FBI Director Kash Patel recently confirmed that the bureau purchases commercially available location data for its investigations. The admission puts a spotlight on a growing tension in U.S. privacy law: government agencies reaching sensitive personal information not through a court-approved warrant, but through private-sector data brokers.
This practice highlights an uncomfortable reality: as courts tighten the rules on direct government surveillance, the unregulated commercial market offers an alternative route to the same intelligence. By purchasing rather than demanding this data, agencies can quietly reconstruct a citizen’s physical movements, raising fundamental questions about where digital privacy actually stands.
What Did the FBI Admit About Buying Location Data?
The confirmation centers on the FBI’s procurement of “commercially available location data.” That term refers to geolocation information collected not from telecom carriers, but from a sprawling ecosystem of mobile apps, advertising technology, and data analytics firms. These companies gather location signals, often with user permission buried in the app’s terms of service, and then sell aggregated datasets on the open market.
What the admission makes clear is that the agency can obtain detailed movement histories without compelling a company like Google or AT&T to hand over records. Instead, it can buy access from brokers who package and resell the information. Such datasets can reveal patterns of life, including visits to sensitive locations, personal associations, and daily routines, making them a powerful tool for law enforcement.
And this isn’t limited to one agency. The ATF recently canceled a similar contract with data broker Penlink after significant congressional scrutiny. That reversal, driven by bipartisan pressure, shows federal demand for such data is widespread and has become a politically charged issue.
Why Is Buying Location Data So Controversial?
The core controversy centers on whether buying commercially available data sidesteps the Fourth Amendment’s protection against unreasonable searches. Critics argue this commercial pipeline creates a loophole, allowing the government to purchase highly sensitive information it would otherwise need a court-approved warrant to obtain.
The legal landscape surrounding this issue is shifting rapidly. In June 2026, the Supreme Court ruled 6–3 in Chatrie v. United States, declaring that obtaining location data via “geofence” searches—which sweep up location data for every device in a specified area—constitutes a search under the Fourth Amendment. This landmark ruling firmly establishes that Americans have an expectation of privacy in their collective physical movements in the cloud, meaning law enforcement must obtain a constitutionally valid warrant to perform these reverse-location sweeps.
Yet, because the commercial data broker market operates outside traditional court-ordered pathways, it creates what some lawmakers call a “back door” for warrantless surveillance.
Regulators are paying closer attention, too. The Federal Trade Commission recently settled a case against data broker Kochava, alleging the company sold sensitive location data without adequate consumer consent. The action signals that federal regulators see the sale of precise geolocation information as a high-risk practice that demands explicit, informed consent from users.
| Access Method | Source of Data | Typical Legal Barrier | Privacy Concern |
| Carrier records | Mobile network provider | Usually a warrant or court order | Historical movement can be retroactively reconstructed |
| Geofence request | Platform provider (e.g., Google) | Strict judicial scrutiny; warrant required under Chatrie | Broad dragnets sweep in innocent bystanders |
| Commercial broker purchase | App/ad-tech/data broker ecosystem | Low or non-existent legal barriers | Replicates warrantless bulk surveillance without traditional safeguards |
How Is This Data Collected in the First Place?
The commercial location data market starts with ordinary smartphone use. The pipeline usually begins with mobile apps requesting location permissions for legitimate features, like weather updates or turn-by-turn directions. Once you grant permission, embedded software development kits (SDKs) from advertising or analytics companies quietly collect location signals in the background.
That data is then aggregated, often merged with other user information, and sold by brokers to a range of clients: advertisers, market researchers, and, as now confirmed, government agencies. Data is sometimes described as “anonymized,” but security researchers have repeatedly shown that movement patterns can re-identify persons with a high degree of accuracy. States are starting to respond, as seen in Virginia’s new law restricting the sale of precise geolocation data, though the national market remains largely open.
This systematic collection exposes users to quiet, continuous privacy risks. Because location profiles are compiled invisibly in the background, ordinary consumer habits directly feed a highly lucrative commercial pipeline.
A handful of everyday device behaviors are the primary drivers of this commercial data harvesting:
- Mobile apps configured with “always-on” or unnecessary location permissions
- Advertising SDKs embedded in popular free applications
- Background data sharing enabled through built-in analytics and attribution tools
- Active, unrestrained mobile ad-tracking and personalized advertising identifiers
What Can You Do to Reduce Location Exposure?
Complete digital invisibility isn’t realistic, but you can take practical steps to cut your location data exposure. The starting point is to audit and manage app permissions. Review which apps have access to location services, then switch them off for any app that doesn’t genuinely need it to work.
Other useful moves include disabling precise location where possible, deleting unused apps, limiting ad tracking in device settings, and turning off background app refresh for non-essential services. Privacy-focused browsers, up-to-date operating systems, and caution on public Wi-Fi all shrink your digital footprint further. Still, no single tool can eliminate tracking if the underlying app permissions remain wide open.
Understanding the Limits of Network-Level Defenses
When users look to shield their devices from background tracking, virtual private networks are often the first line of defense. However, it is vital to understand what is VPN technology actually capable of blocking. Standard VPNs secure your data in transit and mask your IP address, but they cannot stop on-device GPS tracking or disable the tracking SDKs embedded in apps you have already granted location permissions to.
To address this gap, some modern privacy suites have begun bundling on-device filtering alongside traditional network encryption. For example, IPVanish includes a “Threat Protection Pro” layer in its service, which actively blocks known advertising trackers, analytics signals, and malicious domains directly on the device. While this doesn’t replace the need to manually audit your app permissions, combining network-level masking with active tracker blocking is a practical step toward disrupting the data pipeline that feeds commercial brokers.
Why This Matters for Consumers and Policymakers
The FBI’s admission is a landmark moment because it formalizes the split between “surveillance by court order” and “surveillance by purchase.” It confirms that the commercial data pipeline has opened a new, lightly regulated avenue for government data acquisition. So policymakers now face renewed pressure to modernize privacy laws, rein in the data broker industry, and clarify warrant standards for commercially sourced information.
For you, the takeaway is practical: digital privacy isn’t a passive state; it requires active management. Many of our greatest digital vulnerabilities stem not from sophisticated surveillance operations, but from routine app permissions and weak privacy hygiene. With the FBI’s Internet Crime Complaint Center documenting over $16 billion in annual cybercrime losses, treating privacy, data security, and digital spending discipline as interconnected priorities is simply smart practice.
Frequently Asked Questions
Can the government buy location data without a warrant?
In some circumstances, federal agencies have purchased commercially available datasets from private data brokers. The practice is controversial and under intense scrutiny precisely because it falls within a legal gray area that may not be subject to the same warrant requirements as direct requests to technology or telecom companies.
Does turning off location services fully stop tracking?
No. Turning off GPS and location services is a critical step, but it doesn’t prevent all forms of tracking. Devices can still reveal an approximate location through their IP address, Wi-Fi connections, and cellular tower signals. Some apps also collect additional telemetry that can be used to infer your location.
Can a VPN stop location tracking?
A VPN can improve privacy and security by masking a device’s IP address and encrypting network traffic, which reduces certain network-based tracking. It won’t override device-level GPS settings or location permissions you’ve granted to apps, though. Think of it as one layer in a broader privacy strategy, not a complete fix for all location tracking.
