🏛️ Issues and Advocacy Training
Courses › Surveillance Technology and Privacy

Lesson 7 of 9 · about 15 minutes

Data Brokers and Police Purchases

You'll be able to

  • Trace how location data flows from a phone app to a broker to a government buyer
  • Explain the data broker loophole and the arguments on each side
  • State the status of the Fourth Amendment Is Not For Sale Act and related bills as of October 2026
  • Summarize FTC actions against location data brokers

A weather app asks for your location so it can show the local forecast. You tap Allow. Somewhere in that app's code, a piece of software you never heard of also sends your coordinates, with a device ID and a timestamp, to a company that resells them. A few steps later, a government agency can buy a subscription to that data. Nobody served a warrant on anyone.

How the data moves

Location data reaches the market in a few ways. App developers add SDKs, packages of code from outside companies, sometimes in exchange for payment per user. Some SDKs collect location and send it to a data broker. Ad auctions are another route: when an app shows an ad, it can broadcast details, including location, to many bidders, and some bidders keep the data. Brokers then combine sources, clean them, and sell access.

App plus SDK Data broker Analytics vendor Agency buyer location, ad ID bulk feed subscription

The records are usually keyed to an advertising ID, not a name. Brokers call this anonymous. It rarely stays that way. If a device sleeps at one address every night and spends weekdays at one office, it does not take a detective to guess who owns it.

Worked example: denser than Carpenter

Suppose an app records location every 5 minutes while it runs in the background.

  • Points per day: 1,440 minutes / 5 = 288.
  • Points per 30 days: 288 x 30 = 8,640.
  • Carpenter's records: 12,898 points over 127 days, or about 101.6 per day.
  • Ratio: 288 / 101.6 = about 2.8 times as dense.

And app GPS is often accurate to a few meters, while cell-site records place a phone within a tower's coverage area. The Supreme Court required a warrant for the cruder data in 2018. Buying the sharper data is the gap critics want closed.

The loophole and the argument over it

The Fourth Amendment limits government searches. When police compel a company to hand over records, Carpenter and now Chatrie say location records generally need a warrant. Buying data on the open market is a different act, and agencies have argued that if anyone can buy it, the government can too. That is the data broker loophole.

Agencies' position deserves a fair hearing. At a Senate hearing, FBI Director Kash Patel declined to commit to not buying Americans' location data, saying the bureau does buy commercially available information and that it has produced "some valuable intelligence." Supporters argue that the data is already sold to marketers, insurers and hedge funds, so barring only government buyers would leave investigators with less than a shoe company knows.

The other side, which in Congress has included both conservative Republicans and progressive Democrats, argues that buying data a court would require a warrant to compel defeats the purpose of the warrant. Reporting by NPR in March 2026 said Immigration and Customs Enforcement signed a 2025 contract for a location tool called Webloc, citing 404 Media, and that an FBI spokesperson declined to say which commercial data the bureau buys.

Where federal law stands, as of October 2026

DateEvent
2021Fourth Amendment Is Not For Sale Act first introduced; did not leave committee
July 19, 2023House Judiciary Committee advanced the reintroduced bill
April 17, 2024House passed H.R. 4639, 219 to 199
April 18, 2024Received in the Senate; no further action before the 118th Congress ended
Spring 2026Section 702 renewal debate; Reps. Warren Davidson and Zoe Lofgren and Sens. Mike Lee and Ron Wyden push the Government Surveillance Reform Act, which would require a warrant before buying Americans' data
April to June 2026Congress passed short-term Section 702 extensions; the House passed a three-year renewal without data broker limits; the Senate did not pass a renewal
June 12, 2026Section 702 lapsed, the first lapse since 2008; collection continues under a court certification that runs to March 2027, according to EPIC. No data broker warrant requirement was enacted.

The White House and House Speaker Mike Johnson backed renewing Section 702 without changes, according to NPR's March 2026 reporting. Reporting through mid-July 2026 found Congress had not renewed the statute. This course could not confirm any later action, so check congress.gov for the current status before you cite it in testimony, at a meeting or online.

Some states have moved on their own. Wisconsin lawmakers, for example, introduced state versions of the Fourth Amendment Is Not For Sale Act. State bills like these come and go each session; check your legislature's site.

What the FTC has done

The Federal Trade Commission cannot stop police from buying data. It can go after brokers for unfair or deceptive practices under Section 5 of the FTC Act.

  • X-Mode Social / Outlogic, January 9, 2024. The FTC said X-Mode sold precise location data tied to advertising IDs that could reveal visits to medical and reproductive health clinics, places of worship and domestic abuse shelters, and sold data to private government contractors. The order bans sharing or selling sensitive location data and requires deletion of previously collected location data unless consumers consented or the data is deidentified.
  • Kochava. The FTC sued this Idaho-based broker in August 2022. After years of litigation, the FTC announced a settlement on May 4, 2026, and the stipulated order filed June 26, 2026 would bar Kochava and a subsidiary from selling, sharing or disclosing sensitive location data without consumer consent.
  • Gravy Analytics, Venntel and Mobilewalla. In December 2024 the FTC announced actions against these brokers over selling sensitive location data. Venntel was widely reported to sell to government agencies.
FTC orders limit how brokers sell sensitive data. None of them, by themselves, bar a government agency from buying location data.

Common mix-ups

  • Claim: The data is anonymous, so there is no privacy issue. What the evidence shows: The FTC's X-Mode complaint said the data was not anonymized and could be matched to individuals. Home and work patterns identify most people.
  • Claim: Congress banned police data purchases in 2024. What the evidence shows: The House passed the bill. The Senate never voted. It did not become law.
  • Claim: Only federal agencies buy this data. What the evidence shows: Local agencies have bought broker-based tools too. Check your agency's vendor payments.

Reporting angle

Search your city's and county's check registers and vendor lists for analytics and location data companies. Request contracts and any legal memo justifying purchases without a warrant. Ask the agency directly: "Do you buy or subscribe to any commercial location data, or any tool built on it?" Get the answer in writing. For federal angles, read the bill text on congress.gov and note each sponsor's stated reasons from both parties.

Research angle

Check yourself

1. What is the 'data broker loophole' in plain terms?

2. What happened to the Fourth Amendment Is Not For Sale Act (H.R. 4639) in the 118th Congress?

3. Roughly how many location points per day does an app collect if it records location every 5 minutes?

4. In January 2024, the FTC's order against X-Mode Social (now Outlogic) did what?

5. The FTC's case against Kochava, an Idaho-based data broker, was resolved how, per the FTC's case page?

Terms in this lesson

Data broker
A company that collects personal data from apps, websites, public records and other sources and sells or licenses it.
Advertising ID
A device identifier used for ad targeting. Location records tied to it can often be linked back to a person.
SDK (software development kit)
Code an app developer adds to an app. Some SDKs collect location data and send it to brokers.
Commercially available information
Data anyone can buy, a category federal agencies use to justify purchases without warrants.
Section 702
The part of the Foreign Intelligence Surveillance Act that authorizes collection on foreigners abroad. Its renewal debates have carried data broker amendments.

Full glossary

Sources