Privacy advocates call on Maryland to investigate data brokers

Privacy advocates call on Maryland to investigate data brokers Maryland has one of the strictest data privacy laws in the country.

Key points

• An automatic license plate reader (ALPR) camera monitors traffic on August 19, 2026 in Silver Spring, Maryland.
• Georgetown University Law Center's Technology Law Clinic authored the consumer complaint on behalf of We Are CASA.
• New Jersey, Virginia, Oregon and Connecticut additionally lately banned the sale of some categories of sensitive data, including geolocation data.
• Two of the named data brokers, Penlink and Thomson Reuters, denied the allegations and informed NPR they were in compliance with the law.
• Multiple emails to Flock Safety resulted in the same automated response: Our media team is at present touching grass and taking a break.

Meanwhile, an automatic license plate reader (ALPR) camera monitors traffic on August 19, 2026 in Silver Spring, Maryland. Chip Somodevilla/Getty Images hide caption.

Maryland has passed some of the strictest data privacy provisions in the country. As well as selling information to federal immigration authorities, but privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders' geolocation data.

Your data is everywhere. The administration is buying it without a warrant.

Notably, a coalition of privacy and civil rights groups filed a consumer complaint Wednesday that calls on the state attorney general to investigate specific firms and take enforcement action against them. The complaint comes as U.S. Immigration and Customs Enforcement has been ramping up its employ of commercially-available personal data and surveillance tools to track and deport immigrants as well as monitor protesters.

Meanwhile, the complaint alleges Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety and others, are collecting and selling personal information and location data on Maryland residents to law enforcement customers in violation of state privacy law. While the other firms sell car location data captured by license plate readers, penlink sells cell phone location data through its Webloc program. Why some cities are ditching their Flock license plate readers.

Meanwhile, a number of of the named businesses have contracts with ICE, including Penlink. Thomson Reuters and LexisNexis provide data tools to ICE that contain a broad set of personal information from public records and proprietary data sources.

In practice, the complaint additionally names ThunderCat Technology. It has a contract with Homeland Security Investigations, which is part of ICE, to provide the agency with individual taxpayer identification numbers (ITIN) data.

Meanwhile, the complaint calls on Maryland Attorney General Anthony G. Brown to "use the full force" of the state's solid privacy laws, "and take immediate action to rein in agencies' use of commercially purchased data that enables mass surveillance of Americans without judicial, legislative, or public oversight."

ICE has spun a massive surveillance web. We talked to individuals caught in it.

Georgetown University Law Center's Technology Law Clinic authored the consumer complaint on behalf of We Are CASA. It advocates for working class, Black, Latino, Indigenous and immigrant rights, and 11 other organizations that focus on privacy and civil rights, including the Center for Democracy & Technology and the Electronic Privacy Information Center.

"Through our direct services programming, we have witnessed parents worried about updating their address with state agencies, individuals increasingly cautious about engaging with any institution that collects personal data, even if they meet the program's eligibility requirements, " remarked George Escobar, the executive director of We Are CASA in an official note.

"Ensuring a more equitable Maryland for all starts with an investigation of these data companies and strict enforcement of our values as laid out in state law, " the statement continued.

Notably, a statement provided to NPR by Thomson Reuters reads, "We are confident that we are in compliance with all applicable laws and regulations governing our business and operations." The firm specifies on its website that the license plate recognition product it offers, "is not capable of tracking real time locations of a vehicle; it provides access to ad hoc images collected randomly." Penlink additionally denied that it was violating state law.

"The allegations against Penlink in the complaint are false, as Penlink does not process or sell precise location data of Marylanders in accordance with Maryland privacy law, " reads a firm statement provided to NPR. "Penlink complies with applicable U.S. Privacy laws and data-broker regulations, and we will continue to update our practices as data and privacy laws evolve."

Maryland's law defines "precise geolocation data" as "information derived from technology that can precisely and accurately identify, within a radius of 1, 750 feet, the specific location of a consumer, a mobile device, or a vehicle."

In practice, the complaint alleges that Penlink's products are being applied by Maryland agencies. Penlink did not respond to NPR's questions regarding Baltimore County Police Department's contract for Webloc. It was previously noted by Citizen Lab, or a proposed contract upgrade with Maryland State Police for Penlink's PRX product. State records proposing that contract list "geolocation information" as part of the tool's capabilities.

None of the other named firms responded to NPR's request for comment by deadline.

Multiple emails to Flock Safety resulted in the same automated response: "Our media team is at present touching grass and taking a break. Unlike our cameras, we can't work 24/7, so we'll obtain back to you when we've had a snack and regained the ability to form coherent sentences."

Plenty of law enforcement agencies purchase sensitive data on Americans from data brokers to learn intimate details concerning where they go. This person they meet with and where they live – without needing to obtain a warrant. Advances in artificial intelligence are rapidly making such data products even more powerful.

Lawmakers from both parties have argued that law enforcement should not be able to purchase data they would otherwise need a warrant to obtain, since such data purchases circumvent protections granted by the Fourth Amendment. It prohibits "unreasonable searches and seizures." But Congress has yet to pass a law that would close this so-called "data broker loophole."

Maryland lawmakers, nevertheless, have attempted to put restrictions on what data brokers can do with its residents' data. The Maryland Online Data Privacy Act passed in 2024, and state lawmakers passed extra updates to that law in the most recent legislative session that took effect last month.

In practice, the Maryland attorney general's office declined to comment on the consumer complaint. When NPR inquired with the office in late June regarding the new data privacy provisions taking effect July 1, spokesperson Kelsey Hartman informed NPR, "Entities subject to the law should ensure they are in compliance."

Under current Maryland law, data brokers are barred from collecting or sharing state residents' sensitive data, including location data, unless it is to deliver a product or service the consumer requested, or in response to certain law enforcement demands. Data brokers are barred from selling or sharing Marylanders' location data unless law enforcement has gone through a legal process to obtain a subpoena or warrant.

State law additionally bars data brokers from selling information to agencies that enforce immigration law, unless the law requires it or they receive a warrant.

Meanwhile, the complaint argues the named firms are violating the law by selling location data, or by selling to ICE, or in some cases – both.

"If these practices are allowed to proceed, federal agencies will effectively be able to circumvent constitutional limits and judicial oversight altogether, and to conduct dragnet searches and go on fishing expeditions through Marylanders' private lives in ways that they should not be able to do, " the complaint warns.

Maryland's law is unique for its rules barring data brokers from selling personal data to entities that assist with immigration enforcement, remarked Greg Nojeim, director of the Center for Democracy and Technology's Security and Surveillance Project.

Data brokers in Maryland cannot comply with an ICE subpoena to seek a Marylander's sensitive data, instead ICE must present a warrant, Nojeim remarked.

"This is important because ICE has abused its administrative subpoena authority to silence people who point out ICE abuses, " Nojeim remarked. "Maryland is telling ICE, 'Get a warrant if you want Marylanders' sensitive data.'".

In short, privacy advocates call on Maryland to investigate data brokers is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.