Where Is Federal Law Enforcement’s Data-Buying Transparency?

Many U.S. government agencies buy data from data brokers, but a new intelligence community report just widened the transparency gap between them, with major privacy and civil liberties consequences.

The Office of the Director of National Intelligence (ODNI) published its first report in September 2026 about how the U.S. intelligence community acquires commercial data. Although short, it recapped ODNI’s previously published framework for commercial data acquisition and provided new statistics about how much sensitive data the intelligence community buys, some of the ways agencies use the data, and some of the spending on said data, among other information. Yet the U.S. intelligence community is, of course, just one part of the government—and one part that could potentially buy data from data brokers.

By and large, privacy and civil liberties risks in the United States are greatest when data buyers have the authority to kick in people’s doors: law enforcement. However, to date, no federal law enforcement organization—including the FBI and components of the Department of Homeland Security (DHS)—has issued a comparable commercial data acquisition framework or transparency report. In fact, federal law enforcement agencies have provided the public with little to no information about the potentially vast quantities of commercial data they may be purchasing about people within the borders of the United States. This is a serious problem.

While policymakers and civil society organizations have debated commercial data purchases by many federal agencies, the public should have a significant interest in understanding the FBI, DHS, and other federal law enforcement agencies’ current data purchases. This includes learning what kinds of data federal law enforcement agencies are buying, how much data contains personally identifiable information, how much data pertains to people on U.S. soil, and how they use the data. Federal law enforcement agencies should also explain whether there are any third-party audit capabilities to verify those supposed uses.

Agency reports, in and of themselves, are not enough. Federal law enforcement agencies buying data about people in the United States from data brokers, especially in bulk, when they would otherwise need a warrant or court order, flies in the face of Fourth Amendment principles. Surveillance in the United States is supposed to have robust controls and oversight. Yet people often don’t read, let alone understand, privacy policies and other documents that hint their smartphone app might sell their health and financial data to the FBI, nor would many people reasonably expect the government to be able to buy such data. Congress needs to reform the current Wild West of law enforcement access to brokered data, from people’s web browsing patterns to their geolocations.

But informed public debate, transparency into domestic surveillance activities, and effective legislative responses would all be aided by more insight. When the U.S. intelligence community has taken steps across multiple administrations to establish frameworks and provide transparency into its data-buying and subsequent use through the new ODNI report—agree or not with its supposed practices, and there is absolutely much more to be debated—it is even more important that federal law enforcement agencies provide, or that Congress directs them to provide, the same. And the time to do so is now.

The Broader Picture

Part of the reason commercial data has become such an issue for Congress, civil society, the media, and the public is that intelligence and law enforcement agencies can simply buy data from data brokers. Until recently, little was known publicly about how the U.S. intelligence community thought about, let alone approached, this issue in its purchasing and use.

On the law enforcement side, data that would normally require the FBI and local police departments to obtain a warrant can simply be bought from data brokers. No warrant, court order, or public disclosure is required. Hence, national security professionals, privacy experts, and many other stakeholders debate what it means for U.S. intelligence and law enforcement organizations to access this data.

The U.S. intelligence community has openly deliberated about its use of commercial data since at least 2023. The ODNI published a declassified, partially redacted report in June 2023, dated January 2022, written by a senior advisory panel on commercially available information (CAI), which is what the intelligence community calls commercial or brokered data.

The 2022 report noted, among other conclusions, that a large amount of CAI is available to the general public, foreign governments, their intelligence services, the private sector, and the U.S. intelligence community; that CAI clearly provides intelligence value, whether by itself or when combined with other information; that CAI also raises significant privacy and civil liberties issues; and that CAI is “less strictly regulated” under intelligence agencies’ rules and procedures than other information the intelligence community acquires. The report recommended that the intelligence community develop a multilayered process to catalog the data that agencies buy, develop standards and procedures for commercial data acquisition and use, and create more precise guidance to identify and protect sensitive commercial data implicating privacy and civil liberties.

