The Loophole at the Heart of American Surveillance
In 2018, the Supreme Court ruled in Carpenter v. United States that the government must obtain a warrant before collecting cell phone location data from a carrier. It was widely seen as a landmark privacy ruling — an acknowledgment that the digital trails we leave behind reveal an intimate picture of our lives, and that the Fourth Amendment's protections extend to those trails.
But the ruling had a significant gap: it applied only to data obtained directly from carriers. Data purchased from commercial data brokers — companies that aggregate location information from apps, advertising networks, and device sensors — fell outside its scope. Law enforcement agencies immediately recognized the opportunity, and in the years since, the FBI, the Department of Homeland Security, the IRS, and other federal agencies have quietly built surveillance programs around this loophole.
At a Senate hearing last week, FBI Director Kash Patel made that practice official and public. Under oath, he confirmed that the bureau purchases commercially available location data. "We do purchase commercially available information that's consistent with the constitution and the laws under the Electronic Communications Privacy Act," Patel told senators, "and it has led to some valuable intelligence for us."
What Data Brokers Actually Sell
To understand why this matters, it helps to understand what commercial location data actually contains. Data brokers aggregate location information from the GPS chips in smartphones, primarily harvested by the apps we install — weather apps, games, retail loyalty programs — that request location permissions and then sell that data to intermediaries. Some of this data is nominally anonymized, but researchers have repeatedly demonstrated that anonymization is largely cosmetic: patterns of movement are so unique to individuals that re-identification is straightforward.
The resulting datasets can contain location pings with timestamps accurate to within a few meters, updated every few minutes, stretching back months or years. For a federal agency purchasing such data, the practical effect is nearly indistinguishable from continuous warrantless surveillance of an individual's physical location history — except that instead of going to a judge for approval, the agency simply makes a commercial purchase.
Patel's admission makes clear that the FBI views this as a legitimate practice. The legal reasoning is technically defensible under current precedent: data that has been voluntarily shared with a commercial third party falls under the third party doctrine, which holds that such information carries no reasonable expectation of privacy. Courts established this doctrine in an era of landlines and bank records; applying it to smartphone location data capable of tracking every movement of a person's daily life is a different proposition entirely.







