A large industry of data brokers collects vast amounts of information from smartphone apps, web browsers and other sources, packaging and selling it to advertisers. That same industry also sells bulk location and other datasets to law enforcement and federal agencies — a practice privacy advocates say can reveal intimate details about Americans without a warrant.
Congress may have a chance soon to close that loophole when it takes up reauthorization of Section 702 of the Foreign Intelligence Surveillance Act, which is scheduled to expire on April 20. After changes in 2015, federal agencies were barred from collecting Americans’ data in bulk. But agencies have sidestepped that prohibition by purchasing the same kinds of datasets from commercial brokers.
Last week, about 130 civil-society groups signed a letter urging lawmakers to include language in the FISA 702 reauthorization to stop government buying of bulk data, warning of an “unprecedented expansion of warrantless mass surveillance” and the risk that the data could “supercharge AI-powered surveillance.”
At a recent Senate hearing, Sen. Ron Wyden (D-Ore.) pressed the FBI’s director, Kash Patel, to commit to not buying Americans’ location data. Patel declined, saying the FBI “uses all tools” and purchases “commercially available information” consistent with applicable law, which he said has provided valuable intelligence. The FBI declined to detail which commercial datasets it buys. In 2023, former FBI director Christopher Wray suggested the agency had stepped back from using some location data derived from internet advertising.
Location datasets sold by brokers are often not directly linked to names, but analysts and law enforcement tools can use them to trace where a device goes, where it spends nights and work hours, or to identify patterns that lead to identification, said Bill Budington, senior staff technologist at the Electronic Frontier Foundation.
Artificial intelligence increases the privacy stakes. Anthropic CEO Dario Amodei warned that records bought from brokers can be combined with AI to build “a comprehensive picture of any person’s life—automatically and at massive scale.” That concern contributed to a public rift between Anthropic and the Department of Defense after the company sought limits on domestic mass surveillance uses of its technology.
Several federal agencies — including the FBI, Department of Defense and Immigration and Customs Enforcement — have known contracts or reported use of tools that rely on brokered location information. ICE has been expanding surveillance efforts beyond deportation targets to people who record agents and protesters, using facial recognition, license-plate databases and subpoenas to obtain tech-company data. Earlier this year, ICE sought industry feedback on “commercial Big Data and Ad Tech” for investigatory use. Last year, ICE contracted with Penlink for Webloc, software reported to track mobile-phone movements and identify phones that visited specific locations. Penlink said its vendors filter out “sensitive locations” such as hospitals, schools and religious institutions and that it complies with applicable laws.
Privacy experts say government purchases without a warrant are building “an ever-expanding infrastructure of private sector surveillance” and pushing the country toward a dystopian surveillance state, according to Jeramie D. Scott of the Electronic Privacy Information Center.
Advocates view the FISA reauthorization as the best immediate opportunity to stop agencies from buying bulk broker data. Sean Vitka of Demand Progress said it may be the only meaningful chance this year to enact privacy protections, noting recent changes to FISA and rapid advances in AI increase the danger of broad surveillance powers.
A bipartisan group of lawmakers — Rep. Warren Davidson (R-Ohio), Sen. Mike Lee (R-Utah), Rep. Zoe Lofgren (D-Calif.) and Sen. Ron Wyden — introduced bicameral legislation that would close the data-broker loophole among other reforms. Davidson, who described the issue as nonpartisan, told NPR that buying broker data creates a “broad dragnet sweep under normal warrant requirements.” He also supports ending so-called “backdoor searches,” where agencies search Americans’ communications collected incidentally in foreign intelligence sweeps without a warrant.
Efforts to attach reforms to FISA face resistance. The White House and House Speaker Mike Johnson have pushed for a clean reauthorization without changes, and some Democrats have signaled they favor that approach to avoid letting the law lapse. Johnson delayed a planned House vote until mid-April amid internal opposition.
Courts have not yet ruled on the legality of government purchases from data brokers, leaving the practice in a legal gray area. Privacy advocates argue it defeats the spirit of the 2015 USA Freedom Act, which followed disclosures about bulk collection and was meant to bar bulk collection of Americans’ data. Jake Laperruque of the Center for Democracy & Technology said Congress did not intend to allow agencies to “do bulk collection, but also pay taxpayer money for it.”
Advocates also point to Supreme Court precedent that supports warrant protections for location data. In Carpenter v. United States (2018), the Court held that law enforcement generally needs a warrant to obtain a person’s historic cell-site location data from carriers. Laperruque and others say it makes little sense to allow law enforcement to buy equivalent data from brokers without a warrant, especially since so-called anonymized datasets can often be reidentified.
“The analogy is obvious,” Laperruque said: if police can’t lawfully enter a home without a warrant, they shouldn’t be able to pay a third party for access that amounts to the same search. Davidson agreed that a broader privacy law is ultimately needed but said Congress must immediately stop governments from buying their way around the Fourth Amendment.
AI magnifies the urgency, advocates say. Combining massive brokered records with automated analysis creates new surveillance capabilities that human analysts alone could not achieve, opening novel risks for privacy and civil liberties if the practice continues unchecked.