When law enforcement seeks user data from a communication service provider such as Google or AT&T, it must apply for a court order or warrant under Electronic Communications Privacy Act (ECPA). The Stored Communications Act (SCA), Part II of ECPA, specifically governs law enforcement access to stored electronic communications held by service providers and establishes a privacy “floor” that states have strengthened through their own statutes. However, since the SCA and corresponding state statutes only apply to service providers, law enforcement has found a legal loophole to collect data without judicial authorization: purchasing data from third-party data brokers. These brokers obtain data from service providers and others that are not subject to the SCA.
The result is a surveillance backdoor that strikes at the heart of the Fourth Amendment. Rather than demonstrating probable cause to obtain a warrant, government agencies are spending millions of dollars in contracts with data brokers to buy their way around the court approval process, acquiring the same sensitive information through commercial channels without judicial sign off. The purchase of location data, web browsing history, financial transactions, and other sensitive records allow the government to paint a meticulous picture of a person’s life. These purchases occur in bulk, and without showing any wrongdoing. This circumvents the constitutional protections of millions of people, leaving them vulnerable to improper government snooping and misuse of the intimate details of their lives.
Fortunately, there are growing legislative efforts to close the data broker loophole. On the federal level, the Fourth Amendment Is Not for Sale Act (HR 4639) would extend the legal process under SCA to third-party data brokers, which would require uniform state compliance. The bill passed the House in a bipartisan vote in 2024 but has stalled in the Senate, leaving states to pioneer their own protections in the interim. Colorado and Rhode Island drew directly from the federal bill (HB 1037 and H8119 respectively), adopting the same title and similar requirements, though neither have yet been enacted into law. In 2025, Montana became the first state to pass a law requiring a warrant or subpoena to acquire data from brokers (SB 282). While SB 282 is important, its protections could be augmented by providing a private right of action and restricting cross-agency information sharing. Below, CDT outlines reforms state legislators could enact to close the data broker loophole.
Require a Warrant
States could close the data broker loophole by requiring law enforcement to obtain the same legal process with judicial approval for sensitive data, regardless of whether it is obtained from a communications service provider or a third party data broker.
- Why It Helps: Applying the same legal treatment to communication service providers and third parties preserves the vital protections of independent judicial review in our modern digital ecosystem. Requiring a warrant for electronic communications and other sensitive data ensures that individuals’ information is legally protected no matter who holds it.
- How it Accounts for Public Safety Needs: Setting a warrant requirement to obtain data from brokers permits law enforcement to access any type of information it needs when there is strong evidence of crime. It extends consistent rules for court approval that police have always followed to acquire sensitive private records.
Policy Mechanics
Clarify Data Types Subject to Warrant Requirement
Shifting the regulatory focus from what type of entity data-holders are to what types of sensitive data are being sought is a better model for the digital age. It provides a stronger, consistent standard that effectively protects individuals from overbroad or improper snooping. States do not define consistently the data subject to warrant requirements. Montana’s law outlines an ad-hoc list of data types including precise geolocation and subscriber lists. In contrast, the Rhode Island and Colorado bills use the umbrella term of “personal data” to regulate “information collected from or generated by a specific person as a part of a consumer transaction or the use of a consumer product or service, whether the information was collected by the original third party or obtained by a different third party, that is connected or reasonably connected to the specific person or the specific person’s electronic device.” This definition comprehensively covers the data included in Montana’s law as well as search history and individual inference data from third parties. Under the Montana law, an investigative subpoena may be issued based on a prosecutor’s affidavit asserting that the subpoena is necessary for the administration of justice. This lower standard provides weaker protections for individuals’ private information than does a warrant.
Outline Exceptions to Warrant Requirements
Exceptions ensure that there is flexibility within the law where needed. The Montana, Colorado and Rhode Island legislation, for example, all allow law enforcement to acquire information without a warrant when the individual gives case-specific express consent and in cases of emergency. Efforts to advance public safety should always be balanced with protecting individuals’ rights.
Potential Enforcement Approaches
Restrict Admissibility of Evidence
Data collected in violation of statutory requirements should be inadmissible evidence in any court proceeding. Without consequences for unlawful data acquisition, law enforcement has little incentive to comply, and people bear the risk that illegally obtained information could be used against them. Montana’s law bars the use of unlawfully obtained data in any civil, criminal, or administrative proceeding and prohibits its use in affidavits. This provides stronger protections than the Colorado bill, which provides a waiver option to override this exclusionary rule. Legislators may also consider affirmative disclosure obligations on how evidence is obtained and limit parallel construction workarounds where police recreate the discovery of evidence that was originally obtained unlawfully.
