The Fourth Amendment protects Americans from unreasonable government searches. It requires law enforcement to demonstrate probable cause and obtain a warrant before seizing your papers, records, or communications.
It does not require a warrant to buy that same information from a data broker.
This is the data broker loophole — a legal gap that has allowed government agencies to purchase vast troves of commercial data about Americans without judicial oversight. The FBI, ICE, the IRS, and dozens of other agencies have used it for years. Until recently, the scale of surveillance this enabled, while concerning, was at least limited by the capacity of human analysts to process and make sense of the data.
AI just removed that limit.
How the Loophole Works
The data broker industry collects personal information from an enormous range of sources: mobile apps that sell location data, loyalty programs that track purchases, data aggregators that compile public records, websites that install tracking pixels. Companies like Acxiom, LexisNexis, and hundreds of smaller brokers package this information and sell it.
The Fourth Amendment governs what the government can compel — not what it can purchase. Courts have applied the third-party doctrine, established in Smith v. Maryland (1979), to hold that information you share with third parties — including by using apps, websites, and payment systems — carries a reduced expectation of privacy. When the government buys that information commercially rather than demanding it from the third party, courts have generally found no constitutional violation.
The result: an agency that would need a warrant to subpoena your location history from your carrier can simply purchase that same location history from a data broker — no warrant, no judicial oversight, no probable cause required.
The Two Loopholes Working Together
EPIC describes two reinforcing vulnerabilities:
The data broker loophole: Commercially purchased data, including location history, purchasing behavior, device identifiers, financial transactions, and social graph data, is available to government agencies without a warrant.
The backdoor search loophole: Section 702 of the Foreign Intelligence Surveillance Act allows the government to collect communications of foreigners abroad — but it “incidentally” captures enormous amounts of Americans’ communications in the process. Agents can then query that database using Americans’ names and identifiers without a warrant. This is the “backdoor search” — using foreign intelligence collection infrastructure to conduct domestic surveillance.
Together, these two loopholes allow government agencies to build comprehensive profiles of American citizens using data acquired through legal purchases and incidental foreign intelligence collection, with minimal judicial oversight.
What AI Changes
The data broker loophole has existed for years. What has changed is the scale at which it can be exploited.
A human analyst reviewing purchased location data can meaningfully examine a handful of subjects. An AI system processing the same data can identify patterns across millions of people simultaneously — flagging everyone who visited a specific location during a specific window, correlating location patterns with financial transactions, linking device identifiers to individuals, and building behavioral profiles without a human reviewing individual cases.
This is not speculative. The government’s interest in applying AI to surveillance data is documented and active.
NPR reported in March 2026 that ICE has been purchasing commercial data from brokers and that the government’s appetite for this data is growing as AI analysis capabilities expand. Separately, talks between Anthropic and the Department of Defense regarding the use of Anthropic’s AI systems collapsed after Anthropic insisted on safeguards to prevent the use of its AI for mass surveillance of Americans — a negotiation that would not have happened if the government were not actively seeking AI tools for exactly that purpose.
More than 130 civil society organizations signed a joint letter urging Congress to include closing the data broker loophole in FISA Section 702 reauthorization, citing the potential for the loophole to be used “to supercharge AI-powered surveillance.”
Section 702 was set to expire April 20, 2026, creating legislative urgency. Whether Congress acted — and how — is the central question in this space right now.
Who’s Buying Your Data and What They’re Doing With It
The government’s use of commercial data is not limited to national security agencies. A partial list of documented purchasers:
ICE: Uses commercial location data and data broker records to locate and track undocumented immigrants. The ACLU and EFF have documented this practice extensively. ICE’s data purchases have expanded significantly in recent years.
IRS Criminal Investigation: Has purchased access to Venntel’s location data, a mobile advertising data broker, for use in criminal investigations.
Secret Service: Purchased location data from Babel Street and Venntel for investigative purposes.
CBP (Customs and Border Protection): Has purchased access to mobile location data from multiple brokers for border security operations.
FBI: Purchased commercial data from various brokers, with limited oversight of how it’s used in investigations.
None of these purchases required a warrant. All are legal under current interpretation of the Fourth Amendment.
The Connection to FISA Section 702
Section 702 is a foreign intelligence surveillance authority that allows the NSA to collect communications of non-U.S. persons located abroad. The statute explicitly prohibits targeting Americans. The problem is “incidental” collection: when the NSA collects a foreign target’s communications, it also collects communications of anyone that target communicated with — including Americans.
