FBI Purchases of Commercial Location Data on U.S. Citizens Revealed

The Privacy and Civil Liberties Oversight Board released a report Thursday revealing a carefully drawn distinction in how the FBI purchases location data: the bureau does not buy real-time tracking information from commercial data brokers, but it does purchase historical location records. The finding, based on an investigation launched in 2017, highlights a technical and legal line that federal law enforcement has walked as smartphone location data has become a commodity traded by private companies.

The report confirms that the FBI uses services like Babel Street, a data broker that sells access to historical location information derived from smartphones. These companies aggregate location data from hundreds of mobile applications, many of which embed advertising software development kits that continuously collect and transmit device coordinates. The data then flows through a complex ecosystem of advertising exchanges and data brokers before being repackaged and sold to government agencies, private investigators, and other buyers. While individual app users may consent to location tracking buried in lengthy terms of service agreements, they rarely understand that their movements can later be purchased by law enforcement.

This distinction between historical and real-time data carries legal weight. Real-time tracking more closely resembles active surveillance, the kind traditionally requiring judicial oversight. Historical data purchases, by contrast, involve records that already exist, framing them as business transactions rather than surveillance operations. The Supreme Court's 2018 decision in Carpenter v. United States held that accessing historical cell site location information from wireless carriers requires a warrant, recognizing that detailed location history implicates Fourth Amendment protections. However, law enforcement agencies have argued that purchasing similar data from commercial brokers operates in a different legal space, since the data is already collected for commercial purposes and available on the open market.

The practice has drawn scrutiny from civil liberties advocates and some members of Congress who argue that buying data circumvents the warrant requirement established in Carpenter. The Defense Intelligence Agency, Immigration and Customs Enforcement, and Customs and Border Protection have all acknowledged purchasing commercial location data. Internal government memos obtained through Freedom of Information Act requests have shown agencies debating whether Supreme Court precedent applies to data broker purchases. Some legal scholars argue that the third-party doctrine, which holds that information voluntarily shared with companies loses some privacy protections, should not apply when data collection is effectively invisible to users and when the data reveals intimate details about daily life.

The PCLOB report does not address whether the FBI should purchase any location data, only whether it buys real-time access. This narrow framing leaves significant questions unanswered about the volume of historical data purchased, how long location records are retained, and what legal standards govern their use in investigations beyond counterterrorism. The report's focus on counterterrorism investigations also leaves unclear whether similar practices extend to criminal investigations, where different legal authorities and oversight mechanisms apply.

Data brokers like Babel Street and Venntel market their services by emphasizing that their data comes from commercial sources rather than telecommunications providers, positioning their products as distinct from the carrier records at issue in Carpenter. These companies obtain location data from a wide array of sources including weather apps, navigation tools, games, and shopping applications. A single smartphone might transmit location data to dozens of different companies throughout the day, creating multiple parallel streams of information that converge in broker databases. This fragmented data collection ecosystem makes it difficult for users to understand or control how their location is tracked, even if they carefully manage app permissions.

The technical capabilities of historical location data should not be understated. While not providing live tracking, historical databases can reveal patterns of life, associations with other individuals, visits to sensitive locations like medical facilities or places of worship, and detailed movement histories spanning months or years. Analysts can query these databases to identify all devices present at a specific location during a particular timeframe, or to track where a specific device traveled over extended periods. The FBI's decision not to purchase real-time access may reflect policy caution rather than technical limitation, as the underlying data infrastructure could support near-real-time queries if contractually permitted.

Congress has periodically considered legislation to restrict law enforcement purchases of data that would require a warrant if obtained directly from service providers. The Fourth Amendment Is Not For Sale Act, introduced in multiple sessions, would prohibit government agencies from purchasing data from brokers that would otherwise require legal process. Such legislation has attracted bipartisan interest but has not advanced to passage, leaving the current legal landscape ambiguous. Different federal agencies have adopted varying internal policies, creating inconsistent standards across the government.

The PCLOB report arrives as courts continue grappling with how Fourth Amendment protections apply to modern technology. Lower courts have reached conflicting conclusions about whether Carpenter extends to commercial data broker purchases, creating a potential circuit split that could eventually reach the Supreme Court. Until then, federal law enforcement operates in a space where purchasing historical location data remains permissible under current policy, even as the practice raises fundamental questions about privacy, surveillance, and the modern meaning of constitutional protections in an era when personal data has become a commercial product bought and sold with minimal transparency or oversight.