Commercial Data Brokers & Location Intelligence
How commercial companies collect, aggregate, infer, license, and sell information generated by phones, applications, vehicles, websites, public records, transactions, and other connected systems—and what law enforcement should understand about precise location data, device identifiers, identity resolution, sensitive locations, data provenance, accuracy, Carpenter, privacy, procurement, retention, auditing, and governance.
What this explainer does
Data brokers and commercial intelligence services can give investigators access to information that historically would have required numerous separate investigative steps.
Commercial datasets can include identity information, public records, addresses, telephone numbers, email addresses, vehicles, property information, internet activity, demographic information, commercial transactions, device identifiers, and location-related data.
The investigative value can be substantial. So can the risk. The fact that information is available for purchase does not establish that every source was lawfully obtained, every consumer consented, every inference is accurate, or every governmental use is constitutionally permissible.
Where did the data originate?
How was it collected?
What does it actually represent?
How was it linked to a person or device?
What authority permits the government's use?
1. Overview
Modern commercial markets can turn thousands of small digital observations into a detailed profile of a person, device, household, organization, or location.
Individual pieces of information may come from applications, websites, public records, commercial transactions, mobile advertising systems, connected vehicles, or other sources.
Data brokers can purchase, receive, combine, clean, correlate, score, categorize, and resell those records. A customer may then search or analyze a dataset without dealing directly with the companies or applications that originally generated the information.
2. What Is Commercially Available Information?
Commercially Available Information—often shortened to CAI—is a broad concept covering information that is available for purchase, license, subscription, or other commercial access.
CAI should not be treated as synonymous with publicly available information.
Some commercially available datasets incorporate public records. Others can include information generated through nonpublic commercial interactions, applications, devices, advertising systems, or other data supply chains.
3. What Does a Data Broker Do?
A data broker commonly obtains information from multiple sources and makes resulting data or analytical products available to others.
Obtain information from commercial, public, licensed, or other sources.
Combine records originating from different systems.
Standardize formats so disparate datasets can be searched or compared.
Add identifiers, categories, public records, or other contextual information.
Attempt to connect devices, accounts, addresses, or other identifiers to people.
Provide access through datasets, platforms, reports, APIs, subscriptions, or other products.
4. Where Commercial Data Can Come From
Apps can generate location, device, advertising, usage, and account information.
Mobile and online advertising systems can generate identifiers, events, and location-related information.
Property, corporate, court, licensing, and other government records may be aggregated.
Purchases, subscriptions, registrations, and other transactions can create data.
Browsing, advertising, tracking, and online interactions can create commercial records.
Vehicles, appliances, wearables, and other networked systems can generate information.
A broker may purchase data from another broker, making the supply chain several layers deep.
Businesses may license customer, transaction, identity, or risk-related information.
Some products consist not simply of source records, but classifications or predictions derived from them.
5. Typical Commercial Data Pipeline
6. Commercial Location Data
Location is among the most sensitive categories of commercially available information because repeated observations can reveal movement and patterns of life.
Some commercial location datasets originate from mobile applications or advertising-related systems that receive latitude and longitude information from a device.
Records may permit retrospective analysis of where a device appeared over time.
Some products can identify devices observed within defined geographic areas.
Multiple observations may reveal travel between locations.
7. Device and Advertising Identifiers
Commercial datasets frequently use identifiers rather than names as the initial way to distinguish devices or users.
These identifiers may be generated by operating systems, applications, advertising platforms, cookies, accounts, or commercial identity systems.
8. Identity Resolution
Identity resolution is the process of linking otherwise separate records or identifiers to a person, household, device, account, address, or organization.
Repeated nighttime or residential location patterns may be used to infer a likely home.
Public and commercial records can associate names with the inferred residence.
Other data may connect an account or identifier to a particular device.
9. Commercial Geofencing
Some commercial products allow users to define a geographic boundary and identify devices represented as appearing within that area.
This resembles reverse-location investigation conceptually, but commercial datasets may originate from a very different technical and legal ecosystem than provider geofence-warrant data.
10. Patterns of Life and Movement Analysis
A single location point may reveal little. Hundreds or thousands of points can reveal far more.
Repeated overnight presence can suggest a likely residential location.
Repeated daytime patterns may suggest employment or another regular destination.
Repeated co-location can suggest association, although it does not necessarily prove personal contact.
Sequential observations can reveal movement across a city, state, or larger area.
Regular patterns can reveal recurring behavior.
Location history may expose medical, religious, political, legal, or intimate activity.
11. Sensitive Locations
Precise location information becomes especially sensitive when it can reveal visits to places associated with protected, intimate, medical, religious, political, or vulnerable activity.
