Commercially Available Information: Fourth Amendment Obligations for Intelligence Agencies in the Private Marketplace

The Fourth Amendment protects all individuals in the jurisdiction of the United States from unlawful searches and seizures by the government. In most cases, information collected about individual citizens by government agencies is subject to various legal or statutory obligations or restrictions. Commercially available information (CAI) collected by data brokers, however, has complicated this framework. Private companies and data brokers collect and aggregate granular information and can provide valuable insight about an individual’s movements, activities, or associations (Ayoub and Goitein 2024). The United States Intelligence Community (USIC) can and has purchased this data through commercial marketplaces rather than collecting it directly, raising concerns around the applicability of traditional Fourth Amendment constraints (Office of the Director of National Intelligence 2022).

To the general public, CAI may often be thought of as cell tower pings or purchase histories, but that is an outmoded level of fidelity. When a customer or user opts into the terms and conditions laid out in smartphone apps like TikTok, Tinder, or even Google Maps, what they may be giving up is up-to-the-second metadata about their social and physical networks (Ayoub and Goitein 2024). The data can then be analyzed to identify close friends and/or family members through both physical proximity – through Bluetooth device ID, a shared wifi network, or geolocation data – or via metadata surrounding the frequency and method by which a user contacts another person. In an intelligence investigation, information of this quality is highly valuable (Oerlemans and Langenhuijzen 2024). The challenge is that information like this that the government wanted to collect on U.S. persons may be subject to significant legal or procedural restrictions. On the open market, however, private companies assume the burden of collection, allowing agencies to purchase directly without necessarily obtaining a warrant first (Sobel 2023). This presents a significant gap in the legal, procedural, and oversight burdens in direct collection versus the speed at which CAI can be purchased. To what degree does the USIC’s reliance on CAI challenge existing legal frameworks governing Fourth Amendment protections and IC-congressional oversight obligations? This paper will argue that while commercially available information has become an increasingly important intelligence capability, supporting national security objectives through capabilities like pattern-of-life analysis, its acquisition by the USIC raises privacy and constitutional concerns that oversight frameworks do not currently address. Greater congressional oversight and updated legislative safeguards, such as the Fourth Amendment Is Not For Sale Act, are necessary to balance intelligence effectiveness with the protection of Americans' civil liberties.

When used as intended, commercially available information serves legitimate business and governmental purposes. It allows businesses to send better targeted advertising, helps identify emerging business opportunities or demographic trends, and can even help with things like budgetary considerations for local municipalities. CAI has also played a crucial role in open source intelligence collection (Oerlemans and Langenhuijzen 2024). In its most raw form, CAI can provide generalized and anonymized information about growing trends that support national security objectives. For example, analysis of commercially available or publicly accessible social media data can help identify foreign influence operations. Researchers have been able to identify Twitter/X.com account IDs, locations, and recurring hashtags to identify Russian disinformation campaigns (Zannettou et al. 2019). This illustrates how CAI can provide a clear national security capability. More granular data about U.S. persons is where the tensions arise, however. Data in the aggregate and abstract is not necessarily a civil liberties problem and is the lifeblood of the USIC's mission. The problems arise as the data becomes more granular, individualized, and person-specific, potentially revealing patterns of life or data that could otherwise be subject to legal considerations for collection by government agencies.

In a more refined state, CAI can contain exceptionally sensitive information about individuals. From data brokers like FullContact, this data can be purchased pre-aggregated, giving the buyer a look into the location, contact information, employment, and other data about single individuals. Other data brokers provide “anonymized” data. And while that data may not come with individual names or personal identifiers attached to it, it can be linked to data that does. By compiling data sets from disparate sources, anonymized datasets could provide reidentification possibilities when combined with data containing personally identifying information (PII). The Office of the Director of National Intelligence acknowledges this risk: When purchasing large data sets to track foreign individuals, data of U.S. persons inevitably comes embedded (Office of the Director of National Intelligence 2024).

The USIC does not typically purchase data directly from applications like Google or Tinder. Instead, data brokers serve as intermediaries between the consumer-facing products and the public and private organizations looking to do data analysis. Data brokers have access to multiple sources of data and can aggregate, anonymize, and provide tailored demographic, location, or other information to purchasers (Ayoub and Goitein 2024). For its part, the USIC’s foreign intelligence collection operates within a policy framework, largely guided by Executive Order 12333, with provisions on how to handle U.S. persons’ information that are incidentally collected (Exec. Order No. 12333 1981). CAI complicates this framework because U.S. persons’ data may already be embedded in these data sets when the IC acquires them. Since its establishment in 2004, the ODNI has played a key role in forming norms and rules around what is or is not considered acceptable bulk intelligence on U.S. persons (Lowenthal 2025). The USIC has attempted to self-govern by establishing rules and documentation standards for collecting CAI. Ultimately, however, the purchase of CAI as a sanctioned practice raises questions about collection “rules” and legal, statutory, or oversight obligations associated with intelligence collection (Office of the Director of National Intelligence 2024).

A watershed moment in CAI was the Supreme Court’s Carpenter v. United States decision in 2018. The Carpenter decision held that the government’s collection of historical cell-site location information constituted a Fourth Amendment search and generally required a warrant supported by probable cause. The decision did not settle the government’s obligations when purchasing data from intermediaries, leaving an important constitutional question open (Carpenter v. United States 2018). Further, the Defense Intelligence Agency (DIA) contends that since they are not specifically a law enforcement agency, the Carpenter decision does not directly apply to them. In 2021, the DIA provided a written statement to Congress that it “does not construe the Carpenter decision to require a judicial warrant endorsing purchase or use of commercially available data for intelligence purposes” (Office of the Director of National Intelligence 2022, sec. 3.4). The FBI has also admitted to historically purchasing location data but cited the data as derived from “internet advertising,” further clarifying the bureau was not actively purchasing and would need a court order to purchase such information (Burt 2026). The ODNI, however, has documented the DIA’s understanding in a partially declassified report; the USIC interprets the Carpenter ruling as not applicable with regard to intelligence collection when purchasing through third-party brokers (Office of the Director of National Intelligence 2022).

The ODNI’s narrow interpretation of the Carpenter ruling has caused a reaction in Congress, highlighting the difficulty in oversight when intelligence and law enforcement potentially overlap (Thayer 2023). The Fourth Amendment Is Not For Sale Act is a bipartisan proposal that attempted to bar “remote computing service (RCS) providers and electronic communication service (ECS) providers” from providing the federal government with records pertaining to any individual customer or subscriber. It further prohibited the release of these records from intermediary providers and disqualified them for use in trial (U.S. Congress 2023). This legislation has passed the House, but has died before making it to a vote in the Senate.

Open source data will continue to remain a valuable tool for investigators and intelligence services alike. Lawmakers will face the challenge of legislating an ever-evolving technological landscape to protect U.S. persons’ Fourth Amendment rights without wholesale disregard for CAI as an intelligence source. This will require a significant commitment from a body of the government who has historically been slower to adapt than the pace of technology. While The Fourth Amendment Is Not For Sale Act might immediately satisfy Americans who see this as an answer to the weaponization of intelligence, it carries significant national security implications (Berrefjord and Bjørstad 2024). Threading the needle between providing the USIC with the tools it needs while simultaneously protecting U.S. persons’ privacy will be an iterative process that will require good faith on both sides of the political aisle.