CBP’s Admission: Purchasing Location Data From the Online Advertising Ecosystem
United States Customs and Border Protection (CBP) has acknowledged—publicly and explicitly for the first time—that it purchased phone location data sourced from the online advertising industry. That acknowledgement appears in a document known as a Privacy Threshold Analysis, which was obtained through a Freedom of Information Act request.
The document addresses a trial CBP ran between 2019 and 2021, and it ties the agency’s access to location information to the commercial ad-tech pipeline—an industry built to target ads, but also capable of supporting surveillance-grade tracking at scale.
The Privacy Threshold Analysis and the 2019–2021 Trial
The key detail isn’t just that CBP got location data. It’s how this came to light: a Privacy Threshold Analysis obtained via FOIA, describing a time-bounded trial period.
This is important because it shows there’s a formal process inside the organization—something that’s documented, reviewed, and recorded—instead of just a casual or one-off purchase. It also matters because it connects a government agency’s location tracking to commercial data that people generate every day just by using apps and browsing the internet.
How Real-Time Bidding (RTB) Can Expose Phone Location Data
CBP’s purchase is described as involving data linked to real-time bidding (RTB)—the behind-the-scenes machinery that decides which ads you see online and in apps.
In RTB, ads are often delivered after automated, instantaneous auctions, where advertisers bid for the opportunity to show an ad to a specific person. The article describes the darker reality inside the “murkiest parts” of this ecosystem: entities can collect data from your device and package it for sale.
What RTB Collects: Device Identifiers and Location Signals
The advertising industry can collect device-level information, including:
- Phone identifying details
- Location data
Once collected, that data can be repackaged and sold to other companies and entities. In other words, what begins as “ad targeting” infrastructure can become a supply chain for high-resolution tracking.
Why This Data Is So Valuable for Tracking People
The context calls this kind of data a “gold mine” because it can be used to track daily activities. That phrase is doing a lot of work—and honestly, it should make you pause.
“Daily activities” implies routine patterns: where someone sleeps, works, visits, worships, seeks medical care, or meets others. When location data is granular and persistent, it can create a behavioral map of a person’s life—without needing to break into their phone.
What CBP Won’t Say (and Why That’s Part of the Story)
CBP did not respond to a request asking whether it is still buying this data.
That silence is important. Because the practical question isn’t only whether CBP used ad-tech location data in the past. It’s whether the pipeline remains open today—whether location data drawn from ad auctions is still being treated as something a government agency can simply buy.
The Wider Pattern: Monitoring Neighborhoods Through Mobile Movement Data
The context also points to reported plans involving Immigration and Customs Enforcement (ICE): the agency has reportedly planned to purchase access to a system called Webloc, which would allow whole neighborhoods to be monitored for mobile phone movements.
Even if this is discussed as a separate tool or system, the theme is consistent: commercial location intelligence can be repurposed into neighborhood-level visibility—tracking movement not just of individuals, but of populations in a defined area.
The Surveillance-Heavy Online Advertising Industry as a Data Broker Pipeline
The article describes the online advertising world as sprawling and surveillance-heavy. And that framing matters, because RTB isn’t a niche feature—it’s a core mechanism of how modern advertising works.
So you end up with a weird reality:
- People think they’re participating in “free content” economics.
- But the infrastructure enabling those ads can generate location traces and device-linked data.
- And those traces can be sold onward—potentially to government entities.
Not because anyone “hacked” anything. Just because the data exists, is collected, and has a market price.