How the government gets your data: the warrant and the back door

You have probably heard that the police cannot just take your data. They need a warrant. That is true, and it is a real protection. A warrant is a judge’s permission for police to search or collect something, based on evidence.

It is also only half the story. This article explains how the government gets your data through two doors. One has a lock and a judge. The other is a shop counter. By the end you will know which door deserves your worry, and what you can do about it this week.

What actually happened?

Start with the front door. In 2018, the Supreme Court decided Carpenter v. United States. It held that when the government got a person’s historical cell-site location records, that was a Fourth Amendment search ^[4]. In plain words, tracking where your phone has been is the kind of thing that needs a warrant. That was a big win for ordinary people.

The ruling was also narrow. The Court said it did not address other business records that might reveal location by the way ^[4]. So the decision protected one kind of record. It did not settle the rest.

Now the back door. The Court noted in the same case that wireless carriers often sell aggregated location records to data brokers ^[4]. A data broker is a company that collects and sells information about people, often without them knowing. The Court said those records lacked individual identifying information of the sort at issue in that case ^[4]. That detail matters, and we will come back to it.

Here is what agencies have done since:

In 2021, Senator Ron Wyden revealed that the Defense Intelligence Agency was buying and using location data collected from Americans’ phones ^[1].
In January 2024, Wyden released documents confirming that the National Security Agency buys Americans’ internet records. These can show which websites people visit and which apps they use ^[1].
A Department of Homeland Security inspector general found that Customs and Border Protection, Immigration and Customs Enforcement and the Secret Service did not follow department privacy policies before buying and using commercial location data ^[2]. The inspector general recommended that ICE stop using that data until its privacy reviews were finished and approved ^[2].
In March 2026, FBI Director Kash Patel told the Senate Intelligence Committee that the FBI does buy commercially available information. He said it was consistent with the Constitution and the laws under the Electronic Communications Privacy Act ^[3].
In 2023, then-director Christopher Wray had told Wyden that the FBI was no longer buying location data, but that it had at some point ^[3].

One more piece is less famous. In Georgia, cities may not run license plate readers on state rights of way unless they sign an agreement to send their data to a federal drug trafficking program known as HIDTA ^[6]. A Drug Enforcement Administration privacy review warned that its national plate reader program risks collecting data on every plate that passes each camera ^[6]. That is not a purchase. It is a pipeline, and it gets data to the government without a warrant too.

The verdict: the back door is the bad part

Mixed on the front door, bad on the back door.

The warrant is a good system. A judge has to look at evidence before an agency can search you. Carpenter pushed that protection into the age of phones ^[4]. Nothing here argues for dropping it.

The back door is bad for privacy. If an agency can pay for what it would otherwise need a warrant to get, the warrant stops mattering. The judge is never asked. The record of who looked at what is thinner. This is our view, and it follows from our position on surveillance: it should be minimal, and it should have checks. Buying around the checks is not minimal, and it has no checks.

Is this a movie-plot threat? No, and that is what makes it worth a paragraph. Nobody has to imagine a secret program. FBI leadership said in public that the agency buys this kind of data ^[3]. A federal watchdog documented the purchases at DHS ^[2]. Senators released NSA documents ^[1]. This is possible and it is also confirmed.

What we cannot tell you from the record is how much any one person’s data is in these purchases. The sources do not say. Agencies say they follow the law ^[3], and the Supreme Court’s own wording suggests some of the data sold is aggregated and lacks individual identifying information ^[4]. Some of what agencies buy is not stripped that way, though. Wyden’s documents describe internet records that can show which websites people visit and which apps they use ^[1]. Treat “anonymous” on a data label as a claim, not a fact.

Why it matters

Picture Sarah. She drives to a clinic on Tuesdays and checks a weather app on the way. Under the front door, police who wanted her phone’s location history would need a warrant ^[4]. Under the back door, the question is whether some company already collected that location data and is willing to sell it. The sources show agencies buying such data ^[1]^[2]^[3]. They do not show what any one app or company sold.

Now picture Jake. He reads news about a controversial topic every night. His browsing is the sort of record the NSA documents say the agency buys, because internet records can show which websites people visit ^[1]. Jake did nothing wrong. The point is that he never agreed to any of it, and no judge was involved.

That is the part most coverage misses. The story is usually told as “can the police search my phone?” The more common route is that the data already sits in a company’s files, and a purchase order replaces the warrant.

There is also a consent problem. A January 2024 Federal Trade Commission order held that data brokers must get Americans’ informed consent before selling their data ^[1]. That is a step toward fairness. But an order about one set of facts is not a ban on the practice, and the sources do not show it stopped agency purchases.

What could fix it?

Congress has tried. H.R. 4639, the Fourth Amendment Is Not For Sale Act, passed the House in the 118th Congress ^[5]. It would bar law enforcement and intelligence agencies from buying covered customer or subscriber records from third parties such as data brokers ^[5]. It defines getting records “in exchange for anything of value” to include buying them outright ^[5]. Records bought in violation of the ban, and evidence derived from them, could not be used in a trial, hearing or other proceeding ^[5].

It had a gap. The records it protects exclude data generated by license plate reader systems ^[5]. Given the plate pipeline above ^[6], that is a big hole.

In March 2026, Wyden and three Senate colleagues introduced a bill that would close what they call the data broker loophole. It would require federal agencies to get a warrant to buy records from brokers ^[3]. We support that. It is the simplest fix: if an agency would need a judge to take the data, it should need a judge to buy it.

What you should do

You cannot fix Congress this week. You can make your own data less available to sell. These steps are in order of effort, from smallest to largest.

Check the location settings on your phone. Open the list of apps that can see where you are. Set most of them to “never” or “only while using.” A weather app does not need to know where you are all day.
Turn off the advertising ID. Both major phone systems have a setting that limits ad tracking. It will not stop everything. It does cut one of the easiest ways data gets collected.
Delete apps you do not use. Each one is a possible source of data that ends up for sale.
Use a VPN when it fits. A VPN is a service that sends your internet traffic through an encrypted tunnel to another computer, so your network sees the tunnel and not the sites you visit. It can keep your internet provider from seeing which sites you visit. It does not stop an app on your phone from reporting your location, and it does not make you anonymous.
Ask data brokers to delete you. Many brokers have an opt-out form. It takes time, and your data can come back. Do it if your situation calls for it, and skip it if you have a lot on your plate.

What can you skip? You do not need to throw out your phone, and you do not need to stop using maps. Most people are not individual targets. The worry here is about bulk collection, and the fix is mostly less data leaving your phone in the first place.

If you face a real, specific threat, such as a stalker, a legal fight, or work that puts you at risk, this article is not enough. A privacy specialist or lawyer can look at your actual situation. A blog post cannot.

Common mix-ups

“A warrant protects all my data.” It protects what the law says it protects. Carpenter covered historical cell-site location records, and the Court said it did not decide about other business records ^[4].

“If the data is anonymous, it is harmless.” The Supreme Court described the aggregated records carriers sell as lacking individual identifying information ^[4]. But NSA internet records can show which sites and apps people use ^[1]. Do not assume a label settles it.

“This is all illegal, so it will stop.” The FBI director said in public that the agency buys such data and called it consistent with the law ^[3]. Whether it should be legal is the fight in Congress ^[3]^[5].

“The FTC fixed this.” The January 2024 order says brokers must get informed consent before selling ^[1]. That is about brokers. It is not an agency purchasing ban.

Go close one door

Your first step takes five minutes: open your phone’s location settings and cut the apps that do not need you.

The front door has a lock and a judge. Most of us should worry about the door with no lock at all, and push for the bills that would put one on it.