In May 2024, the ODNI published that recommended framework. It was formally titled the Intelligence Community Policy Framework for Commercially Available Information. Without detailing every nuance, the document spelled out principles for CAI acquisition, such as that agencies’ access to, collection of, and processing of CAI should be “authorized by and consistent with all applicable law and in furtherance of a validated mission or administrative need or function”; that privacy and civil liberties shall be “integral considerations” in CAI acquisition and use; and that agencies should assess the integrity and quality of data they collect, including undertaking assessments for underlying biases and inferences.

Additionally, it defined a subset of CAI as “sensitive.” This definition is based on the data containing a substantial volume of personally identifiable information about U.S. persons or greater than a de minimis (insignificant) volume of data capturing sensitive attributes about U.S. persons, such as race or ethnicity, political opinions, religious beliefs, sexual orientation, gender identity, or genetic information, among others—or that reveals sensitive activities by establishing a pattern of life. Amid the Trump administration’s numerous other changes to the U.S. intelligence community starting in January 2025, incoming ODNI leadership endorsed the framework that spring.

Following those events, ODNI published its 2026 Commercially Available Information Report in September 2026. The report stated that the intelligence community principally uses “sensitive” commercial data, per the definition above, “to identify and analyze foreign threats to U.S. interests” and that it is also “used for compliance purposes and for security- and personnel-related functions.” The latter includes the “[counterespionage] program in which the [intelligence community] workforce consents to access of their [sensitive CAI] for clearance vetting purposes.”

The 2026 report went on to say that, based on a prior update the intelligence community provided to Congress, seven intelligence community elements accessed or purchased 23 datasets the ODNI policy defines as “sensitive.” Those 23 datasets constitute 3.8 percent of the intelligence community’s total spend on commercial data acquisitions in 2025 (the report did not provide either the datasets’ exact cost nor the community’s total spend). The ODNI reported that of those 23 datasets, six of them were “U.S.” (in quotes) focused and that all six “were utilized for the [intelligence community’s] consent-based [counterespionage] program.” Among other details, the report ends by specifying that each intelligence agency’s legal counsel and civil liberties and privacy officer is

responsible for ensuring their element’s activities related to access, collection, and processing of [sensitive CAI] are within their authorized mission, align with existing legal requirements, and implement internal controls to mitigate privacy and civil liberties risks in accordance with the CAI [Intelligence Community Policy Memorandum].

For example, according to the report, these privacy and civil liberties controls include a requirement to conduct a risk analysis before accessing or collecting the information to determine whether “the value of accessing or collecting the [sensitive CAI] likely outweighs the privacy and civil liberties, data integrity, quality, and security risk, that cannot reasonably be mitigated.” It also said that controls may include policies “at various levels” that “mandate analysts to mask or label identifiable [U.S. persons] data, as well as report incidental [U.S. persons data] collection” to supervisors, civil liberties and privacy officers, and legal counsel.

There is much to discuss here about the report. But stepping back and looking at the U.S. government writ large, the ODNI’s framework and transparency report—while there is much more to be done—stands in stark contrast to federal law enforcement agencies.

Information to Date About Federal Law Enforcement and Data Brokers

“We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us,” FBI Director Kash Patel told the Senate Intelligence Committee in March 2026. This was the last public statement from the FBI on the subject since March 2023, when then-Director Christopher Wray told the same Senate committee that the FBI was not currently purchasing U.S. phone-geolocation data but that “I understand that we previously—as in the past—purchased some such information for a specific national security pilot project.”

The story doesn’t end there. In February 2020, the Wall Street Journal reported that DHS was buying location data to identify immigrants with arrest records and inform other law enforcement activities—the latter an ambiguity that prompts urgent questions about potential arrests, detentions, and more. A September 2023 report from the DHS inspector general found a number of problems with DHS agencies’ commercial data purchases—a series of revelations that are, frankly, disastrous for privacy and civil liberties, not to mention basic data governance.