Grant Private Right of Action
A private right of action — whereby persons who suffer a statutory injury have the ability to seek redress through civil lawsuit — is an important enforcement mechanism that empowers individuals to proactively protect their rights and punish violators. Montana’s law omits this; the Colorado and Rhode Island legislation grant injured individuals the right to injunctive relief, declaratory relief, or other relief deemed necessary to enforce the act.
Limit Intergovernmental Data-sharing
While information-sharing across agencies can be useful, it also increases access to personal data beyond the scope of investigation and complicates control. The Federal bill as well as Colorado and Rhode Island’s legislation restrict the exchange and sale of third-party data across federal, state, and local agencies.
For more info on CDT’s efforts to close the data broker loophole, visit cdt.org/area-of-focus/government-surveillance/ or email the State Engagement team at [email protected].
Facts Only
The Electronic Communications Privacy Act (ECPA) and Stored Communications Act (SCA) regulate law enforcement access to data from communication service providers.
Government agencies purchase data from third-party data brokers to acquire information without judicial authorization.
Purchased data includes location data, web browsing history, and financial transactions.
The Fourth Amendment Is Not for Sale Act (HR 4639) passed the House in 2024 but has not passed the Senate.
Colorado and Rhode Island introduced bills (HB 1037 and H8119) based on the federal legislation.
Montana passed SB 282 in 2025, requiring a warrant or subpoena for data from brokers.
Montana's law bars unlawfully obtained data from civil, criminal, or administrative proceedings.
Colorado and Rhode Island bills provide for injunctive and declaratory relief for injured individuals.
Federal, Colorado, and Rhode Island legislation restrict the exchange of third-party data across agencies.
All mentioned legislation (Montana, Colorado, Rhode Island) includes exceptions for emergency cases and express consent.
Executive Summary
Law enforcement agencies are utilizing a legal gap to bypass the Fourth Amendment's warrant requirements by purchasing sensitive personal data from third-party brokers rather than requesting it from service providers under the Stored Communications Act. This practice allows the government to acquire detailed records of individuals' lives—including geolocation and financial history—without demonstrating probable cause.
Legislative efforts to close this loophole are currently fragmented. While the federal Fourth Amendment Is Not for Sale Act has stalled in the Senate, states are implementing their own protections. Montana recently became the first state to mandate a warrant or subpoena for such data, though critics suggest its protections are limited by the use of investigative subpoenas and a lack of private right of action. In contrast, pending legislation in Colorado and Rhode Island proposes broader definitions of "personal data" and provides stronger civil remedies. The central tension remains the balance between ensuring public safety and preserving judicial oversight in a digital ecosystem where personal information is commodified.
Full Take
The strongest version of this narrative is that the commodification of personal data has created a "market-rate" bypass for constitutional protections, effectively allowing the government to outsource surveillance to private entities to avoid judicial scrutiny.
The argument relies on a framing of a "surveillance backdoor," utilizing an Emotional Exploitation pattern to characterize commercial transactions as a systemic strike at the heart of the Fourth Amendment. By positioning the issue as a choice between "judicial sign-off" and "improper government snooping," the narrative creates a moral imperative for specific legislative remedies.
Patterns detected: ARC-0014 Emotional Exploitation
The root cause is a lag between 20th-century legal frameworks (ECPA/SCA) and a 21st-century data economy. The unstated assumption is that the "third-party doctrine"—the legal idea that individuals lose a reasonable expectation of privacy when they voluntarily share data with a third party—is no longer ethically or practically valid in an era of ubiquitous digital footprints.
The implications center on the erosion of human agency; when the state can purchase a "meticulous picture" of a life without suspicion of wrongdoing, the presumption of innocence is functionally replaced by a state of permanent visibility. The primary beneficiaries are data brokers who monetize this gap and agencies seeking frictionless intelligence.
Bridge Questions:
Does the ability to purchase data from a broker constitute a "search" under the Fourth Amendment if the data was legally sold by a private party?
If the "third-party doctrine" is discarded, how does that affect the legality of other commercial data exchanges not involving the government?
What objective metrics would determine if "emergency exceptions" are being abused to circumvent the spirit of these new laws?
Counterstrike Scan: A bad actor would push this narrative by exaggerating the scale of "bulk purchases" to create a sense of imminent peril, urging the immediate passage of specific bills without discussing the potential impact on legitimate criminal investigations. The content here avoids this by discussing specific legislative mechanics and providing a balanced look at various state approaches.
Clean.