The Shopping Cart

The USA FREEDOM Act, signed June 2, 2015, ended the NSA's bulk collection of Americans' telephone metadata under Section 215 of the Patriot Act — the program disclosed by Edward Snowden. It did not restrict the commercial data-broker market. In the years since, federal agencies have obtained functionally equivalent information — phone location histories, device identifiers, internet-activity records — not by collecting it under legal process, but by purchasing it from brokers, generally without warrants. The mechanism changed from 'collect' to 'buy'; the data did not. This is the through-line the rest of this record documents agency by agency.

“The Government no longer collects telephony metadata in bulk. — the change the USA FREEDOM Act was written to make, 2015”

• USA FREEDOM Act (Pub. L. 114-23, June 2, 2015) — ended NSA bulk telephone-metadata collection under Section 215
• ODNI Senior Advisory Group, declassified report on Commercially Available Information (Jan. 2022, released June 2023) — the IC increasingly buys CAI, including location data, in lieu of collection

This is the entry that anchors everything after it, because the source is the intelligence community's own internal review — not an advocacy group. In 2021 DNI Avril Haines convened a Senior Advisory Group panel to study the IC's use of commercially available information (CAI). Its report — classified January 2022, declassified and released in June 2023 — found that the IC acquires a large and growing volume of CAI, that this includes sensitive information such as location data capable of revealing intimate details of a person's life, and that agencies frequently do not know how much CAI they hold, of what type, or what they are doing with it. The panel warned this data can be used to identify and track Americans in ways that would have required legal process if the government had gathered it directly. The government's own experts flagged the purchase channel as a civil-liberties problem.

“In the wrong hands, [CAI] could be used to cause harm to an individual... it can be misused to pry into private lives. — ODNI declassified CAI report, 2022”

• ODNI Senior Advisory Group Panel, declassified report on Commercially Available Information — IC buys growing volumes of CAI incl. location data; often cannot account for what it holds or how it is used
• DNI Haines statement on the declassified CAI report (June 2023) — ODNI's own framing of the review and its release

Two primary documents put specific agencies on the record. First, the Defense Intelligence Agency: in a memo to Sen. Ron Wyden dated January 15, 2021, DIA confirmed it buys commercially available smartphone-location data, funds another agency to purchase it, filters U.S. device locations into a separate database, and permits analysts to query Americans' movements in it — stating expressly that it 'does not construe the Carpenter decision to require a judicial warrant' for buying and using commercial data. Second, the domestic-security side: the DHS Office of Inspector General, in report OIG-23-61 (September 2023), found that Customs and Border Protection, Immigration and Customs Enforcement, and the Secret Service purchased and used Commercial Telemetry Data — phone location data — without adhering to DHS privacy policies or completing the Privacy Impact Assessments the E-Government Act requires. The report notes one CBP employee used the data to track coworkers with no investigative purpose. These are not press accounts; they are a signed intelligence-agency memo and a federal watchdog report.

“[DIA] does not construe the Carpenter decision to require a judicial warrant endorsing purchase or use of commercially-available data for intelligence purposes. — DIA memo to Sen. Wyden, Jan. 15, 2021”

• DIA memo to Sen. Ron Wyden (Jan. 15, 2021) — confirms purchase and warrantless querying of U.S. smartphone-location data; disputes that Carpenter requires a warrant
• DHS OIG, Report OIG-23-61 (Sept. 2023) — CBP, ICE and Secret Service bought/used commercial telemetry (location) data without required privacy safeguards or PIAs
• Sen. Wyden's oversight letters to the DHS OIG on ICE/CBP location-data purchases — the request that produced OIG-23-61

At a Senate Intelligence Committee hearing on March 18, 2026, Sen. Ron Wyden asked FBI Director Kash Patel whether the bureau would commit to not buying Americans' location data. Patel did not agree. He confirmed the practice, testifying that the FBI purchases commercially available information it considers lawful and that it has produced valuable intelligence — and framed the purchases as one of the tools the bureau uses for its mission. The exchange was widely reported the same day. It is a notable shift from 2023, when then-Director Christopher Wray told Congress the FBI had used commercial location data in the past but was not then doing so. The significance is not merely that the FBI buys the data; it is that the bureau's director defended the practice under oath and declined a direct request to end it.

“We do purchase commercially available information that is consistent with the Constitution and the laws under the Electronic Communications Privacy Act — and it has led to some valuable intelligence for us. — FBI Director Kash Patel, Senate Intelligence Committee, Mar. 18, 2026”

• Senate Select Committee on Intelligence — 'Open Hearing: Worldwide Threats' (Mar. 18, 2026, 10:00am, Hart 216) — the committee's official hearing record; witness list includes FBI Director Kash P. Patel (primary source)
• 'FBI director admits agency is buying location data on Americans' (The Guardian, Mar. 18, 2026) — contemporaneous account of Patel's sworn admission at the Worldwide Threats hearing
• 'FBI is buying location data to track US citizens, director confirms' (TechCrunch, Mar. 18, 2026) — Patel confirms purchases and declines Wyden's request to stop, at the Senate Intelligence Committee hearing
• 'Privacy advocates sound alarm on the data broker loophole used by FBI, other federal agencies' (FedScoop) — contemporaneous account of the same hearing and the warrantless-purchase workaround

Here is the claim we deliberately will not overstate. In Carpenter v. United States (2018), the Supreme Court held that the government generally needs a warrant to obtain historical cell-site location information from a wireless carrier, because a person keeps a reasonable expectation of privacy in the record of their movements even when a third party holds it. The strong argument — made by Sen. Wyden, the ACLU, EPIC and others — is that letting agencies simply buy the same location data from a broker sidesteps that ruling and reconstitutes warrantless tracking by other means. That argument is serious and, in our judgment, likely correct in spirit. But it is legal analysis, not settled law: Carpenter addressed compelled production from carriers, not voluntary commercial sales, and courts have not squarely and finally resolved whether purchasing broker location data is itself a Fourth Amendment search. Agencies like the DIA argue expressly that it is not. Until the Supreme Court says otherwise, 'buying it bypasses the Fourth Amendment' is a well-founded position — not a decided one — and we grade it accordingly.

“An individual maintains a legitimate expectation of privacy in the record of his physical movements. — Carpenter v. United States, 585 U.S. ___ (2018)”

• Carpenter v. United States, 585 U.S. ___ (2018) — warrant generally required for historical cell-site location information; third-party holding does not defeat the privacy interest (Supreme Court opinion PDF)
• The purchase-vs-collection distinction is unresolved: Carpenter concerned compelled production from carriers, not commercial sales, and agencies (e.g., DIA) argue it does not reach data purchases — hence PROBABLY TRUE, not FACT

Congress ended bulk telephone-metadata collection in 2015 because a democracy is not supposed to keep a running file on the movements and associations of people it does not suspect of anything. If an agency can obtain the same picture — where you sleep, worship, protest, seek medical care — by routing a purchase order through a data broker instead of a court, a reasonable person is entitled to ask whether the ban meant anything at all, or whether it simply moved the collection off the government's books and onto an invoice. We think the question is legitimate, and the ODNI's own panel came close to asking it. We also think the honest answer, on the public record alone, is that the purchases are proven while the constitutional verdict is not yet in — and we decline to convert unease into a finding the courts have not made. The pattern of surveillance capabilities outliving the reforms meant to end them is a thread we follow in the Surveillance States hub, where this question properly lives.

• ODNI declassified CAI report — the intelligence community's own account of how much it buys and how little it tracks