FTC enforcement actions have specifically addressed commercial data capable of revealing visits to categories such as medical facilities, religious organizations, correctional facilities, labor-union offices, schools, shelters, and military installations.
12. Commercial Does Not Mean Accurate
Commercial datasets can contain errors at multiple stages.
Original device or application location may be inaccurate.
Time-zone handling, processing, or vendor transformation can affect chronology.
Device-to-person or address-to-person linkage may be wrong.
Addresses, telephone numbers, ownership, and account relationships change over time.
Records from different people or devices can be incorrectly merged.
Classification or prediction may be wrong even when underlying source data is correct.
13. Data Provenance
Provenance is the history of where information came from and what happened to it before it reached the investigator.
14. Raw Data and Derived Inferences Must Be Separated
| Data | Possible Inference | Why the Difference Matters |
|---|---|---|
| Repeated device coordinates overnight | Likely home | Residence is an analytical conclusion, not necessarily directly reported by the device. |
| Device visits one business repeatedly | Employee or customer | Multiple explanations may fit the same location pattern. |
| Two devices appear near each other | People are associates | Co-location does not automatically establish a personal relationship. |
| Device appears at a medical facility | User has a medical condition | Location does not establish why the person was present. |
| Identifier linked to an address | Named resident is device user | Household attribution is not necessarily individual attribution. |
15. Commercial Location Data Compared with Other Technologies
| Technology | Source | Typical Search Model |
|---|---|---|
| Commercial Location Data | Broker or commercial dataset assembled from one or more sources | Device, person, location, historical movement, or analytical search |
| Historical CSLI | Wireless carrier | Known device → historical tower records |
| Tower Dump | Wireless carrier | Tower / time → devices |
| Geofence Warrant | Provider location-history database | Geography / time → responsive device identifiers |
| ALPR | Camera network | Plate / vehicle → detections and movement |
| Cell-Site Simulator | Government-operated radio technology | Locate or identify cellular device |
16. The Fourth Amendment
The constitutional treatment of commercially purchased data is not resolved by one comprehensive Supreme Court rule.
Traditional Fourth Amendment doctrine has often treated information knowingly exposed to the public differently from private information. Traditional third-party doctrine also reduced protection for some information conveyed to businesses.
But modern commercial datasets can contain information that was never meaningfully exposed to the general public and can reveal patterns far beyond what any individual observer could practically obtain.
17. Carpenter and the Commercial-Data Question
In Carpenter v. United States, the Supreme Court held that government acquisition of the extended historical CSLI at issue constituted a Fourth Amendment search.
The Court declined to apply traditional third-party doctrine mechanically simply because the location information was possessed by a wireless carrier.
Carpenter involved compelled carrier records, not a government subscription to a commercial data broker.
18. Does Purchasing the Data Avoid a Warrant Requirement?
There is no simple nationwide rule that every piece of commercially available information may always be purchased and searched by police without legal process.
Nor is every commercial database automatically protected by the Fourth Amendment.
The answer can depend on what information is being purchased, how it was originally generated, its sensitivity, how comprehensive it is, whether the person meaningfully exposed it, and controlling federal or state law.
19. First Amendment Risks
Commercial location and identity data can reveal attendance at demonstrations, religious services, political meetings, union offices, advocacy organizations, media organizations, and other protected activity.
20. FTC Enforcement Has Changed the Data-Broker Landscape
Recent Federal Trade Commission actions demonstrate that commercial availability does not establish that the underlying collection or sale is lawful or appropriately consented to.
FTC action challenged sale and sharing of sensitive precise location information.
FTC challenged collection and sale of precise location information without adequate informed consumer consent.
FTC action addressed sensitive location information, including data capable of revealing a private home.
FTC action addressed location datasets capable of identifying visits to sensitive sites.
FTC litigation challenged sale of precise location data capable of tracing individuals' movements.
Vendor availability is not a substitute for evaluating consent, sourcing, privacy, and lawful use.
21. The Intelligence Community's CAI Framework
The Office of the Director of National Intelligence has adopted a formal policy framework governing Intelligence Community access to and processing of commercially available information.
That policy does not govern ordinary state and local police agencies. But several of its safeguards provide a useful governance benchmark.
Access should serve a validated mission or authorized governmental function.
Make reasonable efforts to determine original sources and how information was generated and aggregated.
Evaluate integrity, quality, bias, and inference risk.
Apply safeguards tailored to the volume, nature, and sensitivity of information.
Establish handling, retention, destruction, and oversight requirements.
