Senator Ron Wyden of Oregon asked Patel a direct question: would the FBI commit to not buying Americans' location data? The answer was a textbook exercise in saying yes while appearing to say no.
"We do purchase commercially available information that is consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us to be utilized with our private and partner sectors."
Wyden's response was equally direct.
"So you're saying that the agency will buy Americans' location data? I believe that's what you've said in some kind of intelligence lingo."
Yes. That is what he said.
The significance of the admission is not simply that the FBI buys data. It is the reversal it represents. In 2023, Patel's predecessor Christopher Wray told the same committee that the FBI had previously purchased location data derived from commercial sources but, to his knowledge, was not currently doing so. Patel's testimony on 18 March confirmed the programme has resumed and is active.
How location data gets from your car to a federal agency
Understanding how this pipeline works requires understanding what the data broker industry actually is, because the phrase "commercially available data" obscures a mechanism that most people have never examined.
Modern cars, particularly connected vehicles built from roughly 2018 onward, generate and transmit an enormous volume of data as a condition of normal operation. GPS location, journey logs, speed data, braking patterns, infotainment system usage, which apps connect to the car and when. This data is transmitted to the manufacturer, which uses it to improve services, diagnose faults remotely and, increasingly, to sell to third parties. A 2023 Mozilla Foundation investigation into 25 car brands found that all 25 collected more personal data than necessary, 19 shared or sold personal data, and 14 used the data for targeted advertising. General Motors, as MotorBuzz reported in its investigation into the UK government's O2 surveillance programme, had enrolled 1.5 million American drivers into its OnStar Smart Driver programme and sold their detailed driving behaviour data to brokers including LexisNexis and Verisk without clear driver consent, a practice that came to light via a New York Times investigation in 2024. Brokers who receive that data can aggregate it, crossmatch it with other datasets, and sell access to whoever will pay.
That is the mechanism. A car collects your location. The manufacturer sells it. A broker packages it. A federal agency buys it. No warrant. No judge. No probable cause.
The legal basis the FBI relies on is the third-party doctrine, a principle dating from two Supreme Court cases in the 1970s which held that information voluntarily shared with a third party carries no Fourth Amendment protection. You shared your location with your car's manufacturer. The manufacturer shared it with a broker. The broker sold it to the FBI. At no point in that chain did anyone seek judicial authorisation, because the third-party doctrine has historically meant they do not have to.
The 2018 Supreme Court decision in Carpenter v. United States complicated that picture significantly. In a 5-4 ruling, the court held that the government does require a warrant to obtain historical cell-site location records from a phone company, because seven days of location data creates a comprehensive chronicle of a person's movements that carries reasonable privacy expectations. Justice Roberts wrote that access to five to seven days of location data provides an all-encompassing record of a person's whereabouts. Wyden's position, held consistently since before that ruling, is that the commercial data purchase route is a deliberate end-run around Carpenter's requirements.
"It's particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information. This is exhibit A for why Congress needs to pass our bipartisan, bicameral bill, the Government Surveillance Reform Act."
That bill, co-sponsored by Republican Representative Warren Davidson, would close the commercial data purchase exemption entirely, requiring law enforcement agencies to obtain a warrant before accessing any location data regardless of its source. It has not passed.
Like this? Get the app: iOS | Android
The pattern MotorBuzz has been tracking
This is not a new problem and it is not an American problem exclusively. The UK government paid O2 £602,000 to harvest the location and browsing data of 25 million phone users to identify EV drivers, as MotorBuzz reported in its investigation into government phone surveillance. New Zealand awarded a $100 million contract to a private Australian AI company to film drivers on public roads and issue fines algorithmically, as covered in depth in MotorBuzz's Drivers Revenge section. Iran built one of the most extensive traffic camera networks in the Middle East, which turned out to have been hacked by Mossad and used to track and kill the Supreme Leader, as MotorBuzz reported in its piece on how surveillance infrastructure became an assassination tool. The pattern across all of these stories is consistent: data collected for one stated purpose is used for another, and the people whose data was collected were not asked, not told, and frequently could not have objected even if they had been.
Patel's testimony does not reveal a new programme. It confirms an existing one and confirms it is active. The specific data it relies on includes location histories derived from phone apps, internet advertising identifiers, and the kind of connected vehicle data that your car has been generating and transmitting since before you noticed the terms and conditions box you clicked through during the setup process.
The data that told your insurer how hard you brake on a rainy Tuesday in October is the same category of data the FBI now admits it buys. Whether that specific dataset has been accessed by federal investigators is unknown. Whether the infrastructure that makes it possible is the same infrastructure is not.
Sources: TechCrunch, 18 March 2026 | Gizmodo, 18 March 2026 | Washington Times, 19 March 2026 | The New Republic, 18 March 2026 | Inquisitr, 18 March 2026 | Politico / Patel Senate testimony, 18 March 2026 | The New American, 18 March 2026 | Carpenter v. United States, 585 US 296, 2018 | Mozilla Foundation, Privacy Not Included, 2023 | New York Times investigation into GM OnStar data sales, 2024 | MotorBuzz UK O2 surveillance | MotorBuzz Drivers Revenge | MotorBuzz Mossad traffic cameras
