Part 1 of 12 in the "Who Sold My Data?" Series
Let me tell you about the Fourth Amendment.
It's the one that says the government can't search your stuff without a warrant. You know—probable cause, signed by a judge, the whole "papers and effects" thing they taught you in high school civics before everyone forgot about it.
In 2018, the Supreme Court made it crystal clear: police need a warrant to track your location through your cell phone. The case was Carpenter v. United States, and the Court said your phone reveals "the privacies of life"—where you worship, who you sleep with, what doctors you see, which protests you attend.
That ruling should have meant something.
Instead, here's what happened next: Government agencies pulled out their credit cards and started buying the same data from private companies. No warrant. No judge. No oversight. Just a purchase order.
The Defense Intelligence Agency was refreshingly honest about it. In a 2021 memo, they admitted they purchase "commercially available geolocation metadata aggregated from smartphones" and explicitly stated that they "do not construe the Carpenter decision to require a judicial warrant endorsing purchase or use of commercially available data."
Translation: We know what the Supreme Court said. We just don't care.
Welcome to the data broker industry. Population: ~5,000 companies you've never heard of, collectively worth $278 billion, who have found a way to turn your constitutional rights into a product.
And business is booming.
The Loophole That Ate the Bill of Rights
Here's how it works.
Every time you use an app, visit a website, drive your car, walk past a Bluetooth beacon, or simply exist with a phone in your pocket, you generate data. Location data. Behavioral data. Health data. Shopping data. Search data.
This data gets collected by apps, sold to aggregators, packaged by data brokers, and put on the open market for anyone with a credit card.
Anyone.
Anti-abortion groups have bought location data showing who visited Planned Parenthood clinics—across 600 locations in 48 states—and used it to target those people with ads. A Wisconsin-based group used geofenced data to send messages to people while they were sitting in the waiting room.
Using a tool called Locate X, privacy researchers traced a single phone as it left a home in Alabama, drove past a gas station, stopped at a church, crossed into Florida, spent two hours at an abortion clinic, and returned home. The tool showed the person's likely home address based on where the phone spent its nights.
That week's worth of data cost $160.
Your entire pattern of life. Your home. Your church. Your healthcare decisions. For the price of a nice dinner.
And the government? They're not just aware this market exists. They're customers.
The Agencies Shopping for Your Rights
A partial list of federal agencies that have purchased location data without warrants:
- FBI — renegotiated their data broker contract around the time of the Black Lives Matter protests
- IRS — because apparently auditing your taxes requires knowing where you pray
- DEA — paid employees at private companies to search packages and hand over travel records
- Secret Service — bought location data to track devices
- NSA — purchases internet metadata
- Defense Intelligence Agency — admitted to searching Americans' movement histories at least five times
- Immigration and Customs Enforcement (ICE) — bought data to track immigrants
- Customs and Border Protection (CBP) — uses commercial location data "to detect the presence of individuals" between ports of entry
- CDC — paid $420,000 for cellphone data to monitor COVID-19 lockdown compliance
That last one should make you pause. A public health agency. Tracking your compliance. Through purchased phone data.
There's a bipartisan bill called the "Fourth Amendment Is Not For Sale Act" that would close this loophole. It's been introduced multiple times. It keeps dying. Because the government likes this loophole. It's convenient. It's cheap. And until you start paying attention, there's no political cost to keeping it open.
They're Watching What's Supposed to Be Protected
The FTC has now had to explicitly ban certain data brokers from selling location data tied to specific types of places. Take a moment to consider why they had to make this list:
- Places of worship — churches, mosques, synagogues
- Reproductive healthcare facilities — abortion clinics, fertility centers
- LGBTQ+ locations — bars, community centers, service organizations
- Political protests and demonstrations
- Labor union offices
- Domestic abuse shelters
- Military installations
They had to ban this because it was happening.
A search for devices that visited a synagogue in Los Angeles returned nearly 9,000 phones. A search for the Islamic Center of America in Dearborn, Michigan, returned 8,840 devices and nearly 100,000 signals over two years. The same tool showed where those phones traveled afterward—across the United States, into Canada, to Lebanon, Jordan, and Iraq.
A prayer app called Muslim Pro—downloaded over 98 million times—was selling user location data to a company called X-Mode, which sold it to military contractors. Another app, Salaat First, fed data to a French firm linked to government contractors working with the FBI, ICE, and Customs and Border Protection.
The U.S. military knows when you pray. That's not a metaphor.
You're Worth $700 a Year. You See $0.
Let's talk about money, because that's what this is really about.
The data broker industry is worth $278 billion globally. It's projected to hit $512 billion by 2033. That growth is built on one product: you.
