OAKLAND - California Attorney General Rob Bonta today, alongside a coalition of 17 attorneys general, called on Congress to take immediate action to halt federal agencies' use of commercially purchased data and artificial intelligence tools that enable mass surveillance of Americans without judicial, legislative, or public oversight. The letter calls on Congress to close the data-broker loophole, require warrants for federal access to Americans' digital data, prevent domestic surveillance via foreign intelligence laws, mandate deletion of unlawfully collected information and related AI models, and establish nationwide transparency and accountability standards for data brokers.

"Every day, we give off a steady stream of data that broadcasts not only who we are, but where we go. This data is deeply personal, can identify your everyday habits and movements, and can be bought. Data brokers compile, package, and sell this information to various entities, typically without a consumer even knowing," said Attorney General Bonta. "California boasts the nation's most robust privacy protection law to give consumers control over their data, but no such federal privacy framework exists, allowing the federal government potential access to this trove of data once it has been collected. Allowing federal agencies to buy or compile, analyze, and use large profiles of information about Americans without limits, oversight, or accountability undermines the public's faith in our system of governance and is dangerous for democracy. In light of federal assaults on immigrant and LGBTQ+ communities, and on gender-affirming healthcare and abortion providers, I urge Congress to take action now and limit the ability of the federal government to deploy mass surveillance on Americans."

Data comes from nearly everywhere online, even when people think they're not revealing anything. Websites, apps, and software can track and amass personal information and behavioral data like pages visited, detailed purchase information, location data, health information, and more in order to create and share profiles and inferences about consumers. These businesses often sell information to third-parties that then amass whole profiles on consumers. The federal government has not kept up with California and other states in protecting consumers from these practices.

In the letter sent to the leadership of the U.S. Senate Committee on Homeland Security and Governmental Affairs and House Committee on Oversight and Accountability, Attorney General Bonta and the coalition warn that federal agencies are exploiting a "data broker loophole" to obtain detailed information about Americans' movements, associations, political activity, and daily lives - information the government would otherwise be required to obtain through a warrant or pursuant to other legal procedures. The attorneys general cite recent examples - including federal agencies' purchase of billions of airline ticketing records and mobile location data from commercial brokers - that reveal a pattern of warrantless surveillance through the acquisition of massive datasets. Several of these practices have already drawn bipartisan concern in Congress and the public after media reporting uncovered the federal government's ability to track individuals' travel, movements, and daily routines.

The attorneys general urge Congress to enact comprehensive reforms, including measures that would:

• Prohibit federal agencies from purchasing data that would otherwise require a warrant to obtain.
• Require judicial warrants before accessing Americans' web browsing activity, search queries, and location information.
• Ensure intelligence agencies cannot circumvent limits on domestic surveillance by exploiting foreign intelligence authorities or third-party vendors.
• Mandate deletion of unlawfully collected data and any algorithms trained using such data.

Joining Attorney General Bonta in sending this letter are the attorneys general of Colorado, Connecticut, Hawai'i, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, Oregon, Vermont, Virginia, and Washington.

California's Privacy Laws

The California Consumer Privacy Act (CCPA) vests California consumers with control over the personal information that businesses collect about them, including the right to request that businesses stop selling or sharing your personal information. With some exceptions, businesses cannot sell or share your personal information after they receive your opt-out request unless you later provide authorization allowing them to do so again.

The Delete Request and Opt-out Platform (DROP), developed by the California Privacy Protection Agency (CalPrivacy), gives Californians more control over their personal information and helps limit the information that data brokers sell. With the launch of DROP earlier this year, Californians have a safe and secure way to protect their privacy. The tool - made possible by the Delete Act (Becker, 2023) - transmits a single deletion request telling over 500 registered data brokers to delete all the personal information they have about you and to not sell your data going forward. For more information about DROP and how Californians can submit a deletion request, visit: privacy.ca.gov/drop.