No Warrant, No Problem: How Data Brokers Are Killing the Reasonable Expectation of Privacy

By Matthew Ortiz-Fuentes '29

---

Katz v. United States (1967) famously expounded on the Fourth Amendment, with Justice John Marshall Harlan II’s concurring opinion establishing a two-prong test to protect the United States population from “unreasonable searches and seizures” in an era of emerging electronic communications surveillance. (1) Harlan built on previous Fourth Amendment case law to determine the following:

“My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ‘reasonable." (2)

Harlan’s conclusion provides us with an actionable standard widely recognized as the “reasonable expectation of privacy”. This means that any government action that infringes on a reasonable expectation of privacy, such as collecting information within a private domicile or monitoring telecommunications, requires a warrant to meet constitutional standards. Thanks to cases such as Riley v. California (2014) and 1986’s Stored Communications Act, this right is applicable to digital data on cell phones. (3) In the smartphone age, that information includes personal application and web activity, location history, and real-time location data, which is legally protected from government access in the absence of a signed warrant.

The Third Party Doctrine

Nonetheless, it is precisely sensitive personal information accrued from everyday cellphone use, such as all the aforementioned, that United States government agencies are able to outright purchase from third-party entities in lieu of obtaining this information by means of a warranted search. (4) The legal mechanism that allows what seems like a circumvention of Fourth Amendment protections is known as the third-party doctrine. (5) 

Established by successive Supreme Court rulings in United States v. Miller (1939) and Smith v. Maryland (1979), the third-party doctrine outlines that in a situation where a person’s information is communicated to a third party, the protection of the Fourth Amendment’s reasonable expectation of privacy standard, which would otherwise require a warrant for the government to collect this information, is categorically forfeited. (6) This decision is itself the evolution of United States v. Hoffa (1966)’s position that the government acquisition of information that a mistakenly trusted confidant voluntarily conveyed to the government does not constitute an action requiring a warrant (as a Fourth Amendment search or seizure would). (7)

The Data Economy

The American privacy law culture, built around principles of technocracy and deregulation in favor of market competition, has fostered an environment where consumer privacy conditions are overwhelmingly set on an opt-out basis. (8) This means online app and service providers can, by default, access a substantial amount of personal information, per the terms of product use, unless a user consciously exercises their right to opt out of this passive data collection. (9) Furthermore, many apps, websites, and other digital products function on a strictly “take-it-or-leave-it” basis wherein a user must accept all terms and conditions, which commonly include data collection stipulations, in order to use such a product. These terms and conditions also often outright include agreements allowing the products to provide user data to data brokers, named under the euphemism of “trusted partners”. (10) These behaviors are driven by surveillance capitalism, a market-driven economic model where consumer data is treated as a raw material to be collected and refined. (11) Within this framework, data brokers are the entities that collect personal information from a variety of online sources to build highly detailed consumer profiles. (12) These consumer profiles are sold in bulk to the highest bidder, an entity that can be anyone ranging from an advertising firm to a bank to even the United States government. (13)

In the digital age, even the Supreme Court has recognized smartphone use as a “pervasive and insistent part of daily life”. (14) The average American has no choice but to accept that their data is available on the data market and accessible to the government, which regularly purchases information from data brokers to assist in surveillance and criminal investigation efforts. (15)

For example, in 2020, reports emerged revealing that the United States military had been consistently purchasing location data from a broker known as X-Mode, which had been siphoning data from the prayer app, Muslim Pro. (16) When asked to comment, Navy Commander Tim Hawkins stated, “Our access to the software is used to support Special Operations Forces mission requirements overseas”. (17)

The Future of the Data Broker Loophole

51 years after the establishment of Katz’s privacy principle,  Carpenter v. United States (2018) ruled that the government is not able to pull cell site location information from telecommunications providers without a warrant. (18) 8 years later, Chatrie v. United States (2026) ruled that the government demanding short-term geofence information from third parties (in this case, Google) constitutes a Fourth Amendment search, thus requiring a warrant. (19) 

What Carpenter and Chatrie further define are the constitutional standards for compelled production of public data, explicitly defining geographic location history and real-time location as elements of individual information that cannot be coercively sourced for investigations without a warrant. (20)

However, neither “update” to the Katz principle so much as mentions the government’s ability to purchase virtually identical data from brokers, completely warrant-free. (21) Despite the recency of Chatrie, the data broker loophole appears to remain a blind spot for the highest court of the nation, and thus the ability for United States government agencies to purchase swaths of personal data for use in surveillance and investigation remains virtually unregulated. (22) Under Carpenter and Chatrie, if a federal agent demands two hours of location history directly from Google, a federal judge must sign a warrant based on probable cause. Yet, if that same agent logs into a commercial data broker's portal, they can plausibly trace that same device's location across months without ever seeking judicial approval.

