CDT Issue Brief: The Data Broker Loophole

CDT Issue Brief: The Data Broker Loophole When law enforcement seeks user data from a communication service provider such as Google or AT&T, it must apply for a court order or warrant under Electronic Communications Privacy Act (ECPA). The Stored Communications Act (SCA), Part II of ECPA, specifically governs law enforcement access to stored electronic communications held by service providers and establishes a privacy “floor” that states have strengthened through their own statutes. However, since the SCA and corresponding state statutes only apply to service providers, law enforcement has found a legal loophole to collect data without judicial authorization: purchasing data from third-party data brokers. These brokers obtain data from service providers and others that are not subject to the SCA. The result is a surveillance backdoor that strikes at the heart of the Fourth Amendment. Rather than demonstrating probable cause to obtain a warrant, government agencies are spending millions of dollars in contracts with data brokers to buy their way around the court approval process, acquiring the same sensitive information through commercial channels without judicial sign off. The purchase of location data, web browsing history, financial transactions, and other sensitive records allow the government to paint a meticulous picture of a person’s life. These purchases occur in bulk, and without showing any wrongdoing. This circumvents the constitutional protections of millions of people, leaving them vulnerable to improper government snooping and misuse of the intimate details of their lives. Fortunately, there are growing legislative efforts to close the data broker loophole. On the federal level, the Fourth Amendment Is Not for Sale Act (HR 4639) would extend the legal process under SCA to third-party data brokers, which would require uniform state compliance. The bill passed the House in a bipartisan vote in 2024 but has stalled in the Senate, leaving states to pioneer their own protections in the interim. Colorado and Rhode Island drew directly from the federal bill (HB 1037 and H8119 respectively), adopting the same title and similar requirements, though neither have yet been enacted into law. In 2025, Montana became the first state to pass a law requiring a warrant or subpoena to acquire data from brokers (SB 282). While SB 282 is important, its protections could be augmented by providing a private right of action and restricting cross-agency information sharing. Below, CDT outlines reforms state legislators could enact to close the data broker loophole. Require a Warrant States could close the data broker loophole by requiring law enforcement to obtain the same legal process with judicial approval for sensitive data, regardless of whether it is obtained from a communications service provider or a third party data broker. - Why It Helps: Applying the same legal treatment to communication service providers and third parties preserves the vital protections of independent judicial review in our modern digital ecosystem. Requiring a warrant for electronic communications and other sensitive data ensures that individuals’ information is legally protected no matter who holds it. - How it Accounts for Public Safety Needs: Setting a warrant requirement to obtain data from brokers permits law enforcement to access any type of information it needs when there is strong evidence of crime. It extends consistent rules for court approval that police have always followed to acquire sensitive private records. Policy Mechanics Clarify Data Types Subject to Warrant Requirement Shifting the regulatory focus from what type of entity data-holders are to what types of sensitive data are being sought is a better model for the digital age. It provides a stronger, consistent standard that effectively protects individuals from overbroad or improper snooping. States do not define consistently the data subject to warrant requirements. Montana’s law outlines an ad-hoc list of data types including precise geolocation and subscriber lists. In contrast, the Rhode Island and Colorado bills use the umbrella term of “personal data” to regulate “information collected from or generated by a specific person as a part of a consumer transaction or the use of a consumer product or service, whether the information was collected by the original third party or obtained by a different third party, that is connected or reasonably connected to the specific person or the specific person’s electronic device.” This definition comprehensively covers the data included in Montana’s law as well as search history and individual inference data from third parties. Under the Montana law, an investigative subpoena may be issued based on a prosecutor’s affidavit asserting that the subpoena is necessary for the administration of justice. This lower standard provides weaker protections for individuals’ private information than does a warrant. Outline Exceptions to Warrant Requirements Exceptions ensure that there is flexibility within the law where needed. The Montana, Colorado and Rhode Island legislation, for example, all allow law enforcement to acquire information without a warrant when the individual gives case-specific express consent and in cases of emergency. Efforts to advance public safety should always be balanced with protecting individuals’ rights. Potential Enforcement Approaches Restrict Admissibility of Evidence Data collected in violation of statutory requirements should be inadmissible evidence in any court proceeding. Without consequences for unlawful data acquisition, law enforcement has little incentive to comply, and people bear the risk that illegally obtained information could be used against them. Montana’s law bars the use of unlawfully obtained data in any civil, criminal, or administrative proceeding and prohibits its use in affidavits. This provides stronger protections than the Colorado bill, which provides a waiver option to override this exclusionary rule. Legislators may also consider affirmative disclosure obligations on how evidence is obtained and limit parallel construction workarounds where police recreate the discovery of evidence that was originally obtained unlawfully. Grant Private Right of Action A private right of action — whereby persons who suffer a statutory injury have the ability to seek redress through civil lawsuit — is an important enforcement mechanism that empowers individuals to proactively protect their rights and punish violators. Montana’s law omits this; the Colorado and Rhode Island legislation grant injured individuals the right to injunctive relief, declaratory relief, or other relief deemed necessary to enforce the act. Limit Intergovernmental Data-sharing While information-sharing across agencies can be useful, it also increases access to personal data beyond the scope of investigation and complicates control. The Federal bill as well as Colorado and Rhode Island’s legislation restrict the exchange and sale of third-party data across federal, state, and local agencies. For more info on CDT’s efforts to close the data broker loophole, visit cdt.org/area-of-focus/government-surveillance/ or email the State Engagement team at [email protected].