Brad Schurtz

MDST 3510
10/28/23
The Role of Data Brokers in Extralegal Government Surveillance
Executive Summary
This policy brief examines the increasingly blurred lines between online tracking conducted by private
companies and the surveillance conducted by the American government of its citizens online and
proposes a ban on the purchasing of privately collected data by government entities as well as the
consideration of larger-scale consumer privacy legislation to protect consumers by allotting them a “right
to privacy” ala the right granted to residents in the European Union. As technology has increasingly
encroached on the individual citizen’s day to day life, there has been little done by federal authorities to
ensure that consumers’ privacy is protected from the ever-expanding adtech industry. While some
states, such as California and Vermont, have passed laws to protect their citizens from data brokers and
other corporate surveillance operations, the lack of federal protections is compounded by the fact that
the government is utilizing the information these unchecked data brokers collect for their own
unwarranted investigations. Additionally, the collection and sale of consumer data to the highest bidder
could create concerns around national security, as if the American government is able to purchase
consumer data, nothing is stopping foreign governments from doing the same. A formalized ban on this
practice is a crucial first step in proving that the priority of the American government is its citizens rather
than corporations, and the enacting of laws that limit the reach and capabilities of data brokers and
other private operators to collect and withhold an individual’s data without their knowledge would
further cement the United States’ commitment to protecting its population’s data and information from
private operators.

Background and Methodology

Due to the delay in legislating the degree to which tech companies can harvest consumer information,
the rise of advanced tracking technologies has resulted in rapid and exponential corporate surveillance
fueled information collection. With this in mind, recent revelations concerning both government
contractors as well as state and local police departments purchasing information from data brokers are
especially concerning and make clear the dangers of the lack of oversight on how our information is
collected and sold by corporate surveillance agencies. Investigations from the Wall Street Journal and the
Electronic Frontier Foundation into companies like Near Intelligence or Fog Data Science and their
relationships to government agencies show that this problem is pressing and that the breadth of it has
been obscured from the population at large. Some of the data these companies collect and sell is also
highly sensitive, as evidenced by a study from Joanne Kim (2023) that found that data brokers are
harvesting and selling mental health data without users’ knowledge and consent. A recent Request for
Information on data brokers from the Consumer Financial Protection Bureau further proves that not
even some within the federal government are fully aware of the degree to which consumer information
is being collected and sold. While the Fourth Amendment requires the government to obtain a warrant
before attempting to track the location of and individual, this practice allows federal agents to
circumvent the law and extralegally purchase the information they seek. Additionally, there remains the
fact that as it stands now, foreign governments are legally able to buy Americans’ personal information
from these data brokers, even outside of the collection of data from platforms such as TikTok that are
based in other countries.
 Key Findings
The core issue in addressing these practices and the problems posed by the data in general is the overall
lack of legislation concerning the legality of data collection and selling. The first priority for legislators
ought to be outrightly banning the sale of consumers’ personal information by data brokers to both our
government and those abroad, followed by enacting legislation giving American citizens more control
over their data as well as moving towards the outright ban of the selling and withholding of personal
data collected by companies without clear user consent. These companies have been allowed to thrive
due to occupying a legal gray area not covered by existing privacy legislation, and the lack of oversight
and scrutiny on how these companies operate needs to be corrected. Because America lacks any “right
to privacy” laws such as those that exist in the EU, many Americans are unaware of how much of their
data has been harvested, and once that data is in the hands of data brokers, individuals no longer have
control of their own information. The recorded instances of federal agencies using consumer data are
likely just the tip of the iceberg, and intermediary legislation such as the recent Protecting Americans’
Data from Foreign Surveillance Act, while addressing the national security concerns around data brokers
selling information to foreign entities, still fails to protect American citizens from their own government.

Recommendations
In addressing the purchasing of American citizens’ data by the federal government, the bipartisan Fourth
Amendment is Not For Sale Act is a crucial reinforcement and example of the federal government’s
responsibility regarding protecting its citizens’ privacy. However, legislators cannot stop there. A
comprehensive federal right to privacy law must be passed as soon as possible. This law should include
three crucial rights regarding consumer control over their data, namely; forcing online companies to
allow users to opt-in to having their data collected and sold, and allowing consumers to opt-out without
trouble or being forced to pay to reclaim their data; making data aggregators inform consumers what
data they have collected and how it was obtained; and allowing consumers access to their own data,
giving individuals more control and sovereignty over their data. Data brokers should also be forced out of
the shadows, as the current lack of scrutiny and knowledge about who is collecting this data and how is
a fundamental reason this problem has become so severe, and the information they collect ought to be
monitored and limited by federal entities. The Health and Location Data Protection Act of 2022 and the
Data Care Act of 2023 are both steps in the right direction, and demonstrate that legislators understand
that something must be done, but their failure to pass shows that some in the government are still
reluctant to control these companies. The longer these companies go unchecked, the more difficult it
will be to reign them in and restore control of American data back to the citizens that provide it.

Conclusion
While the purchasing of consumer data by the federal government is a pressing issue, it is just one
example of a larger and more overarching issue concerning the industry of data collection in the United
States today. Until the data aggregation industry is properly addressed through legislation, such morally
and legally gray transactions of data will continue, and American citizens will continue to be harvested
for data whether they consent to it or not. Legislators owe their constituents swift action to afford
Americans a new right that, in the modern day, ought to be inalienable. The enacting of such legislation
would prove to Americans everywhere that legislators take their privacy seriously, and that the
government understands its responsibility to protect its citizens’ data rather than purchase it. Some
caution is necessary, as disrupting such a profitable and thriving industry will likely represent a major
blow to the economy. Nevertheless, the priority for legislators and the government at large ought to be
protecting constituents, not corporations.
 Works Cited
Gebhart, Gennie. “EFF's Recommendations for Consumer Data Privacy Laws” Electronic Frontier
Foundation, 17 June 2019, https://www.eff.org/deeplinks/2019/06/effs-recommendations-consumer-
data-privacy-laws

Guariglia, Matthew. “What is Fog Data Science? Why is the Surveillance Company so Dangerous?”
Electronic Frontier Foundation, 31 August 2022, https://www.eff.org/deeplinks/2022/06/what-fog-data-
science-why-surveillance-company-so-dangerous

Guariglia, Matthew. “Adtech Surveillance and Government Surveillance are Often the Same Surveillance”
Electronic Frontier Foundation, 18 October 2023, https://www.eff.org/deeplinks/2023/10/adtech-
surveillance-and-government-surveillance-are-often-same-surveillance

Kim, Joanne, Data Brokers and the Sale of Americans’ Mental Health Data, Duke Technology Policy Lab,
2023, https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-americans-mental-health-data/

Tau, Byron, Mollica, Andrew, Haggin, Patience, Volz, Dustin. “How Ads on Your Phone Can Aid
Government Surveillance” The Wall Street Journal, 13 October 2023,
https://www.wsj.com/tech/cybersecurity/how-ads-on-your-phone-can-aid-government-surveillance-
943bde04