Bought Without a Warrant: How Data Brokers Turned Your Phone Into a Police Informant
The Warrant They Never Had to Get
In the spring of 2023, the Federal Trade Commission published findings confirming what civil liberties advocates had long suspected: data brokers were selling extraordinarily granular personal information — precise GPS coordinates, purchasing histories, social connections, even inferred religious and political beliefs — to a range of buyers that included federal, state, and local law enforcement agencies. No judge signed off. No probable cause was established. No suspect was named in advance. The transaction looked, legally speaking, like any other commercial sale. That is precisely the problem.
The practice is not new, but its scale has metastasized alongside the smartphone economy. According to a 2022 report by the Duke Sanford School of Public Policy, data brokers were openly advertising the sale of location data to military and law enforcement clients, sometimes bundling months of movement history on individual Americans for a few thousand dollars — a fraction of the cost of a traditional investigation, and entirely free of judicial oversight.
The Fourth Amendment Has a Loophole the Size of a Data Center
The constitutional framework governing search and seizure was written in an era when surveillance required physical presence. The Supreme Court has attempted to update that framework incrementally — most notably in Carpenter v. United States (2018), where the Court held that accessing historical cell-site location data without a warrant violated the Fourth Amendment. Chief Justice John Roberts, writing for the majority, acknowledged that digital-age surveillance required a rethinking of the so-called "third-party doctrine," the legal principle holding that information voluntarily shared with a third party loses its constitutional protection.
But Carpenter was deliberately narrow. It addressed cell tower data held by carriers. It said nothing explicit about the commercial data broker market — a sprawling, largely unregulated industry that the FTC estimates generates over $200 billion annually. Law enforcement agencies have moved aggressively into that gap, treating the commercial purchase of data as categorically different from a warrant-compelled disclosure, even when the practical result — detailed surveillance of a person's movements, associations, and habits — is functionally identical.
The American Civil Liberties Union and the Electronic Frontier Foundation have both documented cases in which Immigration and Customs Enforcement, the DEA, and local police departments used commercially purchased location data to track individuals without ever approaching a judge. In at least some of those cases, the targets were later found to have committed no crime.
Who Gets Watched
The surveillance economy does not operate neutrally. Research from Princeton University's Center for Information Technology Policy and from academic privacy scholars consistently shows that data broker profiles are densest — and most frequently purchased — for residents of majority-Black, Latino, and low-income ZIP codes. The reasons are partly structural: lower-income Americans are more likely to use free, ad-supported apps that harvest location data as a condition of use, less likely to have legal representation that could challenge surveillance-derived evidence, and more likely to live in neighborhoods already subject to elevated police presence.
The consequences compound. A resident of a heavily surveilled ZIP code who is flagged by a predictive algorithm built on purchased data may be stopped, questioned, or arrested based on a profile they never consented to build and cannot access to dispute. The data broker's output becomes the predicate for a police contact that generates its own record, which feeds back into future algorithmic assessments. It is a closed loop of suspicion, and it runs on commercial infrastructure that faces no meaningful public accountability.
Immigrant communities face a distinct and acute version of this threat. ICE's use of commercial data purchases to locate undocumented individuals — documented by Georgetown Law's Center on Privacy and Technology — has effectively turned the data economy into an immigration enforcement tool, one that operates without the congressional authorization that formal surveillance programs require.
The Lobbying Wall
Comprehensive federal privacy legislation has been introduced in nearly every congressional session for the past decade. The American Data Privacy and Protection Act cleared the House Energy and Commerce Committee in 2022 with rare bipartisan support, only to stall in the Senate amid objections from the tech industry and disagreements over whether federal law should preempt stronger state protections. The data broker lobby — which includes some of the largest names in digital advertising — spent over $60 million on federal lobbying between 2019 and 2023, according to OpenSecrets tracking.
The industry's core argument is that data purchases represent consensual commercial transactions: users agreed to terms of service, advertisers bought the resulting profiles, and downstream buyers — including police — simply accessed what was already on the market. This is the strongest version of the opposition case, and it deserves a direct response. Consent obtained through forty-page terms of service that no one reads, presented as a condition of using tools that modern economic life increasingly requires, is not meaningful consent. It is coerced acquiescence dressed in legal language. The constitutional protection against unreasonable search was not designed to be waivable by clicking "I Agree."
What Forward Looks Like
Several states have begun to act in the absence of federal movement. California's Delete Act, signed in 2023, created a mechanism for residents to request deletion of their data from all registered brokers through a single portal — a significant step, though one that does nothing to restrict law enforcement purchases of data collected before deletion requests are submitted. Vermont requires data brokers to register with the state. Washington's My Health MY Data Act restricts the commercial use of health-related data. These are meaningful but incomplete measures.
What is needed is federal legislation that closes the warrant-purchase loophole explicitly — requiring law enforcement agencies to obtain judicial authorization before purchasing commercially available data that would otherwise require a warrant to compel. Senator Ron Wyden has introduced versions of such legislation; they have not advanced. The 2024 election cycle produced no major-party platform commitment to comprehensive data privacy reform. The issue remains, as it has been for years, technically bipartisan in polling and functionally orphaned in practice.
American democracy depends on the principle that government power over individuals must be checked, authorized, and transparent. A surveillance apparatus that routes around that principle through a commercial intermediary is not a loophole — it is a structural subversion of constitutional governance, and it is expanding every year that Congress fails to act.
The right to move through the world without being commercially packaged and sold to the state is not a technicality — it is the foundation of a free society, and Congress's continued refusal to protect it is a choice with a body count.
