Ireland's two largest anti-abortion campaigns are facing questions over privacy after a BuzzFeed News analysis found that personal user data gathered by both of their apps can be shared with an international network of conservative and religious groups that includes the US National Rifle Association.
The Save the 8th campaign and the LoveBoth Project are at the forefront of the campaign to prevent the repeal of the Eighth Amendment of Ireland's constitution – which makes abortion illegal in most cases – when the country votes in a referendum this Friday.
Both have launched activist community apps to encourage supporters to digitally organise their contact networks to vote against repeal.
Save the 8th's My8 app and the LoveBoth app were developed by the same Washington, DC–based company, Political Social Media LLC, which specialises in building digital campaigning tools for conservative, religious, and anti-abortion groups.
Both uCampaign, which hosts the LoveBoth app, and Jarbik, which hosts My8, are registered to Political Social Media.
As well as being built to a near-identical template, the two apps share near-identical terms of service for users. A BuzzFeed News analysis of these reveals that users have to agree that their personal data can be shared with any other campaign groups and clients the company chooses.
Privacy policies linked from the iTunes store page for both apps state that as well as sharing personal information with third-party campaigns selected by users from within the apps, uCampaign and Jarbik "may share your personal information with other organizations, groups, causes, campaigns, political organizations, and our clients that we believe have similar viewpoints, principles or objectives as us".
This means data can be shared not just between the two ostensibly separate Irish anti-abortion groups, but also with previous clients such as the NRA, the Trump presidential campaign, the Republican National Committee, and the Susan B. Anthony List, a major US anti-abortion group. In the UK, the network includes the Conservative Party and main pro-Brexit campaign, Vote Leave.
The company has also developed apps for the Australian Christian Lobby and Marriage Alliance, two groups that campaigned unsuccessfully against marriage equality when the country voted on the issue in a postal survey last November.
BuzzFeed News asked uCampaign, LoveBoth, and Save the 8th multiple times whether data collected using the individual apps had been shared between the two campaigns or with any of these other groups, but received no response from any of them.
Users of the LoveBoth and My8 apps are prompted to accept the privacy policies when downloading the apps, and web links to the policies remain within the apps once downloaded.
Confusingly, if users follow links to privacy policies from within the apps, they are directed to different webpages to those linked from the iTunes store. These do not include the paragraph on sharing data with "aligned organizations". Dates on the pages show that the privacy policies with that paragraph linked from the iTunes store were the most recently updated.
They require users to allow access to their contacts in order to perform most basic functions of the apps, including using email, WhatsApp, text message, Twitter, or Facebook to share campaign material, for which users are rewarded with in-app points.
Personal information that can be shared includes an individual’s name, email, street address, telephone number, geolocation information, image, and gender.
"If you do not agree to this privacy policy, you may not use the Platform," the terms and conditions for both LoveBoth and My 8 state.
Concerns over data sharing and foreign interference have been a constant theme of Ireland’s abortion referendum since the campaign launch, and there has already been evidence of non-Irish organisations paying for targeted Facebook posts encouraging Irish users to vote against legalising abortion.
While Facebook has recently imposed a ban on referendum ads from outside Ireland, local groups can continue to pay to promote and target content. Google meanwhile has halted all ads relating to the referendum, including from within Ireland.
In a blog post describing the successes of the Vote Leave and Trump campaign apps, which function in the same way as those used by the anti-abortion campaigns, a uCampaign spokesperson said the Trump app was able "to match the phone address book contacts of supporters to a voter universe".
Political Social Media is run by Catholic blogger Thomas Peters. Data within the My8 app shows that it was signed and issued by "Social Political Media (Thomas Peters)". Peters and "Social Political Media" are also listed as data controller for the LoveBoth app and the privacy policy relating to uCampaign.
Analysis of both apps by independent data protection and privacy consultant Pat Walshe using the Exodus privacy tool found they could access a variety of user data including location, contacts, and calendar.
"Both apps also contain analytics tracking code that can impact on user privacy," Walshe told BuzzFeed News.
Trackers contained within both apps include Facebook analytics, which Facebook describes as "your one-stop growth shop", using funnels, cohorts, segmentation, breakdown tables, automated push campaigns, and deep demographic information to segment and analyse users' behaviour.
"There are a number of questions about the degree to which data gathered by the apps are combined with other data and profiles created and used," Walshe said, adding: "I do not believe people downloading the app will be aware of the trackers and their use in helping third parties such as the US-based developer/platform monitor user behaviour."
Thomas Peters did not respond to multiple requests for comment on the apps and the way in which they share data.
Political Social Media is also behind a peer-to-peer text campaign service, RumbleUp – launched in February – which recently claimed to have run its first international campaign to "notify 12,000 potential supporters of a local piece of legislation in a foreign country to contact their local representatives before they were scheduled to vote on it".
Despite sharing a central Dublin address and using apps from the same company, Save the 8th and LoveBoth have said that their campaigns are not connected in any way.