Data surveillance is the systematic, automated monitoring of your digital activity, communications, and physical movements by governments, corporations, and data brokers. Nearly every website visit, text message, card swipe, and GPS-tracked trip produces a record that someone can store, analyze, or sell. The rules for who can collect what, and when they need a warrant to do it, sit across the Fourth Amendment, a handful of federal statutes, and a growing set of state laws. Knowing how the pieces fit together is the difference between passively generating a profile someone else controls and making deliberate choices about your own information.
How You Actually Get Tracked
The starting point for most online tracking is the HTTP cookie, a small file placed on your device to remember preferences and follow you across sites. Tracking pixels go a step further by embedding invisible images in emails and web pages that notify the sender the moment you open the content. Geofencing uses GPS and cellular signals to trigger data collection the instant you cross into a designated area, such as a store, a protest site, or a competitor’s parking lot. None of this requires you to do anything deliberate.
Your internet service provider sits upstream of all of it. Every packet leaving your home or office passes through the ISP’s infrastructure, which logs the sites you visit, how much data you move, and when. Clearing cookies or switching browsers does nothing about that layer.
Physical hardware fills in the rest. Automated license plate readers capture time-stamped images of vehicles at intersections and along highways, building movement logs. Facial recognition cameras scan features in real time against large image databases. Between the network layer and the street-level cameras, physical anonymity in public is increasingly hard to maintain.
What the Government Needs a Warrant For
The Fourth Amendment protects against unreasonable government searches, but for decades a doctrine known as the “third-party doctrine” carved out a large exception: information you voluntarily shared with a bank, phone company, or similar third party carried no reasonable expectation of privacy, and the government could obtain it without a warrant.
The Supreme Court significantly narrowed that doctrine in 2018. In Carpenter v. United States, the Court held that the government generally needs a warrant supported by probable cause before it can obtain historical cell-site location information from a wireless carrier.1Justia. Carpenter v. United States The Court rejected the idea that cell phone users “voluntarily” share their location with carriers, reasoning that phones are so pervasive they log location continuously without any affirmative act by the user. The decision described a “world of difference” between the limited records addressed in earlier third-party doctrine cases and the exhaustive chronicle of movements that cell-site data reveals.2Legal Information Institute. Carpenter v. United States
The ruling was explicitly narrow. It does not cover conventional security cameras, ordinary business records that happen to reveal location, or national security collection. But the underlying principle matters: as digital records grow more revealing, the constitutional threshold for accessing them rises.
The Wiretap Act
The Wiretap Act, codified beginning at 18 U.S.C. § 2510, prohibits the intentional interception of wire, oral, and electronic communications while they are in transit. Unauthorized interception is a federal felony punishable by up to five years in prison.3Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Because the statute sets the fine as “fined under this title,” the maximum fine for an individual is $250,000 under the general federal sentencing provision for felonies.4Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine The statute also carries an exclusionary rule: any communication intercepted in violation of the Act, and any evidence derived from it, is inadmissible in court.5Office of the Law Revision Counsel. 18 U.S. Code 2515 – Prohibition of Use as Evidence of Intercepted Wire or Oral Communications
The Stored Communications Act
The Stored Communications Act, beginning at 18 U.S.C. § 2701, governs data already held by service providers after transmission. The government access rules depend on how long the data has been stored. For contents in electronic storage 180 days or less, the government must obtain a warrant based on probable cause. For contents stored longer than 180 days, the government can use a warrant, a subpoena, or a court order paired with prior notice to the account holder.6Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records A subpoena is a lower bar because no judge finds probable cause. Older stored data therefore gets less statutory protection, though many major providers now require warrants regardless of age as company policy.
