Data Broker Sales and the Fourth Amendment

The Federal Trade Commission is poised to ban a data broker from selling sensitive location data as the Biden administration just issued an executive order to limit sensitive data sales to certain countries of concern. Yet a major customer of these data brokers is the U.S. government itself. For years, news outlets have reported on how federal and state agencies buy Americans’ data from private companies called data brokers—in mass. These brokers purchase and aggregate users’ location data from virtually all applications. Brokers, in turn, repackage and sell geolocation data to willing buyers, including the federal and state governments. This has led to the government purchasing data on 98 million users from a prayer app, as well as tens of millions of users’ data from dating apps, mobile games, the Weather app, Google, rideshare apps, and social media apps. This data can reveal some of the most intimate information about people, from their faith, political associations and beliefs, immigration status, pregnancy status or interest in seeking an abortion, and more. A recently declassified report from the Office of the Director of National Intelligence confirms what has been known for years: Brokers sell people’s private data to the government. 

Matthew Tokson describes this practice and some of the attendant Fourth Amendment issues in a previous Lawfare piece. Government attorneys claim agencies can purchase data without a warrant because the data is commercially available, meaning there can be no reasonable expectation of privacy with respect to this data, and because users signed a terms of service waiver, meaning they forfeited their privacy rights in the data. Tokson ably responds to both arguments, and suggests that a reasonable expectation of privacy persists in the data.

But commentators miss a foundational problem that puts this practice outside the scope of Fourth Amendment protection: a government purchase of data is not “state action” for constitutional purposes. As I argued in the Yale Law & Policy Review, even if users maintain a reasonable expectation of privacy over the data transacted by data brokers, the violation of their privacy is not cognizable under the Fourth Amendment. 

The Fourth Amendment in the Information Age

The Fourth Amendment prohibits “unreasonable searches” of people’s “persons, houses, papers, and effects.” It is the cornerstone legal protection against warrantless surveillance and a constitutional bulwark for privacy. The Fourth Amendment ordinarily requires law enforcement and intelligence agencies to obtain a warrant to conduct surveillance—for example, tracking people’s locations and wiretapping phones. As the Supreme Court has long made clear, a “search” occurs when the government violates your “reasonable expectation of privacy.” Thus, when the police, FBI, or CIA invade this reasonable expectation of privacy, they (generally) must obtain a warrant. 

In the 2018 Supreme Court decision Carpenter v. United States, law enforcement agencies forced two internet service providers to hand over detailed cell-service location information data on a robbery suspect. The Court held that the suspect had a reasonable expectation of privacy in these invasive geolocation records. Thus, to obtain these records, the government needed a warrant. It stands to reason that when the federal government and state agencies purchase equally sensitive geolocation data from brokers, users have an equally reasonable expectation of privacy in the data sold by brokers as that addressed in Carpenter. (And under Kyllo, even commercially available data can be subject to a reasonable expectation of privacy, as both Tokson and I address elsewhere. That users signed terms-of-service waivers does not undermine users’ expectation of privacy, either.) 

So if users have a reasonable expectation of privacy in the data sold by brokers to the government, then why did the government need to obtain a warrant in Carpenter but need not obtain a warrant to purchase the data?

This is because of the “state action problem.” Axiomatically, the Fourth Amendment protects people only against unreasonable searches by the government, not against those conducted by purely private parties. When the Supreme Court first articulated the “reasonable expectation of privacy” test, it made clear that the Fourth Amendment “protects individual privacy against certain kinds of governmental intrusion” (emphasis added). Thus, when a private citizen or company invades your reasonable expectation of privacy, those “invasions ... d[o] not violate the Fourth Amendment because of their private character.” Private searches, then, are not governed by the Fourth Amendment. (Instead, they are governed by common law tort and state statutes.) 

For the Fourth Amendment to require a warrant to purchase your data, then, the act of buying data itself must constitute a “search”–otherwise, there is no state action, and all that has occurred is a private search. 

The State Action Problem

Courts have never directly addressed whether a purchase can constitute a “search.” But long-standing precedent on “private searches” suggests it cannot.

Suppose you obtain a package that’s clearly addressed to me. You open the package despite the fact that it’s clearly my property, and you find contraband films in it. You watch everything on the films before voluntarily handing the package over to the FBI. Does the FBI need a warrant to see the contraband films? 

The Supreme Court’s ruling in Jacobsen would suggest that even though I have a reasonable expectation of privacy in that package, the FBI does not need to obtain a warrant. Jacobsen recast an earlier decision, Walter, in which a private citizen had received contraband films but instead declined to watch them. The citizen forwarded the material to the FBI, which projected and watched the films anyway. Walter lacked a majority opinion, but Jacobsen made clear that the FBI was required to obtain a warrant to watch these films. The Court explained that because “the private party had not actually viewed the films,” the FBI’s projection “exceed[ed] the scope of the private search.” Had the private party viewed the films and then forwarded them to the FBI, no warrant would have been required.

The Court thus settled on “the appropriate analysis of a governmental search that follows on the heels of a private one”: A government search occurs, and a warrant is needed, only insofar as the government’s actions would reveal more than what the private search exposed. (In the words of the Jacobsen Court, the “Fourth Amendment is implicated only if the authorities use information with respect to which the expectation of privacy has not already been frustrated” [emphasis added].) But where the government merely reaccesses the same private information revealed by a private search, there is no “proscribe[d] governmental action.” The government therefore does not need to obtain a warrant where the private material searched by a private entity is voluntarily handed over to the government and the government confines its examination to the scope of the private search. 

