Saturday morning, you head to the hardware store. A nearby Ring camera is filming you as you walk to your car. Your car’s sensors, cameras, and microphones record your speed, how you drive, where you go, who’s with you, what you say, and biological indicators such as facial expressions, weight, and heart rate. The car may also collect text messages and contacts from connected smartphones.
During that time, your phone continuously senses and records your communications, health information, the apps you use, and tracks your location via cell towers, GPS satellites, Wi-Fi, and Bluetooth.
When you enter the store, surveillance cameras identify your face and track your movements in the aisles. Then, when you make a purchase using Apple or Google Pay, your phone tracks what you buy and how much you pay.
All this data is immediately available for commercial use and is bought and sold by data brokers. Data aggregated and analyzed by artificial intelligence reveals detailed sensitive information about you that can be used to predict and manipulate your behavior, including what you buy, feel, think, and do.
Companies unilaterally collect data from most of your activities. This “surveillance capitalism” is often independent of the services provided by device manufacturers, apps, and stores. For example, Tinder plans to use AI to scan your entire camera roll. And despite that promise, “opting out” doesn’t actually stop companies from collecting your data.
Corporations can manipulate you, but they can’t put you in jail. But the U.S. government can and now buys vast amounts of personal information from commercial data brokers. The government can purchase sensitive data on American citizens because the information it purchases is not subject to the same restrictions as information it collects directly.
The federal government is also increasing its ability to collect data directly through partnerships with private technology companies. As advances in AI bring surveillance to unprecedented levels, these surveillance technology partnerships are solidifying nationally and internationally.
As a privacy, electronic surveillance, and technology law attorney, author, and legal educator, I have spent years researching, writing, and advising on privacy and legal issues related to surveillance and data use. To understand the issue, it’s important to know how these technologies work, who collects what data about you, how that data is used against you, and why the laws that supposedly protect your data are not being applied or being ignored.
Sebastian Winau/Photography partnership via Getty Images
Big money will go into AI-driven technology and more data
Congressional funding has led to a surge in government investment in surveillance technology and AI-driven data analytics that automates the analysis of large amounts of data. The massive Tax and Spending Act of 2025 gave the Department of Homeland Security an unprecedented $165 billion in annual funding. Immigration and Customs Enforcement, part of DHS, received about $86 billion.
The release of documents allegedly hacked from the Department of Homeland Security reveals a massive surveillance network that includes all Americans.
DHS is rapidly increasing its contracts with private companies to expand its AI surveillance capabilities. The company is reportedly funding a company to increase automated AI surveillance at airports. An adapter that turns an agent’s phone into a biometric scanner. and an AI platform that takes all 911 call center data and builds geospatial heat maps to predict incident trends. Predicting incident trends can be a type of predictive policing that uses data to predict where, when, and how crimes will occur.
DHS also spent millions of dollars on AI-driven software used to detect sentiment and emotion from users’ online posts. Have you ever complained about Immigration and Customs Enforcement policies online? If so, social media companies including Google, Reddit, Discord, and Facebook, as well as Meta, the owner of Instagram, may have sent identifying data to DHS, including your name, email address, phone number, and activity, in response to hundreds of DHS subpoenas served on these companies.
Meanwhile, the Trump administration’s National Policy Framework for Artificial Intelligence, announced on March 20, 2026, calls on Congress to use subsidies and tax incentives to fund “widespread deployment of AI tools across U.S. industry” and to allow industry and academia to train AI using federal datasets.
This use of federal datasets raises privacy law concerns because they contain sensitive information about individuals over their lifetimes, such as biographical, employment, and tax information.
Blurred lines and small oversights
For foreign intelligence operations, the funding, development, and controlled use of specific AI-enabled data collection makes sense. The CIA’s new acquisition framework to encourage collaboration with the private sector could be legal with proper oversight. But the line between legitimate national security cooperation and illegal domestic espionage is becoming dangerously blurred or ignored.
For example, the Department of Defense declared the contractor Anthropic a national security risk. This is because Anthropic insisted that its powerful agent AI model, Claude, not be used for mass surveillance of American citizens domestically or for fully autonomous weapons.
On March 18, 2026, FBI Director Kash Patel admitted to Congress that the FBI is purchasing data on American citizens, including location history, from data brokers in order to track them.
The federal government is accelerating the use and investment in AI-driven spying technology and mandating less oversight of AI technology. In addition to the National AI Policy Framework to discourage state regulation of AI, the president has issued executive orders to accelerate federal adoption of AI systems, remove barriers to state law AI regulation, and require the federal government to refrain from procuring the use of AI models that attempt to adjust for bias. However, the use of advanced AI systems comes with risks, given reports of AI agents misbehaving, leaking sensitive data, and even posing a threat during day-to-day operations.
your data
Surveillance capitalist systems require people to unknowingly participate in operational cycles of collective surveillance and self-surveillance. Neighborhood doorbell cameras, Flock license plate readers, and hyperlocal social media sites like Nextdoor create crowdsourced records of everyone’s movements in public spaces.
Justin Sullivan via Getty Images
Sensors in phones and wearable devices like earbuds and rings collect more sensitive details than ever before. These include health data such as heart rate and heart rate variability, blood oxygen, sweat and stress levels, behavioral patterns, neurological changes, and even brain waves. Smartphones can be used to diagnose, evaluate, and treat Parkinson’s disease. Earphones could be used to monitor brain health.
This data is not protected by HIPAA, which prohibits health care providers and their collaborators from disclosing your health information without your authorization. This is because the law considers tech companies to be healthcare providers and does not consider these wearables to be medical devices.
legal protection
When people buy a device, use an app, or open an account, they have little choice but to agree to long terms that include consent for companies to collect and sell their personal data. This “consent” allows their data to flow into largely unregulated commercial data markets.
The government claims this data can be legally purchased from data brokers. But when the government buys your data in bulk on the commercial market, it is circumventing the Constitution, Supreme Court decisions, and federal laws designed to protect your privacy from unwarranted government overreach.
The Fourth Amendment prohibits unreasonable searches and seizures by the government. The Supreme Court case requires police to obtain a warrant to search a cell phone or use cell phone or GPS location information to track someone. The Communications Interception Act of the Electronic Communications Privacy Act prohibits the unauthorized interception of wire, oral, and electronic communications.
Despite several efforts, Congress has been unable to enact legislation to protect data privacy, the use of sensitive data by AI systems, or restore the intent of the Electronic Communications Privacy Act. The court has allowed companies that insist on consent to water down the broad electronic privacy protections in the Federal Wiretap Act.
In my opinion, the way to begin to address these issues is for Congress to follow through on its promises and efforts by restoring the Wiretap Act and related laws to their original purpose of protecting Americans’ privacy in communications, and passing legislation to ensure Americans’ data privacy and protect them from harm by AI.
This article is part of a series on data privacy that explores who collects your data, what and how they collect it, who sells and buys your data, what they do with it, and what you can do about it.
