The Reform Nobody Is Fighting For

What the Loophole Actually Is

Here's the trick. It's been there for years. Most people don't know it exists.

The Fourth Amendment says the government cannot search you or seize your things without a warrant supported by probable cause. The Supreme Court in Carpenter v. United States (2018) extended that to cell-site location information held by your phone company: you have a reasonable expectation of privacy in seven days of your own movements, the Court said 5-4, and the government needs a warrant.^[1]

The trick is the loophole is for other people's data.

Your carrier needs a warrant to hand over your location history. Babel Street, Venntel, Datastream Group, and a small industry of commercial data brokers do not. They buy it from the apps on your phone, the loyalty programs you sign up for, the free Wi-Fi you connect to at the airport, the cars you drive, and the credit cards you swipe. They resell the aggregate to anyone with a government contract and a credit card.

The government buys what it cannot compel. No warrant. No court order. No FISA judge. No oversight. No probable cause. No notice to you, ever, that your data was purchased and used in an investigation of you.^[2][3]

The agencies doing this are not a small list. Internal documents reviewed by reporters, FOIA productions, and Senate testimony put the buyer roster at ICE, CBP, FBI, DHS, the IRS, the DEA, the Secret Service, the U.S. Postal Inspection Service, the U.S. Marshals Service, the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Office of the Director of National Intelligence. The Department of Homeland Security has spent at least $30 million on commercial phone-location data alone since 2018. The IRS bought it. The Treasury Department bought it.^[4][5][6]

How It Works in Practice

You land at JFK. The airline sends you a marketing email. Somewhere in the background, your reservation, your phone number, your email, and the timestamp of your flight are flowing into a commercial data broker's database.

You open the airline's app to get your gate number. The app records your GPS location every few seconds. Some of that location data is shared with ad networks under the app's privacy policy in language nobody reads. The ad networks sell the location feed to commercial data brokers.

You tap your phone on the kiosk at the rental car counter. The phone's NFC chip pings the kiosk. The kiosk vendor logs the tap and the timestamp. The vendor sells logs to data brokers.

You drive the rental car out of the city. The car's telematics system pings the manufacturer's cloud. The manufacturer sells telematics to data brokers.

You check into the hotel. The hotel's property management system logs your name, your ID, your credit card, and your stay dates. The hotel's data warehouse is owned by a third-party vendor. The vendor sells guest records to data brokers.

By the time you reach the hotel room, your identity, your location for the last 12 hours, your flight record, your rental car, your email, and your phone number have been sold and resold three or four times. None of it required a warrant. None of it required probable cause. None of it triggered any oversight.^[3][7]

Now multiply that by 330 million people, 4 billion phones, 1.4 billion connected cars, 2.7 billion loyalty program memberships, and the 7,000+ data brokers operating in the United States. You are not a needle in a haystack. You are the haystack. And the government has been buying access to it.^[8]

Why Carpenter Did Not Save You

Carpenter was supposed to be the line. Six years later, it has not held.

The 2018 ruling was about a specific data type held by a specific kind of company (cell-site location information held by a wireless carrier). The Court said that records were protected by the Fourth Amendment when they revealed a comprehensive picture of a person's movements. The reasoning was narrow. The exception has been broad.^[1]

The government and the data broker industry responded by moving the records. Same data, different source. Buy it from the app, not the carrier. Buy it from the ad network, not the phone. Buy it from the connected car, not the phone. Buy it from the loyalty program, not the credit card. Every time the courts close one door, the data brokers open another.^[2][9]

Judge Stephanos Bibas, writing for the Third Circuit in 2024, called this what it is. The "purchase-versus-compulsion loophole" is the legal fiction the government is using to do end-runs around Carpenter.^[10] The Biden administration's DOJ, under then-Attorney General Garland, formally asked Congress to close the loophole. The Trump administration's DOJ has not only not asked Congress to close it. It has been one of the most aggressive purchasers of commercial data through the loophole.^[11]

The Ninth Circuit, the Sixth Circuit, and the D.C. Circuit have all split on whether Carpenter extends to data held by third-party commercial brokers. The Supreme Court has not taken the case. As long as the appellate circuits are split, the loophole stays open and the data flows.