Foreign Intelligence Surveillance and Section 702
Foreign intelligence collection runs under a separate framework, the Foreign Intelligence Surveillance Act.7Office of the Law Revision Counsel. 50 U.S. Code 1801 – Definitions Section 702, at 50 U.S.C. § 1881a, authorizes the Attorney General and the Director of National Intelligence to jointly approve the targeting of non-U.S. persons reasonably believed to be located abroad for the purpose of collecting foreign intelligence. The statute explicitly prohibits targeting anyone known to be inside the United States, targeting a person abroad as a pretext to surveil someone in the United States, or intentionally targeting a U.S. person anywhere in the world.8Office of the Law Revision Counsel. 50 U.S. Code 1881a – Procedures for Targeting Certain Persons Outside the United States
Congress reauthorized Section 702 in April 2024 through the Reforming Intelligence and Securing America Act, with a sunset date of April 20, 2026. The reauthorization permanently barred resumption of “abouts” collection, which had previously swept up communications that merely referenced a target rather than being sent to or from one. FBI agents querying Section 702 data with a U.S. person’s identifier must now get supervisor or attorney approval and provide a written factual basis. The law also established escalating consequences for noncompliant queries, including zero tolerance for willful misconduct.9Congress.gov. FISA Section 702 and the 2024 Reforming Intelligence and Securing America Act
Geofence Warrants
A geofence warrant runs the traditional warrant process in reverse. Rather than identifying a suspect and then searching their records, the government draws a virtual boundary around a crime scene and demands that a tech company identify every user who was inside the boundary during a specific time window. The Supreme Court granted review of the practice in January 2026 in Chatrie v. United States, a case in which the Fourth Circuit produced eight separate concurrences and a dissent reflecting what the Chief Judge called “widely divergent views.”10Congress.gov. Geofence and Keyword Searches – Reverse Warrants and the Fourth Amendment The Fifth Circuit has already held that geofence warrants amount to the kind of general warrant the Fourth Amendment prohibits.
The practical landscape is shifting too. Google, which received the vast majority of geofence warrant requests through its Sensorvault database, deleted all Location History data from Sensorvault by July 2025 and has indicated it can no longer respond to such warrants going forward.10Congress.gov. Geofence and Keyword Searches – Reverse Warrants and the Fourth Amendment Law enforcement has turned to Apple, Lyft, Snapchat, and Uber, so the technique is far from dead.
How Companies Collect and Sell Your Data
Data brokers purchase, aggregate, and resell personal information drawn from shopping records, public filings, browsing histories, and app usage. The profiles they build cover hundreds of millions of people and go to advertisers, insurers, and financial institutions assessing consumer risk or targeting marketing. Most consumers never interact with these companies directly and have no idea which brokers hold their information.
Social media platforms and advertising networks feed the same ecosystem by predicting your future behavior based on past activity. Every interaction trains the model further. Even when you are not actively using a platform, background tracking through cookies, embedded widgets, and device fingerprinting keeps your profile current. The information you generate influences what products you see, the prices you are offered, and the news that appears in your feed.
Personally identifiable information such as your name, address, and Social Security number anchors these profiles across platforms. Biometric data, including fingerprints, iris patterns, and facial geometry, is increasingly stored in digital formats for automated recognition. Unlike a password, biometric data cannot be changed once compromised, which is why several states have enacted specific laws regulating it. Metadata, meaning the record of who you called, when, for how long, and from where, does not include the content of conversations but can reconstruct social networks and daily routines with striking accuracy.
FTC Enforcement
No single federal statute comprehensively regulates commercial data collection. Instead, the Federal Trade Commission uses its authority under Section 5 of the FTC Act, which prohibits unfair and deceptive acts in commerce, to pursue the worst practices.11Federal Trade Commission. Privacy and Security Enforcement If a company promises in its privacy policy not to sell your location data and then sells it, that is a deceptive practice the FTC can pursue.