Record purpose, authority, source, volume, and mechanics of sensitive-data use.
22. Appropriate Operational Role
Commercial information can be valuable for developing, prioritizing, and corroborating investigative leads.
Find possible accounts, addresses, devices, vehicles, or relationships requiring investigation.
Identify possible sources of public or commercial information.
Compare commercial information with independently obtained evidence.
Information may help show that a device, address, or individual does not fit a hypothesis.
Commercial records may assist in reconstructing events when properly validated.
Leads may support later subpoenas, warrants, interviews, or other investigative steps.
23. Independent Verification
Verification should increase with the consequence of the decision.
24. Evidence and Authentication
A commercial intelligence platform may be excellent for investigation but difficult to explain in court if the agency cannot establish where the evidence came from.
Can the underlying record be preserved or exported?
Can the agency identify who originally generated the data?
What event does the timestamp represent?
What generated the location and what precision is claimed?
How was the device or record connected to the person?
What processing occurred between collection and the law-enforcement product?
25. Discovery and Disclosure
Commercial platforms can create discovery issues that are easy to overlook because investigators may treat them as search tools rather than evidence systems.
| Material | Potential Importance |
|---|---|
| Query | Shows what the investigator searched. |
| Search Parameters | Establishes geography, date, identifiers, filters, or other scope. |
| Original Result | Preserves what the commercial system actually returned. |
| Alternative Results | May reveal other devices, persons, or explanations. |
| Vendor Documentation | May explain data source, accuracy, terminology, and product limitations. |
| Audit Log | May demonstrate when, why, and by whom a search was conducted. |
| Analyst Work | Shows how vendor output became an investigative conclusion. |
26. Procurement Questions
| Issue | Agency Question |
|---|---|
| Original Source | What companies, devices, apps, or systems originally generate the data? |
| Supplier Chain | Does the vendor purchase information through intermediary brokers? |
| Consent | What permits the original collection and downstream sale or licensing? |
| Location Precision | How is location generated and what accuracy limitations apply? |
| Identity Resolution | How are anonymous or pseudonymous identifiers linked to people? |
| Sensitive Locations | What searches or categories are prohibited or restricted? |
| Data Age | How current is each category of information? |
| Error Correction | How does the vendor identify and correct inaccurate records? |
| Audit Logs | Does the system record searches, users, exports, and administrative actions? |
| Data Export | Can the agency preserve the exact result relied upon? |
| Regulatory History | Has the vendor, parent, or source provider been subject to privacy or data-protection enforcement? |
| Subcontractors | Who else receives, stores, processes, or supplies the data? |
| Government Data | Does the vendor retain agency searches or investigative information? |
| AI Training | Can agency queries or results be used to train vendor models? |
| Termination | What happens to agency information when the contract ends? |
27. Retention
A subscription platform can make it tempting to export large amounts of commercial data “just in case” they become useful later.
That practice can transform temporary access to a commercial service into a permanent local government dataset.
29. Auditing Is Essential
Commercial platforms capable of searching people, homes, devices, movements, or associations present obvious misuse risks if searches are not attributable to individual users.
Every search should be attributable to an authorized user.
Require case number, incident, intelligence purpose, or other mission justification.
Preserve meaningful information about what was searched.
Track downloads or exports of sensitive datasets.
Conduct periodic review for unusual, high-volume, or sensitive searches.
Define consequences for unauthorized personal, political, discriminatory, or non-mission searches.
30. Agency Governance Framework
Define legitimate investigative, intelligence, emergency, and administrative uses.
Determine whether particular commercial datasets require warrants or other legal protections.
Require reasonable understanding of original source and supply chain.
Evaluate what permits commercial collection and downstream disclosure.
Apply heightened controls to location, health, religion, politics, associations, and other sensitive categories.
Prohibit searches based solely on protected speech, religion, association, journalism, or viewpoint.
Treat vendor results as leads until sufficiently corroborated.
Require documentation and verification when anonymous identifiers are linked to named people.
Preserve searches, users, purposes, exports, and administrative activity.
Establish rules for results, evidence, intelligence, and uninvolved-person data.
Preserve search parameters, vendor output, methodology, and material necessary to evaluate conclusions.
Reassess vendors, datasets, legality, privacy, and value as the market changes.
31. Questions Every Agency Should Answer
32. Where Commercial Intelligence Is Going
Vehicles increasingly generate location, telemetry, account, and behavioral information.
Watches and health devices can create location and activity information.
Homes and businesses increasingly contain networked sensors capable of generating commercial data.
Machine learning can increasingly correlate fragmented identities across large datasets.
