ATF canceled Webloc. The data-broker loophole remains.
When Everything Becomes Searchable Safety, Privacy and Freedom in the Digital Era
The Redemption Project Newsroom
The government may need a warrant to compel certain phone-location records from a cellphone company.
But what happens when the government buys access to a similar movement trail from a private vendor?
That is the question behind the Bureau of Alcohol, Tobacco, Firearms and Explosives’ canceled contract for Webloc, a phone-tracking tool sold by Penlink that used commercial location data from consumer apps and advertising networks.
The ATF cancellation matters.
But the larger issue did not end with one contract.
The larger issue is whether the Fourth Amendment can become a procurement problem.
A warrant asks a judge to authorize a search. A vendor contract buys access to a product. Those are not the same thing.
According to The Associated Press, ATF canceled its contract with Penlink after privacy and legal concerns were raised by Sen. Ron Wyden, D-Oregon, and Rep. Michael Cloud, R-Texas, as well as by a prosecutor and judge in a criminal case. Lawmakers said ATF conducted more than 300 warrantless searches using Webloc, including more than 200 tied to active ATF investigations. (AP News)
ATF told AP the program was a limited pilot and said Webloc did not meet the agency’s needs. The agency also said it is not using other ad-tech-sourced services. (AP News)
That is the agency’s position: limited pilot, public safety mission, tool discontinued.
The constitutional concern is broader.
Webloc uses commercial location data gathered from consumer apps and advertising networks. That kind of data is often called ad-tech data because it comes from the digital advertising ecosystem that supports many apps, websites and mobile services. AP reported that Webloc’s data sources include consumer apps and advertising networks that collect mobile-device locations from people who download apps or browse the web. (AP News)
Citizen Lab, a research group at the University of Toronto, described Webloc as an ad-based geolocation surveillance system that uses data from consumer apps and digital advertising to monitor hundreds of millions of people globally. Citizen Lab said the technology was originally developed by Cobwebs Technologies and is now sold by Penlink. (The Citizen Lab)
That means Webloc is not just a police tool.
It is part of a larger commercial surveillance market.
The government did not build the entire tracking economy by itself. It found one already operating.
That is what makes the ATF story important beyond ATF.
In the traditional Fourth Amendment framework, the government usually needs legal process to obtain sensitive records. A warrant requires probable cause and particularity. A subpoena or court order may require a lower standard, depending on the records and statute. Either way, the government is using legal authority to compel production of information.
A vendor contract is different.
A vendor contract does not ask a judge whether the government has probable cause. It does not necessarily require individualized suspicion. It does not, by itself, answer whether a search is constitutional. It allows an agency to buy access to a product.
That may sound like a procurement detail.
It is not.
When the product is a searchable location trail, procurement becomes a constitutional question.
The Supreme Court’s 2018 decision in Carpenter v. United States held that police generally need a warrant to obtain historical cell-site location information from a cellphone provider. Carpenter recognized that long-term phone-location records can reveal a detailed picture of a person’s movements.
The Court has not directly resolved the newer question raised by commercial data tools: if the government would need a warrant to compel certain location data from a phone company, can it buy similar data from the commercial market without one?
That is the data-broker loophole.
The loophole does not depend on a police officer physically following someone. It does not require a search team at a house. It does not begin with a person being stopped on the street.
It may begin with a contract, a login and a query.
That is why the legal process matters.
A warrant says: Judge, we have probable cause. Please authorize a specific search.
A vendor contract says: We purchased access.
Those two pathways should not be treated as if they provide the same protection.
The ATF/Webloc story also shows why this is not merely an academic privacy debate. AP reported that one case involved suspected arson at a facility belonging to a U.S. defense contractor. According to lawmakers, both a prosecutor and a judge raised concerns about the use of Webloc ad-tech data, and ATF ultimately had to seek a more traditional court order for bulk cellphone tower data from carriers. (AP News)
That detail matters because the problem moved from theory into court practice.
If prosecutors and judges are uncomfortable with how a location tool was used or sourced, the issue is not only public relations. It can affect investigations, discovery, evidence and the integrity of criminal cases.
Good police work needs lawful tools.
A case built with evidence that courts cannot trust is weaker, not stronger.
