Who Is Buying Your Location Data?

Two things generate a continuous record of where you go: the phone in your pocket and the license plate on your car. Both produce data that companies collect and sell, and most people have no idea the market exists. On August 19, 2026, a coalition of privacy and civil rights groups filed a 29-page complaint asking Maryland's attorney general to investigate seven companies over exactly this, alleging they are selling Marylanders' location data in violation of one of the strictest state privacy laws in the country. The companies named deny wrongdoing. Whatever the outcome, the filing is a useful window into an industry that operates almost entirely out of view.

What does the complaint allege?

The coalition names Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety, and ThunderCat Technology, alleging they collect and sell precise location data about Maryland residents to law enforcement customers in violation of state privacy law. According to the filing, Penlink sells cell phone location data through a program called Webloc, while several of the others sell vehicle location data captured by automated license plate readers. A number of the named companies hold state or federal contracts, including with immigration authorities.

It is worth stating clearly that these are allegations in a consumer complaint, not findings. Penlink and Thomson Reuters both denied the allegations and told NPR they are in compliance with the law. Maryland's attorney general has not commented, and no investigation has been confirmed. Reasonable people disagree about when law enforcement should be able to buy commercial data, and this post is not the place to settle that. The mechanics underneath, though, apply to everyone regardless of where they land on the policy question.

Why is Maryland the flashpoint?

Because Maryland wrote an unusually strict rule. The Maryland Online Data Privacy Act, passed in 2024 with further updates taking effect in July 2026, treats precise location as sensitive data and prohibits selling it except in narrow circumstances. Most state privacy laws let you opt out of data sales. Maryland's approach is closer to a ban on selling sensitive categories at all, which means the question is not whether residents consented but whether the sale should have happened in the first place. That is why a complaint like this is possible there and would be much harder to bring in most other states.

Where does location data actually come from?

Three main pipelines, and you interact with all of them without noticing:

• Apps on your phone. Location permissions granted for a legitimate feature often feed advertising and analytics pipelines that resell the data onward, which we cover in how apps track and sell your data.
• Automated license plate readers. Cameras mounted on poles, patrol cars, and tow trucks photograph plates continuously, building a searchable history of where a specific vehicle has been, explored in cameras logging where you drive.
• Your carrier and your car. Mobile network operators and connected vehicles both generate location records, discussed in did your phone company sell your location and is your car selling your driving data.

The license plate pipeline is the one people underestimate, because there is no permission prompt, no app to delete, and no setting to change. A camera photographs a public road, and you happen to be driving on it.

Why is location considered so sensitive?

Because a pattern of places is a pattern of facts about you. Where you sleep, where you work, which clinic you visited, which place of worship you attend, whose house you stayed at overnight, and which protest you stood in. None of that requires anyone to read a message or open a file. It is inferred from coordinates and timestamps, and it is remarkably hard to explain away. That is why legislators who exempt most data categories still tend to single out precise location, and why it commands a premium in the commercial market.

What can you actually do about it?

Being straight with you: some of this is outside individual control. You cannot opt out of a license plate reader photographing a public street, and removing your listings from people-search sites does nothing whatsoever to stop it. Any service telling you otherwise is selling a fantasy. What you can influence divides into two parts.

The first is supply from your phone, and this is genuinely effective. Audit location permissions and set anything that does not need constant access to while using or never, turn off advertising identifiers, and be sceptical of free apps requesting background location. That alone cuts a large share of the commercial location feed.

The second is the identity layer, which is where the connection to broker removal is real but narrower than headlines suggest. A location trail on its own is a set of coordinates tied to a device or a plate. It becomes a story about a named person when it is joined to identity records: this plate belongs to this registered owner, at this address, with these relatives. People-search and data broker sites publish that joining material openly. Removing it does not stop the tracking, but it makes the trail harder to attach to you by name, and it addresses the exposure that shows up in scams, doxxing, and someone locating your home. That layer needs maintaining, since listings rebuild from fresh public records. Consumer Reports found that opt-outs done by hand or by automation cleared only about 27 percent of exposed listings, while removals run by real people who monitor and refile reached roughly 70 percent.

Frequently asked questions

Can I opt out of license plate readers?

Not as an individual, in general. The cameras photograph public roads and there is no consumer opt-out. Some states restrict how long the data may be retained or who it can be shared with, so the meaningful lever here is state law rather than a personal setting.

Does turning off location services solve the problem?

It helps a great deal with app-sourced data, which is a major pipeline, but it does not affect carrier network records, connected car telematics, or license plate cameras. Treat it as closing the largest door rather than all of them.

Is selling location data legal?

It depends entirely on your state. A few states, including Maryland, restrict the sale of precise location outright, and others have recently moved to ban selling it. In states without such rules there is no comprehensive prohibition, which is why the same commercial practice can be lawful in one place and contested in another.

Would removing my data broker listings hide my car?

No. Removal has no effect on cameras, carriers, or vehicle telematics. Its value here is limited to reducing the public records that link a name and home address to a person, which is a real but separate exposure from location tracking itself.