Last updated:
🛒 Police Buying Your Data From Brokers: The Warrant Loophole
Agencies that would need a warrant to demand your phone’s location history can often just buy it. Here is how the loophole works, who uses it, and why the law is still unsettled.
Quick answer: Police and federal agencies can often buy location and personal data from data brokers. To demand the same data from a phone company, they would need a warrant. US privacy law limits what providers may hand to the government. It says little about brokers who buy the same data and resell it. No court has squarely ruled whether these purchases are a Fourth Amendment search Criminal Legal News (1 Jul 2026). That gap is the “data broker loophole”.
How does the loophole work?
- Apps collect it. Weather, game and shopping apps gather your location through ad software built into them, or leak it in ad auctions Criminal Legal News (1 Jul 2026).
- Brokers pool it. Companies such as Venntel and Gravy Analytics buy those feeds and tie each point to a phone’s advertising ID Criminal Legal News (1 Jul 2026).
- Vendors package it. Tools such as Babel Street’s Locate X, Penlink’s Webloc and Fog Reveal let agencies search the pooled data by area or by device Criminal Legal News (1 Jul 2026) AP via PBS NewsHour (1 Sep 2022).
- Agencies buy access. A licence is a purchase, not a demand, so no subpoena or warrant is filed.
The legal hook is the Stored Communications Act. It bars phone companies and online services from voluntarily giving customer records to “a governmental entity”. They may share them with anyone else 18 U.S.C. § 2702, Cornell LII. A broker that is not itself the service falls outside that rule, so the data reaches the government by way of a sale.
Who buys it?
| Buyer | What is reported | Source |
|---|---|---|
| ICE | Venntel customer; a $2.3 million Penlink contract in autumn 2025 for Webloc access | Criminal Legal News (1 Jul 2026) |
| CBP | Venntel contracts worth more than $2 million in 2019–20; a Babel Street renewal of nearly $3 million | Criminal Legal News (1 Jul 2026) |
| FBI | In March 2026 Director Kash Patel told senators: “we do purchase commercially available information”. It was unclear whether he meant location data | Biometric Update (Mar 2026) |
| Defense Intelligence Agency | Told Congress in 2021 it funds another agency that buys phone location metadata; its view is that Carpenter needs no warrant for purchases | Biometric Update (Mar 2026) |
| Secret Service, IRS, DEA, Defense units | Babel Street and Venntel contracts, including Special Operations Command access to Locate X | Criminal Legal News (1 Jul 2026) |
| Local police | Webloc users include Los Angeles, Dallas, Baltimore County, Tucson and Durham police and the Texas Department of Public Safety | Citizen Lab, Report 191 (9 Apr 2026) |
| Local police | Fog Reveal: about 40 contracts with nearly two dozen agencies, licences from $7,500 a year, 250 million devices | AP via PBS NewsHour (1 Sep 2022) |
Citizen Lab found Webloc draws on up to 500 million devices worldwide and up to three years of history Citizen Lab, Report 191 (9 Apr 2026). AP found some police used Fog Reveal without a warrant AP via PBS NewsHour (1 Sep 2022).
Why is it legally ambiguous?
The case for buying. Under the third-party doctrine, information you hand to a business, such as bank records (United States v. Miller, 1976) or dialled numbers (Smith v. Maryland, 1979), generally has no Fourth Amendment protection Criminal Legal News (1 Jul 2026). Agencies add that they buy openly sold data on the same terms as any customer. They also say it carries an ad ID, not a name. That is the position the DIA has taken Biometric Update (Mar 2026).
The case against. In Carpenter v. United States (2018) the Court required a warrant for historical cell-site records. It declined to apply the third-party doctrine mechanically to data that detailed Criminal Legal News (1 Jul 2026). In Chatrie (June 2026) it held that obtaining Google location history was a search, even though a company held it SCOTUSblog (29 Jun 2026). Critics say an ad ID is easy to tie to a person: a phone that sleeps at one address each night points to its owner EFF (Aug 2022). If a warrant is needed to compel the data, they ask, how can paying for it remove the need Cato Institute?
What no court has said. None has squarely decided whether a purchase is a search. Nor whether evidence from a purchase must be thrown out Criminal Legal News (1 Jul 2026). The government’s own intelligence review, declassified in 2023, warned of “profound changes in the scope and sensitivity” of this data Nextgov, on the declassified ODNI report (Jun 2023).
What has Congress done?
- Fourth Amendment Is Not For Sale Act. It would bar agencies from buying data they would otherwise need legal process to get. It passed the House on 17 April 2024 EPIC (17 Apr 2024). The Senate never voted on it Criminal Legal News (1 Jul 2026).
- A warrant amendment to Section 702 failed on a 212–212 tie in April 2024 Criminal Legal News (1 Jul 2026).
- Government Surveillance Reform Act. Senators Wyden and Lee and Representatives Davidson and Lofgren introduced it in March 2026. It would close the loophole as part of Section 702 reform Sen. Wyden’s office. It has not passed.
- Section 702 itself lapsed in June 2026, after the House rejected a short extension 198–218 Security Boulevard (Sep 2026) EFF (Jun 2026). Court-approved certifications are understood to allow collection until about March 2027 Criminal Legal News (1 Jul 2026). Purchases were never part of 702, so the lapse does not stop them.
Have any states closed it?
Montana did in May 2025, the first state to do so Reason (16 May 2025). Its law bars state and local agencies from buying electronic communications, precise location and other sensitive data without a court-issued warrant or investigative subpoena Mont. Code Ann. § 46-5-603. Exceptions cover consent, emergencies involving danger of death or serious injury, and people in custody Reason (16 May 2025). It does not bind federal agencies Criminal Legal News (1 Jul 2026).
What can I do about it?
- Delete or disable your advertising ID. It is the key most brokers use; see our advertising ID guide.
- Give location only to apps that need it, and only while you use them. Weather and game apps rarely need precise location.
- Opt out of data brokers. See Optery vs DeleteMe, or California’s free DROP service.
- Ask your representatives where they stand on the Fourth Amendment Is Not For Sale Act, or a state version like Montana’s.
For how police get data with legal process instead, read our guide to police data request portals. For immigration enforcement tools, see the ICE surveillance tracker. This page explains the law; it is not legal advice.
Frequently asked questions
Can police buy my location data without a warrant?
In most of the US, yes, in practice. Agencies including ICE, CBP and the FBI have bought access to broker data. No court has squarely ruled whether that is legal, and only Montana bans it for its state and local agencies.
What is the data broker loophole?
US privacy law bars phone companies and online services from voluntarily handing customer records to the government, but not from selling them to others. Brokers buy that data and resell it to agencies, which then skip the warrant.
Does the Chatrie ruling stop data purchases?
Not directly. In June 2026 the Supreme Court held that obtaining location history through a geofence warrant is a search. It did not decide whether buying similar data from a broker is one.
What is the Fourth Amendment Is Not For Sale Act?
A bill that would stop federal agencies buying data they would otherwise need a warrant or court order to get. It passed the House in April 2024, but the Senate never voted on it.
Which state bans police from buying data?
Montana, since May 2025. State and local agencies there need a warrant or investigative subpoena to buy communications, precise location or other sensitive data. Consent and emergencies are exceptions.
How do I stop my data being sold to police?
Delete or disable your phone's advertising ID, limit location access to apps that need it, and opt out of data brokers. None of this is complete protection, but it cuts the data that ends up for sale.