That is why the debate should not be framed as public safety versus privacy in the simplest sense. ATF investigates serious crimes involving firearms, explosives, arson and violent offenders. Those investigations matter. Communities have a legitimate interest in solving violent crimes and preventing harm.
But serious crimes do not erase the need for rules.
The question is not whether law enforcement can ever use commercial data. The question is what legal standard should apply when the government buys access to sensitive location information that can reveal where people go, what they do and who they may be connected to.
Location data is different from ordinary business records.
It can reveal home and work patterns. It can show visits to churches, clinics, shelters, addiction treatment centers, gun stores, political events, schools, lawyers’ offices and private homes. It can show not only where a device was, but the rhythm of a person’s life.
That is why lawmakers objected.
Wyden called ATF’s cancellation “a victory for Americans’ constitutional rights” and said the government’s purchase of Americans’ location data from data brokers is an “end-run around the Fourth Amendment.” Wyden and Cloud said ATF had used Webloc for 341 total searches and said the agency committed to reviewing contracts for illegal location data. (Ron Wyden)
Cloud, a Republican, and Wyden, a Democrat, approaching the issue together matters. The constitutional concern does not fit neatly into one party’s talking points. It is about whether government power can reach sensitive private information through the market instead of the courts.
That should concern conservatives who worry about federal power.
It should concern liberals who worry about surveillance.
It should concern anyone who believes constitutional rights should not depend on how the government obtains the invoice.
ATF’s cancellation does not prove the agency committed a crime. It does not prove every Webloc search was unconstitutional. It does not prove the data was always precise enough to identify a person. It does not prove Penlink acted unlawfully in every use. It does not mean law enforcement can never use commercial data under any circumstances.
The documented claim is narrower and stronger: ATF used a vendor tool that allowed warrantless searches of commercial location data. After bipartisan lawmakers raised legal and privacy concerns, the agency canceled the contract.
That is enough to raise the larger question.
Why should a person’s location trail receive stronger protection when the government compels it from a phone company than when the government buys access to it from a brokered data market?
If the same general movement trail is involved, the constitutional concern does not disappear because the source changed.
This is where the ATF story connects to the larger digital-policing debate. In geofence warrant cases, law enforcement goes to court and asks a judge to authorize a search of location data held by a company. That process raises hard questions about probable cause, particularity and how many innocent people may be swept into the search.
In the Webloc story, the pathway is different. The government did not begin by asking a judge for Google Location History. It purchased access to commercially collected location data from a vendor.
That is why this story belongs in a series about searchable life.
Americans are not tracked only by government warrants. They are tracked by private apps, advertising networks, data brokers and vendor platforms. Government may arrive later as one customer in a market that already turned movement into a product.
The public may assume phone-location data is protected because police generally need a warrant for certain cellphone records. But if similar movement information can be purchased from a commercial vendor, the practical protection may be much weaker.
The ATF contract is canceled.
The market is not.
AP reported that other law enforcement agencies, including the FBI and the Department of Homeland Security, continue to buy commercial geolocation data. AP also reported that a bipartisan group of lawmakers has introduced legislation that would ban the government from buying data without a judicial order. (AP News)
That means the Webloc story is not over. It has simply moved to the next question.
Will Congress close the loophole?
Will courts treat purchased commercial location data like compelled location data when it reveals the same kind of private movement?
Will agencies audit prior searches and disclose when such tools were used in criminal cases?
Will vendors be required to show how data was collected, whether users meaningfully consented and whether searches are logged and reviewable?
Those are not technical details.
They are constitutional government questions.
A free country can give law enforcement tools to solve serious crimes. But it should not allow the government to avoid the warrant question by shopping in the data market.
The Fourth Amendment should not turn on the billing method.
If the government needs a warrant to compel a person’s movement history, it should not be able to avoid that question by buying a similar trail from the commercial surveillance market.
I am a retired detective and criminal justice / government educator based in Tennessee. I am a commentary write for Tennessee Lookout and a weekly columnist with Knox TN Today. My work examines public policy, public safety systems and civic responsibility. My reporting and commentary have also appeared in Governing, The Arizona Capitol Times, South Florida Sun Sentinel, Police1, among other state and regional outlets.
 | A guest post by
|
 | A guest post by
|