This week, FOIA documents revealed that Customs and Border Protection and ICE are dodging the Fourth Amendment by buying our private data from third-party data brokers, instead of bothering with a warrant. Add these agencies to a list that already includes the FBI, Department of Defense, IRS, and DEA. Third party data brokers are all too eager to sell out the Fourth Amendment in search of profit, and neither the Supreme Court nor legislators have so far stepped in to stop law enforcement and intelligence agencies from buying our data. That could change soon: the Judiciary Committee has begun hearings on the Fourth Amendment Is Not For Sale Act, a bill that, as Senator Ron Wyden puts it, “closes [the] legal loophole and ensures that the government can’t use its credit card to end-run the Fourth Amendment.”

Courts have long acknowledged that Fourth Amendment protections extend beyond physical locations into the data space. The Supreme Court, in a case requiring a warrant for cell phone searches, wrote that the “proverbial visitor from Mars might conclude that [cell phones] were an important feature of human anatomy.” As courts have increasingly recognized, much of what we do with phones is no longer optional in modern life. In the Carpenter decision, the Supreme Court decided that a warrant was required to search a week’s worth of phone location data transmitted to cell towers. But even as the Supreme Court expanded Fourth Amendment protections to include digital data, its new test created holes in case law. While Carpenter prevents the state from forcing cell phone companies to turn over their data, the warrant requirement doesn’t apply when the government merely incentivizes disclosure – such as when they run up their credit cards to circumvent the Fourth Amendment. When someone agrees to the terms and conditions on an app, they could be inadvertently agreeing to let the app sell their data to anyone – including data brokers that market to law enforcement. 

The courts have so far considered this data sharing voluntary – because, technically, you could read through all the terms and conditions and chose to avoid apps that share personal data with third-party brokers. But it takes longer to read the Spotify Terms and Conditions than it takes to read the Bill of Rights, so this protection is more theoretical than reality-based. In a hearing yesterday, Liza Goitein from the Brennan Center summarized this supposed protection as: “You’re effectively saying you’re not going to use apps.” We might technically turn our data over voluntarily, but in practical terms we’re coerced into sharing our data by the demands of the modern era. 

In the lacuna surrounding supposedly voluntary data, bias can replace probable cause as the basis for investigation. Without the requirement for a warrant, instead of starting with a crime, law enforcement agencies are searching for one. This type of dragnet surveillance opens the door to targeting on the basis of race, religion, or ideology. In 2020, news broke that the Department of Defense was buying data from apps targeting Muslims, including Muslim-specific dating apps and prayer apps. Previously, data obtained through the third-party data broker loophole was used to surveil Black Lives Matter protesters. And Republicans in Congress have raised the concern that the IRS has purchased location data that could be used in selective probes of conservatives, something the IRS has gotten in trouble for in recent years. Without the guard rail of requiring probable cause to get a warrant, speculative investigations can proceed on the basis of constitutionally-protected categories, taking freedom of expression and religion as collateral damage. 

This problem is massive in scale. Purchases from third-party data brokers throw huge swaths of Americans into the crosshairs of the surveillance state. The data broker at the center of the Muslim app-DoD scandal claimed to possess monthly data on 25% of the adult population. In the opening statement of the recent Congressional hearing, Chairman Jerrold Nadler noted that ICE, DEA, and the FBI have used a data broker that draws on over 80,000 apps. 

And even claims that data is anonymized are suspect. Studies have shown that over 99.98% of people can be identified with 15 demographic characteristics. 87% can be identified with only a birthdate, zip code, and gender. Even if the data brokers hand over is anonymized, it can be personally identified without much effort or information – so data buying can rapidly turn into warrantless monitoring of individuals. Neither anonymity nor existing case law are enough to protect us from dragnet surveillance. 

So what can you do? Tell Congress to pass the Fourth Amendment Is Not For Sale Act. Federal agencies shouldn’t be allowed to buy their way around the constitution.