17 State Attorneys General Just Made This the Most Concrete FISA Reform Demand

In March, seventeen state attorneys general (a coalition led by California's Rob Bonta and including Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, Oregon, Vermont, Virginia, and Washington) sent Congress a letter demanding the loophole be closed as part of any FISA 702 reauthorization.^[12]

This is not a privacy advocacy group. This is a bipartisan coalition of state law enforcement leaders. The same officials who run state police, state consumer protection divisions, and state-level criminal investigations. They are telling Congress, in writing, that federal agencies buying their residents' data without a warrant is a problem. These are the people whose state law enforcement agencies are the natural allies of federal law enforcement. They are saying the federal side has gone too far.^[12]

California Attorney General Bonta, in the press release accompanying the letter, named the harm directly: "When the government can buy what it cannot compel, it erodes the very constitutional protections that safeguard every American's right to privacy."^[12]

The AG letter did three things the warrant fight alone could not do. It framed the loophole as a Fourth Amendment issue, not a FISA procedural issue. It put a law-enforcement-friendly face on the reform demand. And it shifted the burden of proof: the question is no longer "should the loophole be closed?" but "why is Congress refusing to close a loophole that even state cops think is unconstitutional?"^[12][13]

What Closing the Loophole Would Actually Look Like

Two vehicles have the language drafted. Both are stalled.

The Wyden-Lee Government Surveillance Reform Act is the Senate bill. Senators Ron Wyden (D-OR) and Mike Lee (R-UT) introduced it. It would amend Section 702 to explicitly require a warrant before the FBI can query the 702 database for an American's communications, and it would also require a warrant before any federal agency purchases commercially-held data on Americans from a third party.^[14]

The data-broker provision is the part nobody talks about. It would close the loophole for every federal agency, not just the intelligence community. The warrant requirement would extend to data already held by commercial brokers: the same data the government currently buys.^[14]

The House three-year extension (H.R. 8035, which passed 235-191 on April 29) does not include the data-broker language. The warrant amendment demanded by a bipartisan coalition of House members was kept off the floor by the Rules Committee. The bill text that was voted on would reauthorize Section 702 with no reforms at all.^[15]

The Senate compromise text Senate Intelligence Committee chair Tom Cotton (R-AR) and vice chair Mark Warner (D-VA) had been negotiating also did not include the data-broker language. It included a "backdoor search" warrant requirement (a warrant before the FBI queries 702 data for an American) but the data-broker loophole was left open.^[16]

The Cotton-Grassley letter to Secretary Rubio from this weekend, which is the most concrete current proposal in the room, does not address the loophole at all. It is about executive-branch fallback authorities for foreign-intelligence collection. The loophole stays open regardless of what happens with Section 702 Friday.^[17]

The Wyden-Lee reform bill is the only one of the four that would close the loophole. It is the only one of the four that has the AG coalition's endorsement. It is the only one of the four that has 76% public support.^[18] It is not getting a floor vote in either chamber.

Why Nobody on Cable Is Talking About the Loophole This Week

Two reasons. One strategic, one political.

Strategically, the warrant fight is the one that is closest to a vote. The Senate procedural vote on Friday was about a clean three-year reauthorization. The path to a different outcome (a short extension, a reform-tagged extension, a deal that includes a warrant amendment) runs through the same procedural vote. The warrant fight is the fight that is procedurally possible. The data-broker fight is downstream.^[19]

Politically, the warrant fight is also a cleaner story for cable news. "FBI searches 7,413 Americans' data without a warrant" is a number. "ICE buys location history of every person who crossed a checkpoint" is a system. Numbers get chyrons. Systems get explainers. The loophole is a system. The explainer would take four minutes. The chyron is a one-liner.

None of this is a reason to leave the loophole open. It is a reason to understand why the loophole has been left open for the eight years since Carpenter. The politics of the loophole are bigger than the politics of any single FISA fight. The loophole survives every FISA fight for the same reason the surveillance state survives every FISA fight: the cost of closing it is borne by agencies that have other ways to collect. The benefit of closing it accrues to 330 million Americans who do not know the loophole exists.

Thursday: The Reform Scorecard

Tomorrow we publish the companion piece: a side-by-side comparison of every Section 702 reform proposal on the table this week. Clean reauthorization. Two-year extension. The House three-year bill. The Wyden-Lee Government Surveillance Reform Act. The Durbin-Lee SAFE Act. The Cotton-Warner compromise. The Cotton-Grassley executive-order fallback. What each one does to the warrant fight. What each one does to the data-broker loophole. What each one does to the Fourth Amendment.

