The Same System That Targets You With Ads Is Helping the Government Track You

Two Surveillance Machines, One Pipeline

Every time you open an app or visit a website, a silent auction takes place in milliseconds. Advertisers bid against one another to show you an ad, and to do so they receive a packet of data about you: your location, your device identifiers, your browsing history, and more. That process, known as real time bidding, is the engine behind targeted advertising. It is also, according to the Electronic Frontier Foundation, a surveillance infrastructure that the federal government is actively exploiting.

EFF Staff Attorney Lena Cohen has documented how law enforcement agencies, including Customs and Border Protection, are tapping into this commercial data ecosystem to track the movements and activities of people inside the United States. The government is not building its own surveillance network. It is buying access to one that advertisers already built.

How Ad Tech Surveillance Works

The real time bidding ecosystem was designed to connect advertisers with audiences. In practice, it creates a continuous record of where people go and what they do. Each bid request sent during an ad auction can contain precise GPS coordinates, a unique device identifier, the name of the app being used, and a timestamp. Hundreds of these requests can be generated for a single person in a single day.

Data brokers sit downstream of this process. They collect, aggregate, and resell the location signals and behavioral profiles generated by ad auctions. Over time, the resulting datasets can reveal patterns that no single data point would suggest on its own: regular visits to a medical clinic, attendance at a religious institution, participation in a political rally, or the address where someone sleeps at night. The EFF notes that this kind of aggregated data exposes "intimate details about people's lives" in ways that would have been impossible to compile through traditional means just a decade ago.

This is the data that advertisers use to target you. It is also the data that federal agencies are now purchasing.

How the Government Gets In

Customs and Border Protection has been among the most active federal agencies in purchasing commercially available location data. Rather than issuing subpoenas or seeking court orders, CBP and other agencies simply buy access to the same datasets that are sold to marketers. From the perspective of the data broker, the transaction looks no different than selling to an insurance company or a retail chain.

Cohen explains that this arrangement allows agencies to build a detailed picture of a person's movements and associations without ever approaching a judge. The data arrives pre packaged, often covering months or years of location history, and it can be queried to identify everyone who visited a particular location during a particular time window. The legal predicate for accessing it is nothing more than a purchase order.

CBP is not alone. Multiple federal agencies have maintained contracts with data brokers that specialize in aggregating ad tech signals. The market for this kind of data has grown alongside the advertising industry itself, creating a parallel economy in which personal information flows from smartphones to ad servers to government databases with no point at which a warrant is required.

The Fourth Amendment End Run

The constitutional problem at the center of this practice is the third party doctrine: the legal principle that information shared with a third party loses its Fourth Amendment protection. When you share your location with an app, the government has long argued, you have voluntarily surrendered any expectation of privacy in that data.

The Supreme Court complicated that argument in its 2018 decision in Carpenter v. United States, ruling that the government needs a warrant to access cell phone location records from carriers. But data brokers are not carriers, and their customers rarely give meaningful consent to government access when they click through an app's terms of service. Agencies have exploited this gap by routing their surveillance through commercial purchases rather than legal process.

The EFF argues that the scale and intimacy of ad tech data should bring it within the scope of Carpenter's protections regardless of how it was collected. Buying what you would otherwise need a warrant to compel is, in the EFF's view, a constitutional violation dressed up as a procurement decision. The government has so far disagreed, and courts have not yet settled the question.

The Government Surveillance Reform Act

Senators Mike Lee and Ron Wyden have introduced the Government Surveillance Reform Act, a bill that would directly address the loophole agencies are exploiting. Among its provisions, the legislation would prohibit the federal government from purchasing Americans' private data from commercial brokers and would require the FBI to obtain a warrant before querying intelligence databases for information about people in the United States.

The bill represents one of the most comprehensive attempts in recent years to close the gap between Fourth Amendment doctrine and modern surveillance practice. Its sponsors argue that the government should not be able to buy its way around constitutional protections that courts would otherwise enforce.

The legislation has not yet passed. Similar proposals, including the Fourth Amendment Is Not For Sale Act, have stalled in previous congressional sessions despite bipartisan support. Meanwhile, the commercial data market continues to expand, and the government's access to it grows with it.

What This Means for Ordinary People

Most people accept some degree of data collection as the price of free apps and personalized services. Few realize that the same transaction also grants federal law enforcement a potential window into their lives. The ad tech ecosystem was not designed with civil liberties in mind, and its data flows were not engineered to stop at the boundary between commercial and government use.

The practical implications are significant. A person who attended a protest, visited a legal services clinic, or sought medical care at a reproductive health facility may have generated location signals that a data broker collected and that a government agency could now purchase. None of those activities required a warrant to track. None of them generated an alert at the time. The record simply accumulated in the background, invisible and persistent.

The surveillance infrastructure continues to expand. The USDA recently awarded Palantir a no-bid contract to monitor federal workers' return to office compliance, potentially bringing bossware surveillance technology to the federal workforce. Until Congress acts, the only structural defense available to individuals is limiting the data that enters the pipeline. That means scrutinizing app permissions, disabling advertising identifiers on mobile devices, using privacy preserving browsers, and being deliberate about which services receive location access. The ad tech surveillance machine runs on data that devices broadcast voluntarily. Reducing that broadcast is the most direct response available to people who did not consent to becoming subjects of government surveillance when they downloaded a weather app.