Current discourse is torn on the matter of the government’s use of data brokers. Lobbyists representing law enforcement entities, such as the Fraternal Order of Police, maintain that uninhibited law enforcement access to third-party data is crucial in time-sensitive cases. (23) Immigration and Customs Enforcement released a legal memo defending their use of purchased geolocation information, arguing that Carpenter is a narrow decision that explicitly excludes “business records that might incidentally reveal location information” from Fourth Amendment protection. However, legal activist groups such as the American Civil Liberties Union argue that the government’s use of data brokers’ information sourced from the general public is nothing short of a Fourth Amendment violation. (24)  

The future of the data broker loophole is uncertain, with attempted legislative action against it surfacing in the proposed The Fourth Amendment Is Not For Sale Act, which was passed by the House of Representatives on April 17, 2024, but has since then been held off from appearing for a vote before the Senate. (25) Chatrie’s majority opinion contains language legal analysts such as Jake Laperruque believe may pave the way for future decisions on warrant-free digital surveillance. (26) Justice Kagan wrote:

“A cell-phone user is not to be viewed as sharing private information with third parties—which then can be freely passed on to the government—just by doing the ordinary things cell-phone users do.” (27)

This statement can be interpreted by future rulings as encompassing information knowledgeably or unknowledgeably shared with the third-party actors known as data brokers. However, as the situation stands right now, the Federal Bureau of Investigation, Department of Defense, Immigration and Customs Enforcement, Customs and Border Protection, and state and local law enforcement departments nationwide continue to purchase sensitive information from data brokers, lack of warrant notwithstanding. (28)

Endnotes

1. Katz v. United States, 389 U.S. 347, 360–62 (1967) (Harlan, J., concurring).

2. Ibid.

3. Riley v. California, 573 U.S. 373, 403 (2014).

4. National Association of Criminal Defense Lawyers, Civil Rights and Data Purchases: How Government Agencies Buy Their Way Around the Fourth Amendment (2021).

5. Institute for Justice, “The Third-Party Doctrine: IJ’s Project on the 4th Amendment” (2022).

6. United States v. Miller, 425 U.S. 435, 443 (1976); Smith v. Maryland, 442 U.S. 735, 743–44 (1979).

7. Hoffa v. United States, 385 U.S. 293, 302 (1966).

8. California Privacy Protection Agency, Personal Information and Data Brokers, Cal. Civ. Code §§ 1798.99.80–89.

9. Ibid.

10. UNC Kenan-Flagler Business School, The Business of Data Brokers (2020).

11. Criminal Legal News, “Surveillance for Sale: The Data Broker Loophole and the Fourth Amendment After Chatrie,” July 1, 2026.

12. UNC Kenan-Flagler Business School, The Business of Data Brokers.

13. National Association of Criminal Defense Lawyers, Civil Rights and Data Purchases.

14. Carpenter v. United States, 585 U.S. 296, 311 (2018).

15. Vice Motherboard, “CBP, DHS Bought Phone Location Data from Broker Venntel Without a Warrant” (2020).

16. Vice Motherboard, “How the U.S. Military Buys Location Data from Everyday Apps” (2020).

17. Al Jazeera News, “US Military Buying Location Data on Popular Muslim Apps, Report Finds,” November 17, 2020.

18. Carpenter, 585 U.S. at 316.

19. Chatrie v. United States, 609 U.S. ___ (2026).

20. Ibid.

21. Criminal Legal News, “Surveillance for Sale.”

22. Chatrie, 609 U.S. ___ (2026).

23. Fraternal Order of Police, “FOP Letter to Congress Regarding H.R. 4639 / S. 2576, The Fourth Amendment Is Not for Sale Act” (2024).

24. American Civil Liberties Union, “House Passes Bipartisan ‘Fourth Amendment Is Not for Sale Act,’” April 17, 2024.

25. GovTrack, “H.R. 4639: Fourth Amendment Is Not for Sale Act,” 118th Cong., 2023–24.

26. Jake Laperruque, “Breaking Down the Implications of the Landmark Chatrie Ruling,” Tech Policy Press, July 2026.

27. Chatrie, 609 U.S. ___ (2026).

28. Electronic Frontier Foundation, “Data Brokers Are Selling Your Flight Information to CBP and ICE,” EFF DeepLinks, July 2025.