Data Brokers Can Rebuild a Protest From App Location Trails

Start with a black nylon rain jacket and the phone in its shallow inside pocket. The phone knocks against the wearer’s ribs during a harmless loop around an empty civic plaza, which is irritating but useful: it reminds us that a location trail begins with a physical object carried by a person, even when the eventual database strips away the person and presents only a string of coordinates.

For a safe demonstration, the plaza stays empty. The walker examines only location history from their own device, at a coarse scale, and does not attempt to identify anyone else. A few points can suggest arrival, movement and departure. A commercial broker working across many apps can see far more, then package the result behind dashboards, bulk files or software access.

The jacket never becomes a database field. The phone does.

This is why protest surveillance no longer requires an officer in the crowd, a camera trained on a face or an undercover account inside a group chat. Those methods still exist. The quieter option is to buy access to a commercial system designed to answer a different question: which devices appeared near a place during a chosen period, and where else did they tend to go?

A phone becomes inventory

Location data commonly begins inside an app. A weather service, navigation tool, coupon app or game may request location access for a plausible feature, while embedded advertising or analytics code collects information for a broader commercial purpose. A software development kit, or SDK, is packaged code that an app developer adds rather than building a function from scratch. Some SDK vendors receive data directly from the apps carrying their code.

The phone may be represented by a mobile advertising ID, a resettable identifier intended to help companies recognize one device across apps without displaying the owner’s name. That separation sounds reassuring until the location trail repeatedly ends at one residence overnight and appears at one workplace during the week. A pseudonym is not anonymity when the behavior attached to it supplies the missing name.

Other location signals can enter advertising systems through bid requests, the messages sent when an app offers an ad impression for sale. Access varies by app, operating system and permission setting, and the supply chain has changed as Apple and Google tightened some controls. The central business logic remains. App publishers want revenue or free analytics.

Data companies want scale. Buyers want movement converted into categories they can compare.

The resulting records can pass through several hands before reaching a broker that never had a consumer relationship with the person carrying the phone. Contracts and technical restrictions may forbid certain uses, yet the individual at the beginning rarely sees those terms, much less negotiates them. Consent becomes a relay baton passed between companies until nobody holding it can explain what the runner agreed to.

The black jacket’s pocket matters here. The person chose where to put the phone. They did not make a comparably legible choice about whether a marketing intermediary could preserve the plaza visit, combine it with other movements and offer access to a customer years removed from the original app.

The protest becomes a filter

A broker does not need a category labeled political dissident. It needs location points, timestamps and a way to query them.

A geofence is a digital boundary drawn around a physical area. In commercial analytics, geofences are routinely used to estimate visits to stores, measure advertising campaigns or study foot traffic. Applied to a public gathering, the same mechanism can isolate devices observed near the event during the relevant period. Repeated observations can help distinguish someone lingering inside the area from traffic passing nearby, though that distinction remains probabilistic.

From there, software can group devices into an audience or produce aggregated movement patterns. Some products expose device-level identifiers; others claim to provide only summaries or controlled access. Either form can be revealing. An aggregate report can describe the neighborhoods from which a crowd arrived, while persistent identifiers can connect one appearance to a longer trail.

The machinery does not understand assembly, belief or citizenship. It recognizes co-location and recurrence.

That indifference is the mechanism, not a flaw around its edges. Advertising technology was built to turn behavior into something queryable without asking why the behavior occurred, so a visit to a shoe store, a clinic, a church and a protest can enter similar commercial pipelines even though the consequences of exposure are radically different.

Public reporting has shown the reach of these systems without publishing instructions for targeting real people. The New York Times’s 2019 location-data investigation demonstrated how supposedly anonymous device trails could resolve into intimate daily routines. Reporting by The Associated Press and the Electronic Frontier Foundation later documented Fog Reveal, a commercial location-search tool marketed to police and linked to app-derived data. Federal Trade Commission cases involving Kochava, X-Mode’s Outlogic and InMarket have described markets for precise location information and imposed or sought restrictions involving sensitive places, consent and deletion.

The Office of the Director of National Intelligence reached a similarly bleak conclusion in its declassified report on commercially available information: data sold on the open market can expose sensitive details at a scale once associated with government surveillance. The distinction between commercial and governmental collection has become less comforting because one side can purchase from the other.

Precision is persuasive, even when it is wrong

A dot on a map looks like a fact. Often it is an estimate.

