A booming industry of data brokers harvests huge amounts of information from smartphone apps, web browsers and other digital sources, then packages and sells those records to advertisers — and to government agencies. Privacy advocates warn that when law enforcement and federal agencies buy bulk location and other datasets from brokers, they can reconstruct intimate details about Americans’ lives without obtaining a warrant.
Congress faces a near-term opportunity to address that loophole as it considers reauthorization of Section 702 of the Foreign Intelligence Surveillance Act, which is set to expire on April 20. After reforms in 2015, federal agencies were prohibited from collecting Americans’ data in bulk. But critics say some agencies have simply paid private firms for the same kinds of datasets, effectively sidestepping the statutory limit.
About 130 civil-society organizations recently urged lawmakers to include language in the FISA 702 reauthorization that would bar agencies from buying bulk brokered data. The groups warned of an “unprecedented expansion of warrantless mass surveillance” and cautioned that combining brokered records with artificial intelligence could “supercharge AI-powered surveillance.”
At a Senate hearing, Sen. Ron Wyden pressed the FBI’s director, Kash Patel, to promise the bureau would not purchase Americans’ location data. Patel demurred, saying the FBI “uses all tools” and acquires “commercially available information” consistent with the law, and he declined to detail which commercial datasets the bureau buys. Former FBI Director Christopher Wray signaled in 2023 that the agency had reduced its reliance on some location data derived from internet advertising, but the FBI has not published a comprehensive accounting.
Location datasets sold by brokers are often marketed as de-identified, but analysts and modern tools can combine movement patterns, timestamps and contextual signals to trace where a device spends nights and workdays or to reidentify the person who owns it, said Bill Budington of the Electronic Frontier Foundation. That reidentification risk is central to privacy advocates’ concerns: datasets that appear anonymized are routinely vulnerable to being matched with other information.
The rise of powerful AI tools escalates the issue. Anthropic CEO Dario Amodei warned that brokered records, paired with automated analysis, can produce “a comprehensive picture of any person’s life — automatically and at massive scale.” That possibility prompted a public break with the Department of Defense after Anthropic sought limits on domestic mass-surveillance uses of its technology.
Several federal agencies have acknowledged contracts or reported uses of tools that rely on brokered location feeds, including the FBI, the Department of Defense and Immigration and Customs Enforcement. ICE’s surveillance programs have expanded beyond traditional deportation targets; the agency has used facial recognition, license-plate databases and legal process to obtain tech-company data, and it sought industry feedback this year on “commercial Big Data and Ad Tech” for investigatory use. Last year ICE contracted with Penlink for a product called Webloc, software reported to analyze mobile-phone movements and identify devices that visited particular locations. Penlink says vendors filter out “sensitive locations” such as hospitals, schools and houses of worship and that it follows applicable law.
Privacy experts warn that government purchasing of broker data creates an ever-expanding private-sector surveillance infrastructure that risks pushing the country toward a more pervasive surveillance state. Jeramie D. Scott of the Electronic Privacy Information Center called the trend “building an infrastructure of private sector surveillance” that bypasses warrants and judicial oversight.
Advocates say the FISA reauthorization is the most immediate opportunity to stop agencies from buying bulk broker data. A bipartisan group of lawmakers — Rep. Warren Davidson (R-Ohio), Sen. Mike Lee (R-Utah), Rep. Zoe Lofgren (D-Calif.) and Sen. Ron Wyden — introduced bicameral legislation to close the data-broker loophole and pursue other reforms. Davidson framed the issue as nonpartisan, arguing that purchasing brokered datasets creates “a broad dragnet sweep under normal warrant requirements.” He also supports curbing so-called backdoor searches, where agencies search Americans’ communications that were incidentally collected in foreign-intelligence investigations.
But efforts to attach privacy reforms to the FISA package face political resistance. The White House and House Speaker Mike Johnson have pushed for a clean reauthorization without substantive changes, and some members of Congress prefer avoiding a lapse in the law. Speaker Johnson delayed a planned House vote amid internal opposition.
Courts have not yet resolved the legality of government purchases from data brokers, leaving the practice in a legal gray area. Privacy advocates argue that paying for bulk records defeats the intent of the 2015 USA Freedom Act, which followed disclosures about mass collection and was meant to rein in bulk acquisition of Americans’ data. Jake Laperruque of the Center for Democracy & Technology noted lawmakers did not intend to allow agencies to “do bulk collection, but also pay taxpayer money for it.”
Advocates point to Supreme Court precedent that supports warrant protections for location data. In Carpenter v. United States (2018), the Court ruled that law enforcement generally must obtain a warrant to access a person’s historical cell-site location records from carriers. Critics of the broker-purchase practice say it is inconsistent to require a warrant for carrier-held location data while allowing agencies to buy equivalent datasets from private firms without judicial oversight.
For many privacy experts, the combined trends of widespread brokered data, sophisticated reidentification techniques and automated analysis make an urgent case for tighter rules. They urge Congress to explicitly bar government bulk purchases of brokered datasets and to require warrants when location or similarly intrusive records are sought — steps they say are necessary to preserve Fourth Amendment protections in an era of commercialized surveillance and AI-driven analysis.