The FBI, ICE, and Department of Defense have spent years buying your location data from commercial brokers. They don’t need a warrant. They just need a credit card.
Now Congress has a chance to close that loophole — but the window is narrow. Section 702 of the Foreign Intelligence Surveillance Act expires on April 20, 2026, and a bipartisan coalition is pushing to attach meaningful privacy protections before it’s renewed.
The Government Buys What It Can’t Legally Collect
After a 2015 court ruling limited bulk data collection by federal agencies, the intelligence community found a workaround: purchase the data commercially instead. Data brokers sell cell phone location information — where you sleep, where you work, where you worship, who you visit — to anyone with enough money, including law enforcement agencies that would otherwise need a warrant.
ICE signed a contract with surveillance company Penlink for its Webloc program, which tracks mobile phone movements and identifies devices that visited specific locations. Earlier this year, ICE also requested information about “commercial Big Data and Ad Tech” tools for investigations.
”You’re collecting data that really you would never get a warrant for, that kind of a broad dragnet,” Rep. Warren Davidson (R-Ohio) told NPR.
The Electronic Frontier Foundation’s Bill Budington put it bluntly: these tools reveal “where a device has gone, where it spends every night and where it goes during working hours.”
The Government Surveillance Reform Act
A bipartisan group of lawmakers introduced legislation this week to close the loophole. The Government Surveillance Reform Act, sponsored by Senators Ron Wyden (D-Oregon) and Mike Lee (R-Utah) alongside Representatives Zoe Lofgren (D-California) and Warren Davidson (R-Ohio), would:
- Ban warrantless data purchases — Federal agencies could no longer buy Americans’ location, browsing, or communications data from brokers without a warrant, court order, or subpoena
- Close the backdoor search loophole — Require warrants for searches of Americans’ communications collected under Section 702
- Repeal the 2024 surveillance expansion — Remove language that broadened who can be compelled to assist with surveillance
- Protect new data categories — Require warrants for location information, web browsing data, search and chatbot records, and car telematics
”We certainly wouldn’t imagine a scenario where the police said, ‘We’re going to search your house. We don’t have a warrant, but we paid your landlord $100 to give us a spare key,’” said Jake Laperruque of the Center for Democracy & Technology.
The Clock Is Ticking
Section 702 expires April 20. The White House and House Speaker Mike Johnson want a “clean reauthorization” — renewal without changes. A House vote has been delayed until mid-April, giving reformers a narrow window to build support.
More than 130 civil society organizations have signed a letter opposing reauthorization without closing the data broker loophole. Privacy advocates say this is the best chance in years to pass meaningful surveillance reform.
”This is very likely the only chance that Congress has this year to vote for meaningful privacy protections,” said Sean Vitka, executive director of Demand Progress.
FBI Director Kash Patel acknowledged the practice in recent testimony: “We do purchase commercially available information… and it has led to some valuable intelligence for us.” He declined to commit to stopping.
Why AI Makes This Worse
The stakes are higher than ever because artificial intelligence can now process purchased surveillance data at scale. Anthropic CEO Dario Amodei, testifying before Congress, warned that AI systems can assemble “a comprehensive picture of any person’s life — automatically and at massive scale.”
What was once prohibitively expensive — manually tracking thousands of people through location data — is now trivial. The surveillance infrastructure exists. The data flows freely. The only question is whether Congress will require a warrant before federal agencies tap into it.
What Happens Next
If Congress passes a clean reauthorization, the data broker loophole remains open indefinitely. If Section 702 expires without action, the legal situation becomes uncertain — but the commercial surveillance apparatus keeps running regardless.
The path forward is clear: require a warrant. The bipartisan support exists. Whether the political will does remains to be seen.
What You Can Do
While Congress debates, you can limit your exposure to commercial surveillance:
- Audit your apps — Location permissions should be off by default. Review which apps have access and revoke anything unnecessary
- Use a privacy-respecting DNS — Encrypted DNS prevents tracking of which websites you visit. Quad9 (9.9.9.9) and NextDNS are solid options
- Opt out of data brokers — Services like DeleteMe and our Data Purge tool help remove your information from commercial databases
- Switch to privacy-first services — Data that doesn’t exist can’t be sold. Choose cloud providers that minimize data collection and store data in protective jurisdictions
The surveillance state depends on your data being available for purchase. Make it harder to buy.