If you read nothing else before Friday, read the scorecard. The math of the next 72 hours depends on which vehicle actually moves, and which vehicle moves depends on which reform coalition can hold together. The data-broker loophole is the one item on the scorecard that touches every American who owns a phone, drives a car, or has ever been to an airport.

What to Do Before Friday

• Call both your senators today and tomorrow. 5calls.org has a script. The procedural math on a clean reauthorization is 13 votes short. The procedural math on a warrant-tagged reauthorization is a different question. The data-broker language is the reform that is not on the table. Put it on the table.
• Tell them: Close the data-broker loophole. The government should not be able to buy what it cannot compel. 17 state AGs have asked. 76% of the public supports it.^[18]
• Tell them: No vote for a clean reauthorization or a short extension without a warrant requirement and a data-broker prohibition. Both. Not one. Both.
• Opt out of what you can. The data-broker opt-out guide walks through the major brokers. The federal data-buying loophole is a federal problem. State-level opt-out is a partial fix. It is the only fix you control.
• Read the Wyden-Lee bill text. The Government Surveillance Reform Act is the only FISA-side reform bill that would actually close the loophole. Read what your senator is being asked to vote against.
• Join the campaign: EPIC's Reform or Sunset, Demand Progress, and the EFF are coordinating the push. The loophole has been open for eight years. The window to close it this calendar year closes Friday.

The Bottom Line

The data-broker loophole is not a side issue. It is the FISA reform that affects more Americans than every other FISA reform combined. The warrant fight affects the FBI's queries of the 702 database, which is a population in the tens of thousands. The data-broker fight affects the federal government's access to location history, search history, app usage, driving patterns, and travel records for every American with a phone, a car, a credit card, or a loyalty program. That is the whole population.

The loophole is also the reform with the most concrete policy language. The Wyden-Lee Government Surveillance Reform Act has the four corners. The 17-AG letter has the constitutional argument. The 76% public support is the political cover. None of it is in any bill scheduled for a floor vote this week.

Friday's vote is real. The procedural math on the clean reauthorization is 13 votes short. The procedural math on a warrant-tagged reauthorization is a question that has not been put. The data-broker language is the question that has not even been framed. The loophole is not a footnote to the FISA fight. It is the FISA fight the public has not been told is happening.

References

1. Supreme Court: Carpenter v. United States, 585 U.S. ___ (2018)
2. EFF: How the Federal Government Buys Our Cell Phone Location Data (June 2022)
3. NPR: Your data is everywhere. The government is buying it without a warrant (March 25, 2026)
4. NBC News: DHS spent millions on cellphone data to track Americans (2023)
5. The Intercept: The U.S. Treasury Is Buying Private App Data to Target and Investigate People (November 2021)
6. Vice: Secret Service Bought Phone Location Data from Apps, Contract Confirms (2022)
7. Citizen Lab: Webloc, 500 million devices tracked via ad data (May 2026)
8. Brennan Center: Congress Must Close Data Broker Loophole (2024)
9. Project On Government Oversight: Fact Sheet on Closing the Data Broker Loophole
10. Third Circuit: United States v. Chatrie, opinion by Judge Bibas (2024)
11. California AG Bonta: Calls on Congress to Stop Government Mass Surveillance of Americans (March 2026)
12. California AG (full text of 17-AG coalition letter, March 2026)
13. Brennan Center: Closing the Data Broker Loophole (2023)
14. Senator Wyden: Wyden, Lee, Davidson, and Lofgren Introduce the Government Surveillance Reform Act (April 2026)
15. CNBC: FISA Section 702, Congress passes short-term surveillance program extension (April 30, 2026)
16. Roll Call: FISA reauthorization stalls in early-morning Senate vote (June 5, 2026)
17. CBS News: Senate fails to extend FISA surveillance program as deadline nears (June 5–6, 2026)
18. EFF: Congress Must Reject New Insufficient 702 Reauthorization Bill (April 2026)
19. CBS News: Cotton-Grassley letter to Rubio on Section 702 lapse planning (June 6, 2026)