Commercial providers can move from reporting observed facts to predicting interests, behaviors, or relationships.
Commercial intelligence may increasingly move from retrospective datasets toward faster operational feeds.
33. Key Terms
34. Related ShieldPST.ai Resources
Carrier-generated location, Carpenter, reverse searching, warrants, and minimization.
Open explainer →Reverse location searches, provider databases, device identification, and particularity.
Open explainer →Commercial and government vehicle-location databases, networked searching, retention, and movement analysis.
Open explainer →Publicly available information, online investigations, verification, attribution, and governance.
Open explainer →Sensor and database integration, intelligence analysis, sharing, and privacy.
Open explainer →Return to the Shield Technology Reference Library.
Browse explainers →35. Selected Primary and Authoritative Sources
Current Intelligence Community policy framework governing access to, collection, processing, safeguarding, documentation, retention, and oversight of commercially available information and Sensitive CAI.
Review ODNI policy
Government report examining the scope, sources, uses, privacy implications, and legal issues associated with commercial data available to the Intelligence Community.
Review report
FTC enforcement litigation involving the sale of precise location information capable of tracing consumers' movements, with a settlement announced in May 2026.
Review FTC case
FTC enforcement action addressing commercial location information capable of identifying visits to sensitive locations, including health facilities, religious organizations, correctional facilities, labor-union offices, schools, shelters, and military installations.
Review FTC action
FTC action addressing aggregation and sale of sensitive location information and associated consumer-consent issues.
Review FTC order
FTC enforcement action addressing sharing and sale of sensitive location information.
Review FTC order
FTC action addressing precise location collection, consumer notice, consent, and sale or licensing of location-derived products.
Review FTC action
Foundational Supreme Court decision holding that government acquisition of the extended historical CSLI at issue constituted a Fourth Amendment search despite the information's possession by a third-party wireless carrier.
Read Supreme Court opinion
Current FTC enforcement library concerning consumer privacy, data security, data brokers, location information, and related commercial practices.
Review FTC enforcement resources
36. Key Takeaways
- Commercially Available Information is broader than information that a person intentionally made public.
- Data brokers can collect or obtain information from apps, advertising systems, public records, transactions, connected devices, other brokers, and numerous other sources.
- Commercial products often aggregate many small data points into substantially more revealing profiles.
- The vendor selling a product to police may be several steps removed from the entity that originally collected the information.
- Data provenance is therefore essential to responsible use.
- Commercial location information may permit historical movement, geofencing, pattern-of-life analysis, and identity resolution.
- Device location and human identity remain separate propositions.
- Identity-resolution systems may rely on inference and can be wrong.
- Commercial data can reveal visits to highly sensitive locations, including medical, religious, political, correctional, educational, and other facilities.
- Raw observations should be distinguished from vendor-created classifications and inferences.
- Commercial intelligence should ordinarily be treated as investigative lead information until sufficiently verified.
- Purchase from a private vendor does not by itself establish accuracy, lawful sourcing, adequate consumer consent, or constitutional permissibility.
- The Supreme Court has not created one comprehensive rule governing law-enforcement purchase of all commercially available data.
- Carpenter nevertheless establishes that sensitive digital location information does not automatically lose Fourth Amendment protection merely because a private business possesses it.
- Agencies should not assume that purchasing information from an intermediary necessarily avoids a warrant requirement that might apply to substantially equivalent information obtained directly from its original holder.
- State constitutions and statutes may provide protections beyond federal constitutional law.
- Commercial data capable of exposing First Amendment activity warrants heightened safeguards.
- FTC enforcement has demonstrated significant regulatory concern regarding the collection and sale of precise location information.
- Vendor due diligence should include sourcing, consent, supplier controls, accuracy, regulatory history, and sensitive-location protections.
- The Intelligence Community's CAI framework provides a useful governance benchmark emphasizing lawful purpose, provenance, quality, sensitivity, safeguards, auditing, retention, documentation, and oversight.
- Commercial platform searches should be auditable and attributable to individual authorized users.
- Searches should have a documented investigative or other authorized governmental purpose.
- Commercial information supporting consequential police action should be corroborated to the level required by the applicable legal standard.
- Query history, search parameters, original results, vendor documentation, and analyst work can become important evidence and discovery material.
- Agencies should avoid creating permanent local repositories of unrelated commercial information merely because exporting large datasets is technically easy.
- The next generation of commercial intelligence will increasingly combine devices, people, vehicles, locations, transactions, online behavior, and AI-generated inference.
- The ultimate governance question is not simply “Can we buy this information?”
- It is: “Should government use this information this way, under what authority, with what verification, and with what safeguards?”