In January 2026, the FTC finalized an order against General Motors and OnStar for collecting and selling geolocation data without informed consumer consent.11Federal Trade Commission. Privacy and Security Enforcement The agency has also opened a rulemaking exploring whether it should set explicit prohibitions on specific commercial surveillance practices, including whether failure to provide privacy-protective default settings should be classified as an unfair practice on its own.12Federal Trade Commission. Commercial Surveillance and Data Security Rulemaking
Children Under 13
The Children’s Online Privacy Protection Act is the strongest federal restriction on data collection tied to age. COPPA covers operators of websites or online services directed at children under 13, and any operator with actual knowledge it is collecting information from a child under 13.13Federal Trade Commission. Children’s Online Privacy Protection Rule (COPPA) Covered operators must post clear privacy notices, obtain verifiable parental consent before collecting personal information, and give parents the ability to review and delete a child’s data.14Office of the Law Revision Counsel. 15 U.S. Code 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection with Collection and Use of Personal Information from and About Children on the Internet
The FTC enforces the rule, and courts can impose civil penalties up to $53,088 per violation. Because each affected child can be a separate violation, poor age-gating practices can produce enormous liability.15Federal Trade Commission. Complying with COPPA – Frequently Asked Questions
State Privacy Laws
Congress has not passed a comprehensive consumer data privacy law. Roughly 20 states have filled the gap. The details vary, but these laws generally give residents the right to know what data companies collect, request deletion, opt out of the sale of personal information, and correct inaccurate records. Enforcement typically falls to state attorneys general, and in some jurisdictions civil penalties reach $7,500 per intentional violation.
A few states go further for specific data categories. Illinois, for one, imposes a private right of action for the collection of fingerprints or facial geometry without informed consent. The result is a compliance patchwork where a company’s obligations, and your rights, depend heavily on where you live.
Workplace Monitoring
No single federal law specifically governs employer monitoring of employee communications or computer usage. Workplace surveillance sits at the intersection of the Wiretap Act, which generally allows monitoring when the employer is a party to the communication or has given notice, and federal labor law.
The National Labor Relations Board’s General Counsel issued a memo warning that intrusive electronic monitoring can violate workers’ rights under Section 7 of the National Labor Relations Act, which protects private-sector employees’ ability to join together to improve working conditions. The memo proposes that an employer presumptively violates the NLRA if its monitoring practices, viewed as a whole, would tend to discourage a reasonable employee from engaging in protected activity.16National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices Wearable tracking devices, GPS badges, keyloggers, and software that takes screenshots or activates webcams were all flagged as concerning. Several states have their own workplace monitoring laws, with rules ranging from written notice requirements to outright bans on surveillance in employees’ homes and personal vehicles.
Financial Transactions Are Reported Regardless
One area where surveillance operates independent of your preferences is banking. Under the Bank Secrecy Act, financial institutions must file a Currency Transaction Report for cash transactions exceeding $10,000, using FinCEN’s CTR Form 112.17FinCEN.gov. Bank Secrecy Act Filing Information Banks also file Suspicious Activity Reports when transactions appear to involve potential violations of law, regardless of dollar amount. Structuring deposits to stay under the $10,000 threshold is itself a federal crime, and banks are trained to spot the pattern. Large transactions and suspicious patterns of smaller ones both feed a federal database accessible to law enforcement and intelligence agencies.
How to Reduce Your Exposure
Complete avoidance is not realistic if you use the internet or carry a phone, but you can meaningfully shrink your footprint. Reject browser cookies whenever possible and use browsers designed to limit cross-site tracking, such as Firefox or Brave. Some browsers support Global Privacy Control, a setting that sends a universal do-not-track signal across all browsing in one step.
Turn off GPS on your phone when you are not actively using navigation. That one change stops the continuous accumulation of location data by apps and carriers. Review app permissions regularly and revoke location, microphone, or camera access for any app that does not clearly need it.
For data already collected, several state laws now give residents the right to request deletion from data brokers. California operates a centralized mechanism that lets you request deletion from all registered brokers at once. Outside states with formal deletion rights, many brokers still honor opt-out requests submitted directly, and dedicated services can automate much of the tedious work.
None of this eliminates surveillance. Your ISP still sees your traffic unless you use a VPN, and financial transaction reporting operates at the institutional level regardless of what you do. But the profile that accumulates on someone who takes no precautions and someone who manages their settings deliberately looks very different over time.