On August 20, a coalition of civil rights groups filed a formal complaint with Maryland Attorney General Anthony G. Brown, asking him to investigate seven data companies for selling residents' location data and personal information to police and federal immigration authorities in violation of state law. The Maryland Online Data Privacy Act took effect July 1. It bars data brokers from sharing residents' location data with law enforcement without a warrant or subpoena, and bans sales to immigration enforcement without any judicial process. The complaint names Penlink, Thomson Reuters, Motorola, LexisNexis, Flock Safety, Insight LPR, and ThunderCat Technology — several of which hold active ICE contracts. Georgetown University Law Center's Technology Law Clinic filed it on behalf of We Are CASA and 11 other organizations, including the Center for Democracy & Technology.

1. Maryland Has the Law. Now It Needs to Enforce It. (We Are CASA, Georgetown Law, CDT)

Privacy and civil rights groups say the law is clear — the state just needs to use it.

Immigrant families are already hiding. George Escobar, executive director of We Are CASA, says his organization has watched parents grow afraid to update their addresses with state agencies, and individuals avoid institutions that collect personal data — even ones they're eligible to use. That behavioral change is happening now, before any enforcement action.

The Supreme Court just backed Maryland's legal theory. The Court ruled 6-3 in Chatrie v. United States (June 2026) that police need a warrant before collecting location data through geofence searches. Maryland's law extends the same logic to commercial data sales. If police need a warrant to compel Google to hand over location data, they should need one to buy the same data from a broker. Laura Moy, director of Georgetown Law's Technology Law Clinic, says Marylanders "should be able to feel secure" in their Fourth Amendment rights.

The ask is enforcement, not new rules. The complaint calls on Brown to investigate all seven named companies and take enforcement action. Zainab Chaudry, director of CAIR Maryland, said people shouldn't have to fear that police are tracking their movements and associations without a warrant. Congress still hasn't passed a federal law closing the data broker loophole. If Brown acts, Maryland's enforcement would be one of the first real tests of a state-level fix.

The named companies deny violating the law and point to court precedent supporting their products.

Thomson Reuters and Penlink flatly deny the allegations. Thomson Reuters stated it's "confident that we are in compliance with all applicable laws and regulations." Penlink said "the allegations against Penlink in the complaint are false, as Penlink does not process or sell precise location data of Marylanders in accordance with Maryland privacy law."

Public license plates aren't what Maryland's law restricts. Flock Safety describes its automated license plate readers as "a limited, vehicle-focused, point-in-time tool." It argues that's not the kind of "pervasive, identity-based surveillance the Fourth Amendment forbids." It cites State v. Simonson, where a Washington state court held that ALPR data captured on public roads didn't implicate constitutional privacy protections. Flock also tightened its data-sharing safeguards in August amid growing scrutiny from states and cities.

3. Still, Law Enforcement Says Buying Data Is Different from Searching for It. (ICE, DHS)

Federal agencies argue that purchasing commercial data isn't a "search" under the Fourth Amendment.

No federal court has called buying location data a Fourth Amendment search. Government agencies have argued that the Fourth Amendment restricts "compulsion" of data, not market participation. ICE has explicitly argued that buying mobile advertising location data differs from the cell-site location searches the Supreme Court restricted in 2018. Because data brokers are private entities, the government argues their data collection isn't government action — and therefore isn't subject to constitutional limits.

This technology solves violent crimes and finds missing people. Police departments credit ALPR and location data tools with closing cases ranging from car theft to homicide. For understaffed departments, commercial data tools let a small team surveil far more ground than they could on their own. DHS signed a $1 billion contract with Palantir in February 2026 for AI-powered analytics across all DHS components, including ICE and CBP.

Three Supreme Court justices still agree with the government on this. In Chatrie, Justice Alito's dissent — joined in part by Justices Thomas and Barrett — argued the third-party doctrine should govern these cases: data shared with a private company loses Fourth Amendment protection. Alito warned the majority was causing an "upheaval in Fourth Amendment law." Courts and federal agencies still disagree on where the line falls — and no ruling has settled it at the federal level.

Where This Lands

Maryland's complaint hands AG Anthony G. Brown a decision that Congress has dodged for years. Privacy advocates say Maryland's law is clear and the named companies are already breaking it; the companies say they're compliant and their products are constitutionally protected. Law enforcement and the data brokers agree on a legal theory — one that three Supreme Court justices still back: buying commercial data isn't a Fourth Amendment search. Brown hasn't signaled whether he'll open an investigation.

Sources