The inspector general determined that Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and the Secret Service “did not adhere to Department privacy policies or develop sufficient policies before procuring and using” what it referred to as “commercial telemetry data,” which in that case included historical phone location data. It also found that the agencies lacked sufficient controls to ensure compliance with DHS privacy policies. And the very organization that was supposed to be providing oversight, the DHS Privacy Office, “did not follow or enforce its own privacy policies and guidance.”

As such, the report states that agencies would buy commercial data and fail to even conduct a privacy impact assessment—meant to document and evaluate use cases and privacy risks—before the purchases. This is despite the fact that the E-Government Act of 2002 requires the department to perform privacy impact assessments. DHS also has other privacy requirements it is supposed to follow under 6 U.S.C. §142 and other laws applicable to the department.

On top of that, internal agency policies were weak or nonexistent for brokered data. ICE did not have any policies or procedures specific to the data it bought. The Secret Service reportedly did not believe it needed any specific policies or procedures to mitigate privacy risks—again, an astounding fact when the data in question could encompass the detailed location histories of people inside the United States. According to the inspector general’s report, even the commercial data DHS purchased in 2019 and 2020, which had a privacy impact assessment, fell short: The assessment did not authorize using the commercial location data to match advertising identifiers to specific people, which it sounds like DHS was in fact doing.

Perhaps the worst message conveyed in the report, however, was the inspector general’s finding that at least one official—who nominally worked in privacy—believed that geolocation data with an advertising identifier attached was “anonymized,” flying in the face of copious research that shows that geolocation data is virtually impossible to mask in that way, at a device level, while still providing the utility that companies or law enforcement agencies desire.

The inspector general’s report was a startling document and an important insight into DHS’s purchasing of brokered data. ICE’s January request for information about what commercial data it could buy and access indicates this kind of activity may persist. Yet the request similarly provided little information about specific data types, use cases, or privacy and civil liberties ramifications.

Despite the report and FBI Director Patel’s testimony, federal law enforcement agencies have not issued frameworks or reports on what data they buy or how they buy it. The list of nonanswers goes on. Little is known about what kinds of data federal law enforcement agencies buy, what they use it for, or where they get it from. There is also little known about, once federal law enforcement agencies buy commercial data, how they govern it, if they are following statutory requirements and policies already in place for government and law enforcement data use, whether they have audit controls to identify potential abuses (for example, personnel looking up former romantic partners or personnel using data for political purposes), and how many abuses may occur. It is also unknown whether—and, if so, how—privacy impact assessments supposedly justify any potential mass-buying of data on people in the United States.

The limited public information, such as the DHS inspector general’s 2023 report, suggests that some federal law enforcement entities may not even have a framework to govern commercial data acquisition or use. Civil society groups and many in Congress are therefore left arguing about these serious privacy and civil liberties risks while guessing about what law enforcement might be doing. And the public—whose recent bipartisan backlash against Flock cameras indicates that people do, in fact, still care about privacy—is left without information about how federal law enforcement agencies might buy data from data brokers, smartphone apps, cars, and more.

What Next?

The intelligence community continues to advance public discussion around both its commercial data acquisition and how it governs its use. Undoubtedly, many pressing questions remain vis-a-vis intelligence community data-buying. For example, there are several public indications of late that foreign adversaries are becoming more sophisticated in exploiting open-source information and commercial data against U.S. national security interests—including to surveil and target U.S. military personnel in the Middle East.

Policymakers and analysts should therefore urgently understand what adversary exploitation of the commercial data space may look like, what mitigations might be required, and which organizations and entities should implement those mitigations. The executive branch and Congress (to varying degrees, as appropriate) need to understand how U.S. technology connectivity and ubiquitous private-sector data collection, use, and transmission create national security vulnerabilities.

The intelligence community’s commercial data acquisitions and their implications for privacy and civil liberties are likewise critical. While ODNI’s recent report provides more information than has been made publicly available to date about intelligence community commercial data acquisition—a fact to be commended, and a step that would never happen in a country such as China or Russia—questions remain. For example, congressional overseers have plenty of questions to ask around future use cases, governance controls for any data that might involve U.S. persons, and so forth. Differentiating U.S. government activities from those in China, Russia, and elsewhere—from diplomatic and public messaging perspectives—requires genuinely protecting privacy and civil liberties in the United States, too.

