Chip Somodevilla/Getty Images
Maryland has passed some of the strictest data privacy provisions in the country. But privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders’ geolocation data, as well as selling information to federal immigration authorities.
A coalition of privacy and civil rights groups filed a consumer complaint Wednesday that calls on the state attorney general to investigate specific companies and take enforcement action against them. The complaint comes as U.S. Immigration and Customs Enforcement has been ramping up its use of commercially-available personal data and surveillance tools to track and deport immigrants as well as monitor protesters.
Two of the named data brokers, Penlink and Thomson Reuters, denied the allegations and told NPR they were in compliance with the law.
The complaint alleges Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety and others, are collecting and selling personal information and location data on Maryland residents to law enforcement customers in violation of state privacy law. Penlink sells cell phone location data through its Webloc program, while the other companies sell car location data captured by license plate readers.
Several of the named companies have contracts with ICE, including Penlink. Thomson Reuters and LexisNexis provide data tools to ICE that contain a wide range of personal information from public records and proprietary data sources.
The complaint also names ThunderCat Technology, which has a contract with Homeland Security Investigations, which is part of ICE, to provide the agency with individual taxpayer identification numbers (ITIN) data.
The complaint calls on Maryland Attorney General Anthony G. Brown to “use the full force” of the state’s strong privacy laws, “and take immediate action to rein in agencies’ use of commercially purchased data that enables mass surveillance of Americans without judicial, legislative, or public oversight.”
Georgetown University Law Center’s Technology Law Clinic authored the consumer complaint on behalf of We Are CASA, which advocates for working class, Black, Latino, Indigenous and immigrant rights, and 11 other organizations that focus on privacy and civil rights, including the Center for Democracy & Technology and the Electronic Privacy Information Center.
“Through our direct services programming, we have witnessed parents worried about updating their address with state agencies, individuals increasingly cautious about engaging with any institution that collects personal data, even if they meet the program’s eligibility requirements,” said George Escobar, the executive director of We Are CASA in a statement.
“Ensuring a more equitable Maryland for all starts with an investigation of these data companies and strict enforcement of our values as laid out in state law,” the statement continued.
A statement provided to NPR by Thomson Reuters reads, “We are confident that we are in compliance with all applicable laws and regulations governing our business and operations.” The company specifies on its website that the license plate recognition product it offers, “is not capable of tracking real time locations of a vehicle; it provides access to ad hoc images collected randomly.”
Penlink also denied that it was violating state law.
“The allegations against Penlink in the complaint are false, as Penlink does not process or sell precise location data of Marylanders in accordance with Maryland privacy law,” reads a company statement provided to NPR. “Penlink complies with applicable U.S. privacy laws and data-broker regulations, and we will continue to update our practices as data and privacy laws evolve.”
Maryland’s law defines “precise geolocation data” as “information derived from technology that can precisely and accurately identify, within a radius of 1,750 feet, the specific location of a consumer, a mobile device, or a vehicle.”
The complaint alleges that Penlink’s products are being used by Maryland agencies. Penlink did not respond to NPR’s questions about Baltimore County Police Department’s contract for Webloc, which was previously reported by Citizen Lab, or a proposed contract upgrade with Maryland State Police for Penlink’s PRX product. State records proposing that contract list “geolocation information” as part of the tool’s capabilities.
None of the other named companies responded to NPR’s request for comment by deadline.
Multiple emails to Flock Safety resulted in the same automated response: “Our media team is currently touching grass and taking a break. Unlike our cameras, we can’t work 24/7, so we’ll get back to you when we’ve had a snack and regained the ability to form coherent sentences.”
Many law enforcement agencies purchase sensitive data on Americans from data brokers to learn intimate details about where they go, who they meet with and where they live — without needing to obtain a warrant. Advances in artificial intelligence are quickly making such data products even more powerful.
Lawmakers from both parties have argued that law enforcement should not be able to purchase data they would otherwise need a warrant to obtain, since such data purchases circumvent protections granted by the Fourth Amendment, which prohibits “unreasonable searches and seizures.” But Congress has yet to pass a law that would close this so-called “data broker loophole.”
Maryland lawmakers, however, have attempted to put restrictions on what data brokers can do with its residents’ data. The Maryland Online Data Privacy Act passed in 2024, and state lawmakers passed additional updates to that law in the most recent legislative session that took effect last month.
The Maryland attorney general’s office declined to comment on the consumer complaint. When NPR inquired with the office in late June about the new data privacy provisions taking effect July 1, spokesperson Kelsey Hartman told NPR, “Entities subject to the law should ensure they are in compliance.”
Under current Maryland law, data brokers are barred from collecting or sharing state residents’ sensitive data, including location data, unless it is to deliver a product or service the consumer requested, or in response to certain law enforcement demands. Data brokers are barred from selling or sharing Marylanders’ location data unless law enforcement has gone through a legal process to obtain a subpoena or warrant.
State law also bars data brokers from selling information to agencies that enforce immigration law, unless the law requires it or they receive a warrant.
The complaint argues the named companies are violating the law by selling location data, or by selling to ICE, or in some cases — both.
“If these practices are allowed to proceed, federal agencies will effectively be able to circumvent constitutional limits and judicial oversight altogether, and to conduct dragnet searches and go on fishing expeditions through Marylanders’ private lives in ways that they should not be able to do,” the complaint warns.
New Jersey, Virginia, Oregon and Connecticut also recently banned the sale of some categories of sensitive data, including geolocation data.
Maryland’s law is unique for its rules barring data brokers from selling personal data to entities that assist with immigration enforcement, said Greg Nojeim, director of the Center for Democracy and Technology’s Security and Surveillance Project.
Data brokers in Maryland cannot comply with an ICE subpoena to seek a Marylander’s sensitive data, instead ICE must present a warrant, Nojeim said.
“This is important because ICE has abused its administrative subpoena authority to silence people who point out ICE abuses,” Nojeim said. “Maryland is telling ICE, ‘Get a warrant if you want Marylanders’ sensitive data.'”