Google and Facebook alone extract roughly $700 per year from the average American user. That's the value of your attention, your clicks, your searches, your messages, your location, your relationships, your purchases, your vulnerabilities.
You generate that value. You see none of it.
Instead, you see:
- Scam ads (Meta delivers 15 billion per day and makes $16 billion annually from "higher-risk" advertisers)
- Insurance rate hikes (your car sold your driving data for 26 cents; your premiums went up 24%)
- Targeted manipulation (pregnancy data is worth 200x more than basic demographics to advertisers)
- And the quiet erosion of rights you thought you had
The industry has created profiles with names like "Financially Challenged," "Probably Diabetic," and "Gullible Elderly." These aren't jokes. These are real marketing segments, designed to identify people at their most vulnerable and sell access to them.
The Cold Math
Let me give you some numbers to sit with:
What your data sells for:
- Honda sold driving data from 97,000 cars for $25,920 total — 26 cents per car
- Hyundai: $1 million for 1.7 million cars — 61 cents per car
- A week of Planned Parenthood visitor data: $160
What it costs you:
- Car insurance rates increased 24% in 2023
- 72% of elder fraud is enabled by data broker profiles
- $4.9 billion lost to elder fraud in 2023—up 43% from the year before
What companies pay when caught:
- BetterHelp fine for sharing mental health data with Facebook: $7.8 million
- Amazon fine for keeping kids' voice recordings forever: $25 million
- 23andMe's entire customer DNA database: sold in bankruptcy
What would change things:
- One federal privacy law that actually has teeth
- One Supreme Court ruling that closes the purchase loophole
- One mass awakening of people who realize they're the product
Why This Series Exists
Over the next 11 weeks, we're going to take you through every corner of this industry. Not to scare you—though you should be scared—but to arm you.
We're going to show you:
- How social media platforms conduct "vast surveillance" and what the FTC found when they actually looked (it's in a 129-page report and it's damning)
- How Meta makes $16 billion from scam ads and budgets $1 billion for fines because getting caught is just a line item
- How your TV takes 48,000 screenshots per second and makes more money from watching you than from selling you the TV
- How your car sold your driving data for pocket change while your insurance company raised your rates
- How mental health apps shared your darkest moments with advertisers despite promising confidentiality
- How period trackers told Facebook you were pregnant before you told anyone else
- How 23andMe went bankrupt and took your DNA to auction
- How prayer apps tracked 98 million people to military contractors
- How Alexa kept your kids' voices forever—even after you pressed delete
- How your grocery store makes $1 billion from your shopping list while you clip coupons
And then we're going to tell you what to do about it.
What You Can Do Right Now
You're not powerless. You're just uninformed. That changes today.
Immediate steps:
Check your phone's advertising ID. On iPhone: Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track." On Android: Settings → Privacy → Ads → Delete advertising ID.
Audit your app permissions. Any app with location access can sell that data. Be ruthless. Does your flashlight app need to know where you are?
Opt out of data brokers. Yes, it's tedious. Yes, it works. Start with the big ones: Acxiom, Epsilon, Oracle, LexisNexis. We'll give you the full list in the final article.
Use tools that protect you. There are apps—like ZoraSafe—built specifically to tell you where your data is going, which apps are leaking, and what permissions you've granted that you probably shouldn't have. Full disclosure: that's us. We built it because this problem made us angry.
Demand better. Call your representatives. Support the Fourth Amendment Is Not For Sale Act. Make this a voting issue. The only reason this loophole exists is because not enough people are paying attention.
The Bottom Line
Here's what I need you to understand:
The data broker industry has effectively privatized mass surveillance. What the government cannot legally do to you, it can now buy. What the Constitution forbids, the market provides.
Your location. Your health. Your beliefs. Your vulnerabilities. Your children's voices. Your unborn child. Your prayers.
All of it is for sale.
The industry is counting on you not caring. They're counting on the terms of service being too long, the settings being too buried, the problem being too abstract.
Don't give them that.
Your rights are not supposed to have a price tag. But right now, they do.
And it's insultingly low.
Next week: "The FTC Used the Word 'Staggering' and They Weren't Talking About Your Screen Time" — Inside the 129-page report that confirms your paranoia was justified.
About the Author: Cat Karow is the CEO of ZoraSafe and has spent 20+ years in cybersecurity watching this problem get worse. She got tired of waiting for someone else to fix it.
The Shield Blog publishes weekly investigations into the companies profiting from your data and the practical steps you can take to fight back. Subscribe to get each article in your inbox.
Sources and citations for all statistics are available upon request. This article references FTC enforcement actions, federal court filings, Congressional testimony, the Carpenter v. United States Supreme Court decision, declassified ODNI reports, and investigative journalism from Vice Motherboard, 404 Media, The Markup, Reuters, and the Electronic Frontier Foundation.