However, while important questions and policy issues persist about U.S. intelligence community activity, federal law enforcement agencies are the organizations with the power and reach to watch, follow, detain, arrest, or otherwise take action against people in the United States. Federal law enforcement are the agencies with extensive domestic surveillance infrastructure—including automated license plate readers, facial recognition on closed circuit systems, and even Flock cameras—that could quickly supplement commercially purchased data to conduct surveillance within the United States. And it is federal law enforcement agencies whose public track record on commercial data (of the little that is known) looks less like democratic governance and more like missing policies, no public transparency, and an inability to understand basic privacy issues associated with data types like phone location data.

That spells an environment ripe for invasions of people’s privacy. Such risks exist without even getting into bipartisan congressional and civil society debates about whether law enforcement even having the ability to buy data without a warrant or court order, when it might need one to get the same data from a different source, is equivalent to buying one’s way around the Fourth Amendment—and should be done away with entirely. It is a problem for congressional overseers, civil society voices, and the public. As part of democratic oversight of law enforcement and domestic surveillance activities, it is time for change. Bipartisan interest in commercial data purchasing and the parties’ reconsideration of policy priorities provide a significant opportunity for the next Congress to build consensus about requiring transparency; understanding the implications of past, ongoing, and potential future activity; and developing bipartisan reforms.

Congress, through the relevant oversight committees, should call on federal law enforcement agencies to answer basic questions, in the public record, about their commercial data purchases. The agencies should include the Department of Justice, including the FBI and the Drug Enforcement Administration, and DHS, including CBP and ICE. Nonpartisan questions should at minimum begin with:

1. Does your agency or any of its components purchase commercial data, including commercially available information provided as part of licensing agreements or as a component of a commercially procured software platform or interface?
2. What kinds of commercial data does your agency or its components purchase? List all types, including, if applicable, geolocation (phones, vehicles), biometric information (including face photos or gait information), online activity (including browsing), and identifiers (including systems that tie a person’s digital identifiers together).
3. How much money did your agency and its components spend, in total, last year and, separately, in the current year to date on commercial data?
4. For what specific purposes does your agency and its components purchase and use commercial data? Without disclosing specific operational details, comprehensively list all types of use cases or potential, likely use cases in the near term.
5. Does your agency or any of its components share commercial data it purchased with any other federal law enforcement agency or component? Explain.
6. Does your agency or any of its components combine commercial data it purchased with data acquired by other means, including to determine someone’s identity? Explain.
7. Does your agency or any of its components know how much of the data it purchases directly contains sensitive information about people in the United States, defined to include individually identifiable data about their race, ethnicity, religion, gender, sex, sexual orientation, health conditions, and movements (among others)? Explain.
8. Does your agency or any of its components know how much of the data it purchases enables the indirect learning—such as through inference or predictive modeling—of sensitive information about people in the United States, defined to include individually identifiable data about their race, ethnicity, religion, gender, sex, sexual orientation, health conditions, and movements (among others)? Explain.
9. Describe how many of the total of your agency or component’s data purchases to date have undergone privacy impact assessments, have been subject to internal governance processes and controls, have had audit controls put in place to identify security incidents or personnel misconduct, and have been reviewed by legal counsel.
10. Describe whether your agency and its components have ever investigated personnel use of purchased data, how often in time that has occurred, how much of the scope of purchased data those investigations have covered, and what, if any, personnel misconduct issues have been identified (including security lapses or inappropriate data lookups).
11. Describe what plans your agency and its components have for the next 12 months with respect to commercial data, including new purchases, contract renewals, contract terminations, policy continuity or changes, and use continuity or changes.

Reports will not solve the issues federal law enforcement agencies raise from purchasing volumes of commercial data. But if the intelligence community—which has far more sensitive equities and a need for secrecy—can start taking basic steps to be transparent about its commercial data acquisition and use, every federal law enforcement agency should be compelled to do the same and more.