by Leah Harmony

The data trap we agree to every day

With the elusive and costly AI data centers on everybody’s minds these days, one thing absent from conversations is what they are actually for outside of artificial intelligence processes. For example, what data is AI processing? Because of its magnitude, we can surmise it has enormous value for both buyers and sellers. Then there is the loose notion that the data is about us, but to what extent?

In line with our ongoing coverage of all things tech, the SF Bay View newspaper took a deep dive into the who, what, where and how of data harvesting.

Perhaps the most unsettling information came with the understanding that surveillance, real-time location tracking and law enforcement analytics use data center infrastructure directly to function. The Fourth Amendment is supposed to protect you from unreasonable surveillance, but a massive commercial loophole has turned that protection into a bigger joke than it already was. However, this isn’t your average law enforcement overreach. This is a methodology once reserved for the NSA to profile terrorists, now available to your local cops through the apps you use every day. Whether you’re on Yelp looking for the best noodles in town or you’re swiping left on Tinder, you are feeding a global surveillance machine and swiping away your Fourth Amendment protection at the same time.

The legal loophole is called the Third-Party Doctrine, a 50-year-old law born during a 1976 robbery case where the Supreme Court ruled that if you “voluntarily” share info with a third party — like a bank or a phone company — you surrender your “reasonable expectation of privacy.”

In 1976, Justice Thurgood Marshall warned about this giving the government unchecked power to monitor “patterns of association.” He was outvoted. If he were here today, he’d be looked at as a prophet.

When you tap “Allow” on a location prompt, the law treats it as open season to allow the harvesting and utilization of that data. In other words, the only thing that can’t follow your every move is the Constitution.

Read the rest of our unsettling findings below. This is the data trap: a system where your most sensitive information is packaged and sold to benefit everyone except you.

What is being processed and stored:

Every time you download an app, invisible software is installed on your device. Whenever it runs, it harvests your phone’s exact GPS coordinates, timestamps and Mobile Advertising IDs (MAIDs). This creates Pattern of Life Profiles. By cross-referencing public deeds and rental records against where your device spends most of its time, they have your identity, home address, daily routines, religious attendance, medical visits and details about your personal relationships. From there, the intelligence can piece together much more. How much more? Well, there is a reason Pinterest knows when to show you a cheesecake recipe, and subsequently where to buy the ingredients, before you even knew your mom would be asking you to bring it for dessert.

Analysis by MIT researchers has proven that “anonymity” is a myth in this ecosystem: With just four approximate location data points, it is possible to identify 95% of individuals in a dataset of 1.5 million people.

At this point, we can all issue a silent apology to Edward Snowden.

Who and why

Commercial advertisers & retail brands

Why They Want It: Digital advertising shifted from placing ads on specific websites (like a fishing ad on a fishing blog) to tracking individual people everywhere they go. Advertisers want to know your exact routines so they can serve targeted ads at the precise moment you are near a store.

Why It’s Valuable: Location data provides offline attribution — the ability to prove whether an online ad actually caused a consumer to physically walk into a retail store. Knowing where you sleep, work, shop and socialize allows marketers to infer your income bracket, health status, brand loyalty and personal interests. This utility powers a $117 billion Real-Time Bidding (RTB) industry.

Commercial data brokers & aggregators

Why They Want It: Data brokers (like Predicio, Gravy Analytics and Near Intelligence) collect raw location pings through cheap software development kits (SDKs) embedded in everyday apps.

Why It’s Valuable: Location data is a high-margin, infinitely scalable digital asset. Once harvested, a single dataset costs virtually nothing to copy and can be resold dozens of times over to different corporate clients, hedge funds, defense contractors and law enforcement agencies.

Law enforcement & police departments

Why They Want It: Police use this data to bypass Fourth Amendment warrant requirements. Under the Third-Party Doctrine, courts treat app data as “voluntarily shared” by the user, meaning police can buy access to location histories without establishing probable cause, seeking a judge’s approval or notifying the phone owner.

Why It’s Valuable: It provides what Supreme Court Chief Justice John Roberts called “near-perfect surveillance” — acting like a 90-day historical ankle monitor on anyone in the country. Through “pattern of life analysis” (a profiling technique developed by the NSA), detectives can draw a box around any location, view every device that was present and unmask an “anonymous” device owner in minutes by analyzing where the phone sleeps overnight. Platforms like Fog Reveal sell this nationwide tracking power to small police departments for as little as $7,500 a year.

Defense contractors & foreign intelligence

Why They Want It: Military agencies, defense intelligence contractors and foreign actors use commercial ad-tech streams to track high-value targets, monitor foreign conflict zones and gather intelligence on government operations.

