Privacy advocates sound alarm on ‘data broker loophole’ used by FBI, other federal agencies

The data broker loophole is top of mind for privacy advocates following FBI Director Kash Patel’s congressional testimony earlier this week, during which he confirmed the Department of Justice component is paying for data that is then used in law enforcement operations. 

When asked by Sen. Ron Wyden, D-Ore., if he could commit to not buying Americans’ location data, Patel said the FBI “uses all tools” to do its mission. 

“We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act,” Patel said under oath. “It has led to some valuable intelligence for us.”

The FBI did not respond directly to FedScoop’s questions about oversight of these purchases and whether there are audits to prevent misuse. A spokesperson said: “The Director did not state the FBI is purchasing Americans’ location data.”

Privacy advocates say the comments are just the latest example of the opaque nature in which these dataset procurements are conducted. 

“It further underscores the fact that we lack sufficient transparency in order to have meaningful oversight of what the government is doing,” said Alan Butler, executive director and president of the Electronic Privacy Information Center. “We’re truly in a kind of black hole.”

The data broker ecosystem has ballooned over the past decade or so, resulting in a multibillion-dollar industry. The mass data aggregation typically stems from user activity on a website or app, and approval for sharing this data can be buried in the hundreds of pages of terms and conditions that accompany each application.

Data brokers sell information tied to an individual’s behavior and location, according to Thomas Daly, CEO and founder of privacy management software company mePrism. 

“By paying data brokers, the government can track individuals in real time and in deeply personal ways without a warrant or citizen notification,” Daly said in an email. “With hundreds of brokers in operation and no centralized federal ledger, there is a complete lack of transparency regarding the total amount spent on citizen surveillance and the specific data being purchased.”

Other agencies are familiar with data brokers, too. The Department of Homeland Security and its components have allegedly purchased Americans’ location data. Earlier this month, more than 70 Democrats in the House and Senate called on the DHS inspector general to investigate the agency’s data collection efforts via contracts with “shady” data brokers.

Precedent and power

Those in favor of cracking down on data brokerage have several operational standards that they reference as possible precedents.

The intelligence community published a framework in May 2024 for oversight of commercially available information, but it is unclear whether the framework is still in place. Law enforcement agencies haven’t published a similar set of rules. 

There are also laws that require federal agencies to obtain warrants before accessing data that is stored on a person of interest’s computer. The Fourth Amendment is another frequently cited standard of operating as it gives Americans the right to protect belongings against unreasonable searches and seizures. 

Some congressional leaders disagree with privacy advocates on the unconstitutionality of procuring data that’s up for sale. 

“The keywords are commercially available — if any other person can buy it and the FBI can buy it, and it helps them locate a depraved child molester or savage cartel leader, I would certainly hope the FBI is doing anything they can to keep Americans safe,” Sen. Tom Cotton, R-Ark., said during the hearing.

Most privacy advocates argue that the data brokerage economy should broadly have more limits, according to Jake Laperruque, deputy director of the Center for Democracy and Technology’s Security and Surveillance Project. The government’s unique power, however, presents an existential issue. 

“Pointing out a second problem we need to solve doesn’t show the absence of a first one,” Laperruque said. “Congress needs to step up and do a better job to protect Americans’ privacy.”

Commercial entities are often going to data brokers to create advertising profiles. Law enforcement agencies have a different goal. 

“Enterprise Rent-A-Car can’t send armed federal agents to bust down your door and accuse you of a crime,” said Patrick Eddington, senior fellow in homeland security and civil liberties at the Cato Institute. 

Other sources FedScoop talked to echoed the sentiment: “There is nothing that matches the power of the government to investigate you, to rifle through your life and to potentially inflict all the dangers and punishments of the criminal justice system,” Laperruque said. 

Cotton also compared the FBI’s data purchases to that of law enforcement going through trash that Americans put on their curb. 

“You no longer have a privacy interest in it,” Cotton said. 

Cotton’s analogy references a 1988 Supreme Court case where a search of someone’s trash on a public street that led to a warrant and eventual arrest was upheld. The privacy advocates that FedScoop spoke with pushed back on the accuracy of the trash analogy. 

Most cellphone owners use facial recognition or alphanumerical passcodes to secure their device data. But these efforts “basically get undone,” Eddington said, when information from the apps being used on the device are sold — unknowingly and discreetly — to law enforcement.  

“That’s what we mean when we talk about a literal end run around the Fourth Amendment,” Eddington said. 

Laperruque said a more accurate analogy would be if the FBI wanted to search an apartment and agents gave the landlord a hefty sum to get a key. 

“We wouldn’t say, ‘Oh, well, they bought the access,’” Laperruque said. “That’s just not what they’re allowed to do.”

Some lawmakers have tried to close the data broker loophole. 

The Fourth Amendment Is Not For Sale Act gained momentum a few years ago before it ultimately stalled. An updated version of the Government Surveillance Reform Act was introduced last week by a bipartisan, bicameral group of congressional members. If passed, the legislation would prohibit federal agencies from buying Americans’ data without a warrant and effectively close the data broker loophole.

During the hearing earlier this week, Wyden expressed his support for the bill he helped introduce. 

“It’s particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information,” Wyden said of the current landscape. “This is Exhibit A for why Congress needs to pass our bipartisan bicameral bill.”