FBI admits purchasing commercially available U.S. location data

The FBI has acknowledged it is purchasing commercially available location data about people in the United States, a practice the bureau’s director, Kash Patel, defended in congressional testimony as lawful and useful for investigations. The admission reignites a long-simmering fight over whether federal agencies can sidestep warrants by buying data harvested from apps and ad-tech firms, rather than obtaining it from phone carriers or tech platforms through the courts.

What the FBI acknowledged about buying commercial location data

Pressed by Senator Ron Wyden, Patel said the FBI purchases “commercially available information” and uses it in a way he described as consistent with the Constitution and the Electronic Communications Privacy Act. He offered no specifics on how frequently the bureau buys such data, which vendors it relies on, or what internal approvals are required—gaps that have privacy advocates warning of a broad, untested surveillance workaround.

Wyden, a longtime surveillance hawk, called the practice an end-run around the Fourth Amendment. His concern is straightforward: if agents can obtain highly precise location trails from data brokers without a warrant, the protections that apply when the same information is sought from a phone company begin to lose meaning.

The legal gray zone after Carpenter and purchased location data

The Supreme Court’s Carpenter decision held that accessing historical cell-site location records from a carrier generally requires a warrant. Agencies argue that purchasing datasets from private markets—often sourced from app software development kits and online ad auctions—is different because the data is “publicly available” for sale. That theory has not been squarely tested in court, leaving a vacuum where policy and practice race ahead of precedent.

The Department of Justice has previously permitted certain uses of commercially available information, but civil liberties groups note that “available for purchase” is not the same as “voluntarily shared” in any meaningful sense. Users rarely understand that a weather app or a mobile game can pass their coordinates through a chain of intermediaries that ends with government buyers.

How Data Brokers Feed Federal Surveillance

Data brokers aggregate location pings from myriad sources: SDKs embedded in apps, telemetry from connected vehicles, Wi‑Fi and Bluetooth beacons, and real-time bidding (RTB) systems that broadcast device identifiers and coordinates to hundreds of ad-tech partners. Investigations by journalists and watchdogs have shown that federal agencies including border authorities and defense intelligence units have previously acquired such feeds.

One public example: documents obtained by investigative reporters revealed that U.S. Customs and Border Protection purchased data originating in RTB pipelines. Separately, the Federal Trade Commission sued the broker Kochava for allegedly selling precise geolocation tied to visits to sensitive places like reproductive health clinics and houses of worship. The Office of the Director of National Intelligence has also warned, in a declassified assessment, that “commercially available information” can be extraordinarily revealing and easy to reidentify.

While brokers often label datasets as “de-identified,” simple cross-referencing—home-at-night, work-by-day patterns—can point to individuals with high confidence. That makes the data functionally personal, even without a name attached, and potentially more precise than the carrier records at issue in Carpenter.

Congress moves to close the data broker loophole

In response to the FBI’s stance, Wyden and a bipartisan group of lawmakers have introduced the Government Surveillance Reform Act. A central feature would require agencies to obtain a court order before acquiring Americans’ data from brokers, putting purchased data on the same constitutional footing as compelled disclosures from telecoms and platforms.

The proposal tracks recommendations from civil society groups like the Electronic Frontier Foundation and the ACLU, which argue that warrant requirements should hinge on the sensitivity of the information, not on the route by which the government obtains it. It would also force greater transparency about which bureaus are buying what data and under what legal theories.

What it means for users and companies in the data economy

For ordinary users, the front line is in the app store and the browser. Location permissions granted to seemingly benign apps can flow into massive commercial datasets with few effective constraints downstream. Even if only a fraction of apps transmit location, scale does the rest: ad-tech markets generate vast streams of coordinates tagged to device IDs across cities, highways, and sensitive locations.

For companies, the spotlight will intensify on SDK providers and exchanges. The industry has begun to limit the sharing of precise location and to add privacy-preserving controls, but enforcement is uneven. The FTC’s recent actions, combined with potential congressional guardrails, signal rising liability for firms that trade in sensitive movement data without robust, provable consent.

Key questions still unanswered about government data purchases

The FBI has not disclosed how it vets brokers, how long it retains purchased data, whether it filters out information about people with no nexus to a crime, or what auditing and minimization rules apply. It is also unclear whether the bureau uses location data to generate investigative leads, to corroborate tips, or both—and how those uses are documented for discovery in court.

Those details matter. Without judicial oversight, bulk location acquisition can chill lawful activities like protests or clinic visits. With clear rules, independent audits, and warrants where required, investigators can still leverage modern datasets while honoring constitutional limits. Until Congress or the courts settle the legal status of brokered data, however, the practice will remain a high-stakes experiment running ahead of the law.