Experts tell CPPA federal purchases of adtech and location data enable ‘reverse searches’; advocates urge state and federal limits

A group of technologists, former government lawyers and civil-rights advocates told the California Privacy Protection Agency on April 30 that commercially collected data — mobile location feeds, adtech bid streams and data-broker repositories — can be assembled or compelled to create precise, searchable dossiers that law enforcement or federal agencies may use without the traditional warrant protections.

Richard Salgado (Salgado Strategies LLC), formerly a Google law-enforcement director, framed the legal problem under existing statutes. He said the Electronic Communications Privacy Act divides data into content, metadata and basic subscriber information, but modern sensors and apps have blurred these distinctions. He warned of "reverse searches" — requests that a provider search across many user accounts or across a provider's corpus for matches — and raised the routine use of gag orders. "Meta ... said it was something like 77% of the orders they get come with these gag orders," Salgado said, noting that routine secrecy prevents users from knowing their accounts were searched.

Dr. Nathan Good and Jennifer Chen of Good Research explained the technical pathways that make such searches and re-identification possible. Good described mobile apps as assemblages of third-party SDKs — "Legos" developers drop into code — that can leak location and sensor signals to multiple downstream databases. He singled out "bridging" as a critical risk: when ephemeral identifiers are tied to persistent IDs, protections attached to ephemeral signals dissolve and re-identification becomes straightforward.

Civil-rights advocates linked those mechanics to concrete harms. Jacob Snow (ACLU Northern California) described a data-science exercise that reconstructed his own home, workplace and family routines from location logs and emphasized real-world examples where location purchases were later used in immigration enforcement. "It showed my home. It showed the place where I work. It showed my children's elementary school," Snow said, warning that such dossiers make surveillance of marginalized communities easier.

Policy responses discussed at the hearing ranged from state-level data-minimization and stronger transparency to targeted statutory bans on government purchases. Several presenters urged the Fourth Amendment Is Not For Sale Act (federal) and pointed to Montana’s state law as a model; others encouraged California to use the CCPA’s purpose-limitation and the Delete Act’s registration requirements to force greater transparency about who sells location data to government buyers.

Industry perspective: David Leuk of the Network Advertising Initiative said the advertising industry opposes non-consensual sales to law enforcement and supports narrowly tailored prohibitions that prevent repurposing of advertising data while preserving legitimate, privacy-protective commercial uses. He cautioned that overly broad bans could advantage vertically integrated platforms that monetise first-party data without relying on third-party markets.

What the board heard: Experts agreed that technical fixes and stronger front-end minimization will help, but they emphasized legal constraints are needed to stop government purchase or compelled searches of commercial data — including clearer notice and judicial limits on reverse searches and nondisclosure orders.

Next steps: Panelists urged CPPA staff to consider regulatory guidance clarifying that commercial-use disclosures do not cover government surveillance uses, to push for state coordination, and to track related federal legislation and procurement practices.