GPS drift can place a device on the wrong side of a street or boundary. Phones are shared, lent, replaced and left behind. Advertising identifiers can reset, and companies may use other signals to reconnect records. A device observed near a march could belong to a participant, a journalist, a worker in a nearby building or someone waiting for a bus.

The database sees hardware first and context poorly.

Those limits do not make the system harmless. They make it capable of producing confident accusations from ambiguous evidence, especially when an investigator treats a commercial interface as a neutral window rather than a product assembled from incomplete inputs. False precision sells because the map is clean. The underlying life is not.

Return to the empty plaza. Our phone’s coarse self-view shows the wearer crossing open space, but it cannot explain the black nylon jacket, the uncomfortable pocket, the reason for the walk or the absence of a protest. At crowd scale, missing context multiplies. Institutions can still act on the output, and the person misclassified by it may never learn which broker supplied the trail.

Buying data changes the constitutional argument

Police have long sought location information from cellular carriers and technology companies. In Carpenter v. United States, the Supreme Court held that obtaining an extended history of cell-site location records generally requires a warrant. Commercial app data created a tempting detour: an agency can pay a vendor for access rather than compel the phone company to surrender records.

Whether that purchase avoids constitutional protections remains contested, and courts have not produced one clean rule covering every commercial dataset and investigative use. The incentive is easier to read. Warrants require a defined legal process and judicial review. A subscription offers speed, breadth and an interface built to make searching feel routine.

Public agencies may buy directly, work through contractors or use products that sit several corporate layers away from the apps that sourced the data. The vendor gets a government customer. The agency gets capabilities without building a collection system. App users get neither meaningful notice nor a practical way to trace the sale.

This is the hidden economy beneath the map. The protest is valuable because it produces a dense, time-bounded cluster that can be compared with other movements. Commercial buyers may call that audience intelligence. Government buyers may call it investigation.

The data broker gets paid either way.

The useful fix is less data

Industry responses tend to emphasize approved uses, contractual bans and the removal of especially sensitive locations. Those controls can matter, particularly when regulators enforce them, but they leave a basic problem intact: a market containing detailed movement histories will keep attracting customers whose purposes were never contemplated by the person tapping Allow.

The stronger alternative is data minimization, which means collecting and retaining only the information needed for a defined service. A weather app can provide local conditions without maintaining a saleable history of everywhere its users traveled. Sensitive-location rules can restrict resale around protests, clinics and places of worship, although lists of protected venues will always lag behind the next abusive use.

Operating-system permissions and advertising-ID controls can reduce some collection, but they place the labor on individuals navigating settings while the companies designing the supply chain retain better information and stronger incentives. Broker registries, deletion systems and consumer privacy laws offer routes for accountability. They do not erase data already copied downstream, where one request may need to reach a chain of firms the user has never heard of.

A durable rule would target the trade itself: strict limits on selling or licensing precise location data, enforceable deletion duties, and warrant requirements that do not evaporate when an agency reaches for a purchasing card. That costs brokers a lucrative category of inventory. It costs buyers the convenience of searching first and justifying later. Those are costs the market will not volunteer to bear.

The black rain jacket leaves the plaza with its owner. The location record may remain, detached from the sore rib, the empty square and every other fact that made the walk ordinary.

Questions people ask

Can location data identify individual protesters?

It can sometimes narrow a device trail to a person or household by connecting repeated locations, even when the record uses an advertising identifier instead of a name. That inference can also be wrong. A device represents hardware, not intent, and proximity to a gathering does not establish participation.

Where do location-data brokers get their information?

Common sources include apps with location permission, embedded analytics or advertising SDKs, and data moving through advertising systems. Brokers may acquire records through intermediaries, combine them with other datasets and sell files, reports or access to search tools rather than collecting directly from a phone.

Can police buy protest location data without a warrant?

Public reporting has documented law-enforcement access to commercial app-derived location tools. The constitutional limits remain disputed and depend on the data and use, but purchasing offers agencies a route outside the ordinary demand sent to a carrier or platform. Legislative proposals have sought to close that route.

Does turning off location permission solve the problem?

It can limit collection by apps denied access, but it does not repair records already sold or guarantee that every form of location inference stops. The larger issue is structural: people should not have to audit every app and intermediary to prevent attendance at a public gathering from becoming commercial inventory.