The Supreme Court Required a Warrant for Your Location History. The FBI Buys It Anyway.

On June 29, 2026, the Supreme Court ruled 6–3 in Chatrie v. United States that pulling someone's historical cellphone location data from a company like Google is a Fourth Amendment search — meaning police generally need a warrant to do it. Privacy advocates called it a landmark. It is one.

It also doesn't do what most people will assume it does. The ruling governs what happens when the government compels your location data from the company holding it. It says nothing about what happens when the government simply buys the same data on the open market instead. And three months before the ruling, the director of the FBI told a U.S. Senator, under oath, that buying it is exactly what his agency does.

The order that told agencies to stop building walls

On March 20, 2025, President Trump signed Executive Order 14243, "Stopping Waste, Fraud, and Abuse by Eliminating Information Silos." The stated goal was efficiency: stop federal agencies from hoarding data in separate systems and let officials see across them to catch fraud and duplication.

By early 2026, reporting on the order's downstream effects showed what "eliminating silos" meant in practice. NPR's investigation in March 2026 documented ICE gaining access to IRS and Medicaid records, and the CIA's access to domestic law-enforcement data being loosened — databases that were historically kept apart specifically because combining them concentrates power over individuals in a way no single agency was ever supposed to have on its own.

Data silos are inconvenient by design. They're also one of the few structural brakes on a government being able to build a complete profile of any resident on demand. Tearing them down doesn't just streamline fraud detection — it removes a check that has nothing to do with fraud at all.

The FBI director said the quiet part out loud

The same month that reporting broke, Senator Ron Wyden asked FBI Director Kash Patel directly whether he would commit to not buying Americans' location data from commercial brokers.

"Can you commit this morning to not buying Americans' location data?" — Sen. Ron Wyden, Senate hearing, March 2026

"The FBI uses all tools… to do our mission. We do purchase commercially available information that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act. It's led to some valuable intelligence for us." — FBI Director Kash Patel, in response

Patel didn't deny it, and he didn't commit to stopping. That answer matters because it was the first time since 2023 the FBI had confirmed it was actively buying location data pulled from brokers — in 2023, then-Director Christopher Wray told senators the agency had done it in the past but wasn't doing it currently. Wyden called the practice "an outrageous end run around the Fourth Amendment," warning it's "particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information."

Where Chatrie actually draws the line

Chatrie started with a 2019 bank robbery in Midlothian, Virginia. Investigators got a geofence warrant compelling Google to identify every phone that had been within 150 meters of the credit union around the time of the crime. Okeem Chatrie's phone was one of them; he was convicted partly on that evidence. His appeal asked whether that kind of warrant — drawing a box on a map and pulling in everyone inside it, guilty or not — is constitutional at all.

Writing for a 6–3 majority, Justice Elena Kagan held that people retain a reasonable expectation of privacy in their digital location history, even when a third party like Google is the one holding it, and even over a comparatively short window of time. That's a real extension of the Court's 2018 ruling in Carpenter v. United States, which covered only historical cell-tower records held by phone carriers. Chatrie confirms the same protection reaches the far larger, far more precise trove of GPS location data that phones report to app platforms every day.

The Court did not resolve everything. It vacated the lower ruling and remanded the case to the Fourth Circuit to decide whether this specific warrant — sweeping in every device in a radius, rather than targeting a known suspect — was reasonable in scope. The geofence-warrant question survives; only the threshold question (is a warrant required at all) is settled.

The loophole the ruling never touches

Here's the part that matters most and gets the least attention: Chatrie only governs what happens when the government compels data from a company through legal process. It has nothing to say about what happens when the government instead purchases the same category of data from a data broker on the commercial market — no subpoena, no warrant, no judge involved at any point.

That's not a hypothetical gap. It's the exact mechanism Director Patel described to Wyden two months earlier. Advocacy groups have a name for it: the data broker loophole. In 2026, a coalition of more than 130 civil society organizations sent Congress a letter, timed to the reauthorization of Section 702 of the Foreign Intelligence Surveillance Act, warning of an "unprecedented expansion of warrantless mass surveillance" and flagging the added risk of the loophole being used to "supercharge AI-powered surveillance." Seventeen state attorneys general sent a separate letter making the identical demand: require a court order before the government buys sensitive personal data, not just when it compels it.

What actually reduces your exposure

The pipeline here is the same one we've written about before: an app on your phone reads your GPS coordinates, a bundled ad or analytics SDK you never agreed to sends that location to its own vendor, and that vendor sells it into the broker market where any buyer with a government purchase order — not just a warrant — can access it. We laid out the full mechanics and a step-by-step playbook in our piece on Nevada's Fog Data Science contract; the short version:

• Reset your phone's advertising ID (Android: Settings → Privacy → Ads; iOS: turn off "Allow Apps to Request to Track" entirely) — do this before anything else.
• Lock down per-app location permissions to "Never" unless an app has an obvious, immediate reason to need it.
• Block tracking SDKs at the network level (Pi-hole, NextDNS, or a router that does this automatically) so fewer of them can phone home in the first place.
• Fewer apps, audited regularly — the 2025 Gravy Analytics breach proved apps that publicly deny selling data still feed brokers through bundled SDKs they don't fully control.

None of this is a complete fix, and no single step is. A VPN or a privacy router doesn't stop an app from reading your phone's GPS sensor directly — that leak happens above the network layer entirely. What GhostPort's router does, automatically, for every device on your network: block known tracker and ad-SDK domains at the DNS level before they can phone your location home, and encrypt DNS so your ISP isn't a second collection point. That closes one real door in the pipeline. It doesn't close all of them, and we're not going to tell you it does.