This is the first time since 2023 that the FBI has confirmed it was buying access to people's data collected from data brokers, and the admission exposes a legal tension that sits at the heart of modern surveillance governance. When asked by Senator Ron Wyden whether the FBI would commit to stopping the practice, Director Kash Patel said the agency purchases commercially available information consistent with the Constitution and the Electronic Communications Privacy Act, noting that it has led to valuable intelligence.
The issue cuts to a fundamental question about how constitutional protections adapt to technology. In Carpenter v. United States, the Supreme Court held that police must have a warrant to obtain seven days' worth of historical cell-site location records, finding that individuals have a reasonable expectation of privacy in their cell phone location data because that data reflects the whole of their physical movements. Yet federal agencies have argued the decision applies only to data obtained from phone carriers through legal process, not to information purchased on the commercial market.
Data brokers source much of their information including location data from ordinary consumer phone apps and games. This creates what privacy advocates call a workaround. Multiple government agencies including state and local law enforcement, the FBI, the IRS, the Drug Enforcement Administration, the Department of Defense, and the Department of Homeland Security have been paying data brokers to access vast databases of personal information, including geolocation data, without any warrant, court order, or even subpoena.
There is a legitimate institutional argument in favour of the government's position. Supporters of the practice contend that information lawfully sold by private companies on the open market sits outside the Fourth Amendment's protections because no "search" has occurred. The government is simply making a purchase, not compelling disclosure or invading privacy itself. Senate Intelligence Committee Chairman Tom Cotton echoed this reasoning, emphasising that "the key words are commercially available."
But the counterargument carries equal weight. Commercially available information can reveal persistent location data that reveals political, religious, travel, and associational activity, and such data could be used to identify every person who attended a protest or rally based on smartphone location or ad-tracking records. Last week, Wyden and several other lawmakers introduced a bipartisan, bicameral bill called the Government Surveillance Reform Act, which among other things would require a court-authorised warrant before federal agencies can buy Americans' information from data brokers.
The bill would prevent agencies from buying location, device, and identity data from commercial brokers to sidestep traditional Fourth Amendment protections. The legislation introduces an updated version of the Government Surveillance Reform Act to enact new protections for Americans' rights, including stopping the Federal government from buying data on Americans from shady data brokers, while reauthorising and reforming Section 702 of the Foreign Intelligence Surveillance Act.
The practical stakes are significant. Patel offered no specifics on how frequently the bureau buys such data, which vendors it relies on, or what internal approvals are required, gaps that have privacy advocates warning of a broad, untested surveillance workaround. The core argument is that the government should not be able to buy from a broker what it could not lawfully compel from a carrier or platform without judicial oversight, and this argument has become more forceful as intelligence agencies and law enforcement gain access not merely to raw location points but to increasingly sophisticated analytics that can organise, correlate, and search enormous datasets.
The genuine tension here is real. Patel's defenders argue that limiting data purchases would hamper legitimate law enforcement and national security operations. Privacy advocates counter that without judicial oversight, the practice enables precisely the kind of surveillance the Founders sought to prevent. Congress still has not imposed a clear statutory rule barring agencies from buying sensitive location data about Americans without a warrant, leaving the practice operating in a legal grey zone.
What makes this moment significant is not the discovery of the practice, which civil liberties groups have documented for years, but rather the public confirmation. In 2023, the previous FBI director told senators that the agency had bought access to people's location data in the past but that it was not actively purchasing it. Patel's more candid acknowledgement suggests either a changed calculus about what can be openly discussed or simply a different approach to congressional testimony. Either way, it forces the issue back into legislative view at a moment when Section 702 of the Foreign Intelligence Surveillance Act faces reauthorisation. The question for Congress is whether fiscal accountability, individual liberty, and institutional transparency require that warrant protections travel with the data, regardless of the route by which government acquires it.