The resulting database of “incidentally” collected Americans’ communications is large. Agencies can query it using Americans’ names and identifiers — the “backdoor search” — without obtaining a warrant. The FBI has made hundreds of thousands of such queries.
Civil liberties organizations have fought to require a warrant for these backdoor searches for years. The data broker loophole compounds this: agencies can combine incidentally collected FISA data with commercially purchased data to build profiles that neither collection alone could produce.
A bipartisan coalition in Congress — including Senators Wyden and Lee, and Representatives Davidson and Lofgren — has introduced the Government Surveillance Reform Act, which would require warrants for backdoor searches and restrict government purchases of commercial data. EPIC has endorsed this bill. The EFF has endorsed it. Whether it passes depends on how FISA reauthorization plays out.
The Anthropic Episode
One of the most revealing data points in this debate is what happened between Anthropic and the Department of Defense.
According to reporting, negotiations broke down because Anthropic — which builds and sells AI models — refused to agree to terms that would allow the DoD to use its AI for mass surveillance of Americans. The specifics of what the government wanted are not fully public. What is clear is that the DoD’s ask was specific and substantial enough that Anthropic walked away from a defense contract rather than agree to it.
This is significant for two reasons:
First, it confirms that government agencies are actively seeking AI tools for mass surveillance applications — not as a hypothetical future interest, but as a present operational requirement they’re willing to negotiate AI vendor contracts around.
Second, it shows that at least one major AI company drew a line. Whether others are drawing similar lines — or whether other agreements have already been reached without the same scrutiny — is unknown.
Reform Efforts: What Would Actually Fix This
The legal landscape is moving, slowly.
Legislative Approaches
The Government Surveillance Reform Act (Wyden-Lee-Davidson-Lofgren) would require a warrant for government data broker purchases above a threshold volume, require a warrant for Section 702 backdoor searches targeting Americans, and create stronger oversight mechanisms for the intelligence community’s use of commercial data.
The Surveillance Accountability Act (Massie-Boebert, HR 8470) takes a similar approach, requiring warrants before the government can purchase Americans’ data from brokers.
The Fourth Amendment Is Not For Sale Act has been introduced in multiple Congresses; it would prohibit government agencies from purchasing data they would otherwise need a warrant to obtain directly.
Judicial Approaches
The Carpenter v. United States (2018) Supreme Court decision held that prolonged cell-site location tracking requires a warrant — establishing that the digital age requires revisiting the third-party doctrine. Litigation is underway seeking to extend Carpenter’s logic to data broker purchases. No appellate court has yet definitively ruled that government data broker purchases require warrants, but cases are working through the system.
Industry Approaches
Some data brokers have voluntarily restricted government sales. But voluntary restrictions without legal backing can be reversed at any time, and the incentives strongly favor continued sales.
Why This Is Connected to Everything Else
The data broker surveillance loophole doesn’t operate in isolation. It intersects with:
- AI-powered predictive policing — the surveillance infrastructure Axon, Flock Safety, and Motorola are building draws on commercially purchased data as an input
- Data broker practices — the same companies selling location data to advertisers are selling to government agencies; we covered how your cannabis dispensary was likely feeding your data into this pipeline, and how the Kochava FTC case showed the FTC’s approach to location data
- Social media surveillance — government requests for social media data have surged 770%; the data broker loophole allows agencies to purchase social data that social platforms won’t hand over voluntarily
- Consumer privacy rights — the 20 state privacy laws now in effect give individuals rights against commercial companies; none of those rights apply when the government is the buyer
The Fourth Amendment was designed to protect Americans from government overreach. The data broker loophole is a legally sanctioned mechanism that systematically defeats that protection. AI has made it more powerful by orders of magnitude.
Closing this loophole requires Congress to act — either through standalone legislation or as part of FISA reauthorization. The coalition pushing for reform is bipartisan and unusually broad: libertarians, civil liberties organizations, privacy advocates, and some conservatives who are newly concerned about government surveillance power.
Whether that coalition can overcome the intelligence community’s institutional resistance to oversight constraints — and the data broker industry’s financial interest in continued government sales — is the defining privacy fight of this legislative session.
For more on your rights against commercial data collection under current state laws — and how those rights compare to what the government can do — visit privacyrights.compliancehub.wiki.
