U.S. Customs and Border Protections (CBP) has confessed to buying phone location data from the online advertising world, with the purchase making it now the first government agency to confirm such practices. The disclosure was made in a Privacy Threshold Analysis document from 2019 to 2021 that 404 Media obtained via a Freedom of Information Act request and describing a proof-of-concept trial. The data, embedded in real-time bidding (RTB) mechanisms in apps, can be used to track people’s movements with great precision, unbeknownst to them.
Real-time bidding is what drives the ads that users see in mobile apps, where advertisers bid in real time to display targeted content. In these auctions, mysterious advertising tech companies are peddling tens of thousands of apps, including popular games like Candy Crush and fitness trainers like MyFitnessPal, collecting device identifiers, app usage, and geolocation data. That information is packaged and resold, and tracking it creates a “gold mine” of delivery because it exposes daily routines, home addresses and places of work.
CBP’s use of such data is troubling from a privacy standpoint, as it circumvent traditional warrants and has access to an ecosystem that most users don’t actually agree to use. The agency evaluated the technology to track activity close to borders, but would not say whether it still uses the method after queries. Related agencies, such as Immigration and Customs Enforcement, have sought to procure similar tools, like Webloc, which allows users to track phones on a neighborhood scale.
This incident highlights broader government reliance on commercial data brokers for surveillance, echoing past revelations about low-cost ad-based location spying. Apps from dating services to social networks unwittingly feed this pipeline, often without developers' awareness. Critics argue it erodes Fourth Amendment protections, enabling mass tracking under the guise of national security.
As digital ad ecosystems expand, regulators face pressure to curb these hidden data flows before they normalize warrantless monitoring. Users can mitigate risks by limiting app permissions, using VPNs, and supporting privacy laws like those targeting data brokers. Policymakers must now scrutinize how border security intersects with everyday app usage to safeguard civil liberties in an ad-driven world.