A data purchase is analogous to the key features of Jacobsen. A purely private actor—the internet service provider—conducts an initial “private search” by collating user location data, which is eventually sold to a government agency. Whether a government purchase is a “search,” then, turns first on whether a private party’s sale of data to the government qualifies as voluntary and second on whether the government’s examination of the geolocation data extends past the scope of the service provider’s and data broker’s private search. 

The answer to both questions is obvious under current law. First, long-standing Fourth Amendment doctrine establishes that open-market transactions are presumptively voluntary. In a foundational case, an undercover official purchased obscene material from a willing seller. Because the vendor was not aware he was selling contraband to law enforcement, he sold the material without bending to any government pressure. Even though the government official sought to purchase the material, the Court held that the sale represented a voluntary transfer of material. Any Fourth Amendment rights thus went away with the voluntary sale. Since then, the Court has routinely held that even where the government’s identity is known, the sale is presumptively voluntary.

There is no reason to doubt that brokers sell data packages to the government voluntarily. The market is estimated to be worth several billions. Individual brokers stand to profit enormously from selling records, whether to advertisers or to the government. This satisfies the first factor of Jacobsen.

Addressing the second factor, when the government buys a data set, it does not exceed the scope of the service provider’s initial “private search” of its users. Data brokers thoroughly examine, clean, and process their data before the records change hands with agencies. The government therefore conforms to the parameters of the private search. A purchase of data is therefore much like the case of you handing over my private material to the FBI–and in both cases, a warrant is not needed. 

Some observers may suggest that because government purchasers use special software to conduct searches of the databases they buy, and data brokers do not search their own databases in this same way, the government exceeds the scope of the private search. But Jacobsen and its progeny specifically contemplated that even if the government learns more from its examination of the private material than the private party did (because of some preexisting knowledge), as long as it reaccesses the same raw material, no warrant is required. Here, there is a one-to-one match of raw data examined by brokers and the government. (Querying data, in any case, is arguably a different Fourth Amendment event than purchasing data.)

If that weren’t enough, another line of doctrine underscores that a government purchase of data is not a search: the market participant doctrine. The Constitution does not regulate all government action equally. When the government acts as a mere “market participant,” rather than exercising “coercive power,” its actions do not count as “state action.” For example, where the U.S. government is choosing “how to enforce [an] exclusive [trademark] right,” the choice “simply is not a governmental decision.” Since the government acts like a private company in enforcing trademark rights, this kind of market-based decision is not regulated by the Constitution (whereas, if it suppressed speech using its coercive sovereign capacity, its action would be subject to the First Amendment). Similarly, certain decisions taken by a public school association as a market participant–such as the sale of advertising rights–does not constitute state action and is not subject to scrutiny under the Constitution. An agency buyer of data is definitionally a mere market participant. As a result, a government purchase is not state action and so cannot constitute a government search subject to Fourth Amendment scrutiny.

Tokson’s piece cites the recent district court decision in Cooper v. Hutcheson to gesture at the idea that a government purchase converts service providers into state actors for Fourth Amendment purposes. But Tokson overstates Cooper’s reach. There, a sheriff provided a communications company with the phone numbers of several criminal suspects, and the company provided the sheriff with the individuals’ real-time location. The private company, in other words, took direct orders from the sheriff to collect specific people’s data in near-real time. This is a far cry from a private company independently collecting mass data then handing that data over to the government. Furthermore, Cooper resolved a motion to dismiss, meaning the district court did not conclude there was state action—instead, there was merely a plausible inference of such. 

When agencies buy data, then, the government does not conduct a government “search.” All that has occurred is a private search, not state action. (And as I describe elsewhere, applying other theories of state action don’t work here either.) The Constitution therefore does not protect citizens and residents from government purchases of data.

A Different Way to Protect Privacy

If privacy over commercial data is not guaranteed by the Constitution, how should we protect user data? There is a proposal currently floating around in Congress: the Fourth Amendment Is Not For Sale Act. This law would impose a blanket ban on state and federal agencies purchasing data. Having recently passed in the House Judiciary Committee, it appears to be Congress’s preferred mode of addressing data brokers. But passing this law is the wrong way to protect privacy.

This proposed law would hobble U.S. national security agencies relative to foreign intelligence threats. The Director of National Intelligence confirmed that foreign governments already purchase Americans’ data from third-party brokers. Under the Fourth Amendment Is Not For Sale Act, hostile foreign threats would be free to buy Americans’ sensitive data without restraint, even though U.S. intelligence agencies could not. 

Thus, if Congress wishes to restrict the U.S. government’s ability to use commercial data, it should instead regulate the way it is queried. Congress might even consider taking measures to restrict sales to hostile foreign actors. The Biden administration has attempted the latter by subjecting sensitive data sales to export control-like measures (among other things).

Commercial data is just one speck in a wider constellation of emerging privacy challenges raised by new surveillance methods. Fourth Amendment doctrine has repeatedly struggled to keep pace with the novel privacy issues that attend evolving surveillance technology. But Congress can restore the principles that animate the Amendment and keep people’s personal lives truly private.