Why It’s Valuable: Smartphones do not stop broadcasting location pings when their owners enter sensitive facilities. Data leaks have revealed unencrypted, minute-by-minute location tracking for personnel inside Fort Bragg, the White House, the Kremlin and the Vatican. For intelligence agencies, buying commercial ad-tech data is far cheaper and less risky than deploying physical spies or wiretaps.

Hedge funds & financial institutions

Why They Want It: Wall Street firms buy aggregated foot-traffic data as “alternative data” to gain an unfair informational edge in financial markets.

Why It’s Valuable: By monitoring real-time foot traffic at retail chains, coffee shops, factories, oil refineries or airports, hedge funds can accurately predict quarterly earnings and trade stocks before companies publish their official financial reports.

Private media outlets & private investigators

Why They Want It: Private entities buy commercial location feeds to investigate, expose or blackmail specific individuals.

Why It’s Valuable: MIT researchers proved that just four location points are enough to uniquely identify 95% of individuals in an “anonymous” dataset. A real-world example occurred in 2021 when the media outlet The Pillar bought commercial app location data to track daily dating app usage from the office and home of a top Catholic Church official, forcing his immediate resignation.

When, how and how much:

The scale of this surveillance is nearly unfathomable. According to the ICCL, the average American’s location and behavior are exposed 747 times per day. Across the U.S., this data is broadcast 107 trillion times per year. This occurs via Real-Time Bidding (RTB). Every time an ad loads, your phone sends a “bid request” containing your location and ID to an ad exchange. In the time it takes for a camera flash to fire, your data is broadcast to thousands of companies. There are no technical measures to ensure that the “losing” bidders delete your data.

Furthermore, when users attempt to opt out, the industry employs fingerprinting to ensure the revenue stream remains uninterrupted. By computing identifiers through server-side code to evade on-device enforcement, vendors claim they can still reach over 95% of iOS users.

The asymmetric cost: You spend roughly $1,000 for a smartphone and $50 to $80 monthly for a data plan. Over two years, you pay approximately $2,200 to buy, power and maintain the very infrastructure used to monitor you. You are effectively subsidizing your own surveillance at a loss.

We’re not in the business of delivering strictly bad news. Getting all of our footprints out of the sand, and the wave back to the shore, may be difficult, but we put together an escape plan. This is subject to change as we learn more, but this is what we have for you right now.

The escape plan: Solutions to reclaim your privacy in levels

Level 1: Everyday hygiene

Revoke Permissions: Deny location access to any app that doesn’t strictly require it for a core function.

Private DNS: Configure your device to use DNS.adguard.com or NextDNS. This intercepts background tracker telemetry at the network level.

LNA Prompts: Pay attention to Chrome’s Local Network Access (LNA) prompts. These prevent sites from fingerprinting your router or attacking local devices.

Recognize Dark Patterns: Be wary of “Confirm Shaming” (e.g., “No, I prefer to pay full price”) used to trick you into opting into tracking.

Level 2: Intermediate technical defenses

Local Firewalls: Use RethinkDNS to block specific hostnames. If an app tries to send data to a known broker, RethinkDNS provides the “wrong address,” effectively killing the uplink.

Block Email Pixels: Use tools to strip tracking pixels from emails that record when and where you open messages.

Tracker-Free Migration: Switch to open-source alternatives from F-Droid (e.g., Librera FD instead of Google Play Books) that do not contain SDK harvesters.

Level 3: Advanced OS hardening

Migrate to GrapheneOS. It treats apps as “untrusted by default” and offers:

Network Toggle: Completely disable internet access for apps like calculators or flashlights. It even blocks “loopback” and DNS queries.

Storage Scopes: Apps only see the specific files you pick, preventing them from inventorying your entire digital life.

Sandboxed Google Play: Runs Google services as regular, unprivileged apps.

Sensor Toggles: When sensor permission is denied, GrapheneOS provides zeroed or randomized sensor data, defeating keystroke inference and gait analysis.

Level 4: Radical isolation

Faraday Bags: Use a physical RF-blocking sleeve like a Mission Darkness bag. Certified to MIL-STD 188-125, it stops all cellular, GPS and Wi-Fi pings by creating 100dB+ signal attenuation.

The “Dumb Phone“: Revert to a Nokia 3310 or a prepaid device paid for in cash. The ultimate defense is leaving the tracking device behind entirely during sensitive routines.

Who:

Lastly, if you believe in our government and the law, although this article isn’t a great cheerleader for those folks, the legal tide is beginning to turn, but slowly. In 2024, the Fifth Circuit ruled geofence warrants unconstitutional, and in June 2026, the Supreme Court finally labeled geofence warrants as a “search” under the Fourth Amendment. However, there is still no federal law requiring a warrant for the government to simply buy your data from a broker. Until that change comes, your phone remains a spy in your pocket — one that you are paying for the privilege of carrying.

This is America.

Leah Harmony is a journalist and Manager of Production at the San Francisco Bay View. She can be reached at leah@sfbayview.com.