Unbiased

Did seven data brokers break Maryland's new privacy law, or is the law reaching past what they sell?

A coalition wants Attorney General Anthony Brown to act against Penlink, Flock, Thomson Reuters and four other firms under a statute barely two months old, one whose reach turns on whether a license-plate scan is sensitive location data.

8 min read2026-08-21

The definition that decides how far the statute reaches

A privacy coalition told Maryland's attorney general this week that seven companies are selling residents' movements to police departments and to firms that help federal agents find people to deport. The data is granular: where a phone sleeps at night, where a car was parked at noon. Maryland's data-privacy statute, seven weeks on the books, forbids exactly that, the coalition says.¹ The companies say the statute does not reach what they sell.² Both readings cannot be right, and nothing in the law's short life has settled which is.

The complaint runs 29 pages, filed on August 20 with Attorney General Anthony Brown. Georgetown Law's Technology Law Clinic wrote it for the immigrant-rights group We Are CASA and eleven other organizations, among them the Center for Democracy & Technology and the Electronic Privacy Information Center.¹² It names seven firms. Penlink sells cell-phone location data through a program called Webloc. Flock Safety, Motorola Solutions, and Insight LPR sell vehicle locations captured by automated license-plate readers. Thomson Reuters and LexisNexis fold such records into the CLEAR and Accurint databases they sell to law enforcement and to Immigration and Customs Enforcement. ThunderCat Technology supplies ICE's investigative arm with taxpayer-identification data.²³

What each named firm sells, and the buyer the complaint objects to.²³
Firm	What it sells	Buyer at issue
Penlink	Cell-phone location, via its Webloc program	Police, and buyers tied to immigration work
Flock Safety	Vehicle location from license-plate readers	Police networks
Motorola	Vehicle location from license-plate readers	Police
Insight LPR	Vehicle location from license-plate readers	Police
Thomson Reuters	CLEAR: location plus personal records	Law enforcement and ICE
LexisNexis	Accurint: aggregated personal records	Law enforcement and ICE
ThunderCat	Taxpayer-identification (ITIN) data	Homeland Security Investigations, part of ICE

The law is the Maryland Online Data Privacy Act, amended this year by House Bill 711 and in force since July 1.⁴⁵ Two of its features make the complaint possible. The first is a flat prohibition. A controller "may not ... sell sensitive data," and "sensitive data" includes "precise geolocation data."⁴ House Bill 711 rewrote that definition to cover not just a person but "a mobile device, or a vehicle," each located "within a radius of 1,750 feet."⁴ A phone ping and a plate scan both fix a point on a map to within a third of a mile, which is what the definition now describes.

The second feature is aimed at immigration enforcement by name, a provision no other state's privacy law carries.² A controller may not "knowingly sell the personal data of a consumer to a ... governmental unit that ... has ... supported civil immigration enforcement through the provision of personnel or material resources."⁴⁶ The bar looks back six months, and it reaches a unit that merely supported such enforcement, not only one that carried it out.⁴ A controller also may not sell to a buyer it knows "seeks to use the personal data for the purpose of immigration enforcement."⁴ A separate rule governs the broker's usual answer, that it merely obeys legal process. The Act lets a controller comply with a subpoena or summons "except to the extent" the demand "pertains solely to immigration enforcement."⁴ What lifts the bar is narrower: "a valid warrant issued by a federal or State court that particularly describes the personal data to be accessed."⁴ The same warrant-not-subpoena rule carries over to motor-vehicle records held by the state.⁴

The rule in one line

For data headed to immigration enforcement, a subpoena or an administrative summons is not enough. Only a judge's warrant that names the specific data will do.⁴⁷

Behind the statutory questions sits a constitutional one. Selling information is not plainly the kind of conduct a state may forbid at will. In 2011 the Supreme Court held that "the creation and dissemination of information are speech for First Amendment purposes," and struck down a Vermont law that restricted the sale of pharmacy records showing what doctors prescribed.⁸ Whether that ruling shelters the sale of location data to a disfavored buyer is the argument each side saves for last.

Sorrell v. IMS Health Inc. U.S. Supreme Court · No. 10-779

Stage: Decided 6-3, June 2011; the Vermont statute struck down
Question: May a state restrict the sale and use of truthful data as a limit on commercial speech?
Stakes: Whether laws that limit who may buy data face heightened First Amendment scrutiny

The attorney general's first decision is about neither immigration nor the First Amendment. It is whether a plate scan and a phone ping are the "sensitive data" the Act protects or the "publicly available information" it exempts.⁴ Most of the rest follows from that one call, and it is where the two positions first divide.

