CBP Used Ad Tech Data to Track Phone Locations

Legislative Response

Following the disclosure of ICE's ad tech data purchases, approximately 70 lawmakers sent a letter urging the DHS Inspector General to conduct a new investigation into the agency's location data buying practices. The bipartisan concern reflects growing awareness that commercial data purchases represent a significant gap in existing surveillance law.

Current legal frameworks were designed for an era when the government needed to install physical tracking devices or obtain wiretap orders to conduct location surveillance. The Supreme Court's 2018 Carpenter v. United States decision established that accessing historical cell-site location records requires a warrant, but lower courts have been divided on whether purchasing commercially available location data falls under the same constitutional protections.

Privacy advocates argue that the distinction is meaningless from the perspective of the person being tracked. Whether the government obtains location data from a cell carrier via subpoena or purchases even more precise GPS data from an advertising broker, the privacy intrusion is identical. Several proposed bills would require warrants for government purchase of commercially available personal data, but none have yet been enacted.

The Advertising Industry's Role

The advertising ecosystem's role in enabling government surveillance has drawn criticism from civil liberties organizations worldwide. Johnny Ryan, director of the Irish Council for Civil Liberties Enforce program, described the available advertising data as a "goldmine for tracking where every person is and what they read, watch, and listen to."

The technical infrastructure that makes this surveillance possible is called real-time bidding — the system through which digital advertisements are bought and sold in milliseconds. Every time a user loads a webpage or opens an app, information about that user including their location, device type, browsing history, and demographic data is broadcast to hundreds of advertising companies in bid requests. This data is supposed to be used only for ad targeting, but the sheer volume and lack of enforcement creates ample opportunities for secondary uses including surveillance.

Major advertising industry groups have largely avoided addressing the government surveillance implications of their data practices. The existing self-regulatory framework focuses on consumer-facing issues like ad relevance and opt-out mechanisms, not on preventing the wholesale purchase of location data by federal agencies for immigration enforcement or other law enforcement purposes.

Broader Implications

The CBP data purchasing program illustrates a fundamental tension in the digital economy. The business model that funds free apps and websites depends on collecting and monetizing user data. That same data, once collected and sold, becomes available to any purchaser — including government agencies seeking to conduct surveillance without judicial oversight.

Privacy researchers have warned that as long as the advertising data pipeline exists, it will be exploited for purposes far beyond its original intent. Technical countermeasures like disabling location permissions on individual apps offer limited protection, since many apps use alternative location-inference techniques including WiFi network scanning and Bluetooth beacon detection.

The only comprehensive solution, critics argue, would be federal privacy legislation that restricts what data apps can collect in the first place — cutting off the supply of location data before it enters the advertising ecosystem and becomes available for purchase by government agencies or anyone else willing to pay.

This article is based on reporting by 404 Media. Read the original article.