on gender identity in schools are having wide-ranging impacts on educators, and changing the way educators talk with students — even in states without new laws in place restricting such communication.

Students in the Tucson teacher’s classroom have been asking a series of “what if” questions about new anti-trans laws. “‘What if so and so finds out?’ ‘What if the state decides something?’ ‘What if the country decides something?’” the teacher paraphrased. Their LGBTQ+ students have many questions and concerns when it comes to new anti-trans laws, they explained, emphasizing the importance of the trust relationship in the classroom between students and their teacher — a relationship that could be harmed by surveillance and increased restrictions on communications around gender. “My kids are pretty young — they’re not super plugged into the news yet, but there’s fear,” the teacher said.

Researchers have found that supportive and trusting student-teacher relationships are key for the well-being and self-esteem of LGBTQ+ students. Nationally, anti-trans legislation has had a profound impact on the well-being of trans minors: 86% of transgender and non-binary youth reported that new anti-trans laws negatively impacted their mental health, according to recent research by The Trevor Project.

Online monitoring doesn’t affect all students equally, because students from communities of color and low income communities are more likely to be reliant on devices provided by the school to access the internet, and therefore more likely to have the entirety of their online lives surveilled.

Transgender youth also face higher rates of homelessness and housing instability, with family conflict around gender identity and sexuality as a driving force. “It does even more harm when surveillance is being done and the outing is being done of a trans folks of color ... and especially Black trans youth, because really it’s a death sentence for us to be outed, to be forced out of our housing,” Scott said. “We know very well that there is an uncalled-for assumption of criminality on black bodies.”

Furthermore, online monitoring doesn’t affect all students equally, because students from communities of color and low income communities are more likely to be reliant on devices provided by the school to access the internet, and therefore more likely to have the entirety of their online lives surveilled, warned Hye Jung Han, a researcher and advocate in the Children’s Rights Division at Human Rights Watch. “The end result is that poor and marginalized communities are policed more,” she said.

Potential harms for LGBTQ+ youth could be mitigated by increased federal oversight of student spyware companies, and by children’s data privacy protections, experts say. “I would give the U.S. a failing grade when it comes to protecting children online,” said Han. “Currently, we’re putting too much unearned trust and faith in companies and school districts to decide what is right for kids, without any transparency or questioning whatsoever, and therein lies the danger for children.”

There are two main existing federal laws geared toward protecting children’s data privacy: the Family Educational Rights and Privacy Act (FERPA), and the Children’s Online Privacy Protection Rule (COPPA). But when it comes to federal oversight of student spyware companies, privacy experts say there’s room for improvement. Data amassed by school online monitoring tools is often not covered under FERPA, which limits privacy protections to educational records and carries loopholes for sharing student information with third parties.

“You could conceivably imagine an instance in which this data is either … purchased by a third party, or there’s a data breach or data exploitation of some sort that releases this data out to the public, and is used to identify children that have used any kind of their school’s internet or a device from their school to be able to look up gender-affirming care,” Han said.

COPPA, which passed in 1998 and was last amended in 2013, restricts data collection about children under the age of 13, and is centered on parental consent for collecting such data. It is enforced by the Federal Trade Commission. Tsukayama cautioned that over-reliance on parental consent in children’s data privacy laws also can be harmful, and said there is more the FTC could be doing to crack down on student spyware companies. She did point to a 2022 policy statement on COPPA by the commission as a signal that it’s heading in the right direction. The Biden administration also recently announced a series of executive actions aimed at protecting youth mental health online, some of which could entail added oversight of student spyware. Although the new efforts are well-intentioned, Han said, they “fall far short of the protections that children urgently need.”

In May, lawmakers introduced “COPPA 2.0,”arguing that the existing law needs to be updated to include added protections and cover children up to age 16.

But some congressional efforts to promote child safety online could have unintended harmful consequences for LGBTQ+ youth, according to Greer and others. The recently reintroduced Kids Online Safety Act, which was designed to address some of the shortfalls of COPPA, has been condemned by groups including GLAAD, the ACLU, and the National Center for Transgender Equality because of concerns around censorship of LGBTQ+ content.

Policing Gender and the Chilling Effect

Andy Pham and his transgender classmates at the University of South Florida had already changed the way they communicate because of fear of surveillance, even before the new Florida anti-trans laws were passed. “I have personally advised the [Trans+ Student Union] that in-person is really preferable if you wanna be super paranoid — put away your phones first,” he said, explaining that many transgender students have switched to more secure messaging platforms like Signal and Telegram, and privacy-oriented browser options like DuckDuckGo.

Even if new anti-trans laws are not rigorously enforced, the chilling effect caused by awareness of the laws and the surveillance used to enforce them produces powerful impacts on behavior. “The chilling effect is the point,” said Greer. “There’s some degree of this that will be enforced or enforceable. There’s a lot of it that’s not really enforceable, and they know that.”

An insidious form of enforcement, the chilling effect is evident as families with transgender youth uproot from their homes and move out of state to avoid gender-affirming care bans. In Florida, where a law banning gender-affirming care recently passed and has been blocked by a court order, some health clinics serving transgender children had already shut down prior to the law’s passage rather than risk potential enforcement of state medical board orders prohibiting that care.

The chilling effect of anti-trans laws is worsened by the ubiquity of surveillance technology, according Laperruque. “Making people constantly feel watched changes behavior,” Laperruque said. “Whether or not there’s widespread use for prosecution [of anti-trans laws], just the idea of using that to make individuals feel like they’re always being watched is a way to try to engage in control.” In this way, heightened federal data privacy protections could not only mitigate the harms presented through actual enforcement of laws but also counteract the chilling effect through strengthening public confidence in the privacy of their personal data.

For now, in a climate with minimal federal safeguards and oversight of how surveillance technology can be used, fears around anti-trans laws are amplified for transgender people. “People are looking ahead to a time when everything will just have to go underground, everyone will be running. People are already running,” said Pham. “Trans folks are getting increasingly desperate,” he said. “There are people who have resolved to stay and fight, and I believe that it is worth the cost. And then there are people who can’t afford to leave and can’t afford to stay.”