Selling it is already the violation

The captured data is sensitive personal data, so selling it is barred on its face; the immigration-buyer rule and the warrant requirement reach these transfers on their own; the attorney general should investigate and enforce.

Start with the plainest reading. Precise geolocation is sensitive data, and the Act says a controller may not sell sensitive data.⁴ That prohibition carries no exception for consent, for a subpoena, or for a warrant. It is a rule about the product, not the process.⁴ House Bill 711 extended "precise geolocation" to a vehicle's position. So the plate scans that Flock, Motorola, and Insight sell, and the phone locations Penlink sells, enter the protected category the moment they fix a spot to within 1,750 feet.⁴ Outside analysts read the Act the same way, as one that "strictly prohibits the sale ... of sensitive data."⁹ On this reading the sale is over the line before any question about the buyer arises.

The immigration provisions then reach the buyers directly. Selling personal data to a government unit that recently supported civil immigration enforcement is forbidden, and so is selling to any buyer that seeks the data for immigration enforcement.⁴ Thomson Reuters' CLEAR and LexisNexis's Accurint already feed ICE, and ThunderCat supplies its investigators with taxpayer data.²³ ICE's own planned CLEAR contract, a five-year $125 million deal it later moved to recompete, bundled nationwide vehicle-location tools of just this kind.¹⁰ The sales the complaint describes are the sales the text names. The brokers' standard answer, that they respond only to lawful process, meets a rule written to defeat it. A subpoena or administrative summons aimed at immigration enforcement does not count, and only a court warrant naming the specific data does.⁴ Reviewers of the motor-vehicle provisions read them to reject "detainers or administrative subpoenas" and to require "a warrant signed by a state or federal judge."⁷

Laura Moy, who directs Georgetown Law's Technology Law Clinic and wrote the complaint, frames the harm as a commercial one. Companies, she says, "must not be allowed to profit off of giving agencies a 'data broker loophole.'"¹ Her clinic built the legal theory the attorney general is now asked to adopt, which gives her the standing of the argument's author.

The Act does not reach data taken from public view

Much of this data is publicly available information the Act never covers, and federal law separately authorizes the motor-vehicle disclosures. A ban keyed to who the buyer is then collides with a First Amendment that protects selling truthful information.

The Act protects "personal data," and by its own terms "personal data" does not include "publicly available information."⁴ A license plate sits in public view, bolted to a car on a public road. A fixed camera that photographs it records what any passerby could see. If a plate scan is publicly available information, its sale sits outside the sensitive-data ban, because it never enters the defined category at all.⁴ Penlink makes the parallel claim for its own product, telling NPR that it "does not process or sell precise location data of Marylanders in accordance with Maryland privacy law."² Its position is that Webloc's data is not the covered category, not that selling covered data would be fine.

Federal law complicates the motor-vehicle piece. The Driver's Privacy Protection Act bars a state motor-vehicle department from releasing a driver's personal information. But it permits release "for use by any government agency, including any court or law enforcement agency, in carrying out its functions."¹¹ Maryland's statute in turn exempts data disclosed "to the extent necessary to comply as required by" that federal law.⁴ Where Congress has authorized a disclosure to law enforcement, a state ban on the same disclosure invites a preemption fight, and the defense can argue the records fall in the exempted channel rather than the prohibited one.¹¹

The constitutional argument cuts deepest at the immigration-buyer rule. That rule does not forbid collecting the data or selling it generally. It forbids selling to one class of buyer, defined by what the buyer does. Sorrell struck a Vermont law for imposing "content- and speaker-based burdens on protected expression," and subjected it to "heightened judicial scrutiny."⁸ A ban on selling truthful location data to agencies that support immigration enforcement draws its line by the buyer's identity and purpose, the speaker-based kind Sorrell viewed with suspicion. Whether Maryland's interest in shielding immigrants clears that scrutiny is unsettled, and the defense need only raise the doubt to slow an enforcement action.⁸

Penlink, one of the named brokers and the only one selling phone-derived rather than plate-derived location, denies the premise. The allegations "are false," it told NPR, because it does not sell the "precise location data of Marylanders" the law reaches.² Thomson Reuters says it is "confident" it complies with "all applicable laws."² As the firms most directly accused, they hold that the statute, read correctly, leaves their products alone.

The definition that decides how far the statute reaches

Selling it is already the violation

The Act does not reach data taken from public view

Sources