An automatic license plate reader (ALPR) camera monitors traffic on August 19, 2026 in Silver Spring, Maryland.<\/p>\n
Chip Somodevilla\/Getty Images<\/p>\n
hide caption<\/p>\n
Maryland has passed some of the strictest data privacy provisions in the country. But privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders' geolocation data, as well as selling information to federal immigration authorities.<\/p>\n
A coalition of privacy and civil rights groups filed a consumer complaint Wednesday that calls on the state attorney general to investigate specific companies and take enforcement action against them. The complaint comes as U.S. Immigration and Customs Enforcement has been ramping up its use of commercially-available personal data and surveillance tools to track and deport immigrants as well as monitor protesters.<\/p>\n
Two of the named data brokers, Penlink and Thomson Reuters, denied the allegations and told NPR they were in compliance with the law.<\/p>\n
The complaint alleges Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety and others, are collecting and selling personal information and location data on Maryland residents to law enforcement customers in violation of state privacy law. Penlink sells cell phone location data through its Webloc program, while the other companies sell car location data captured by license plate readers.<\/p>\n
Several of the named companies have contracts with ICE, including Penlink. Thomson Reuters and LexisNexis provide data tools to ICE that contain a wide range of personal information from public records and proprietary data sources.<\/p>\n
The complaint also names ThunderCat Technology, which has a contract with Homeland Security Investigations, which is part of ICE, to provide the agency with individual taxpayer identification numbers (ITIN) data.<\/p>\n
The complaint calls on Maryland Attorney General Anthony G. Brown to "use the full force" of the state's strong privacy laws, "and take immediate action to rein in agencies' use of commercially purchased data that enables mass surveillance of Americans without judicial, legislative, or public oversight."<\/p>\n
Georgetown University Law Center's Technology Law Clinic authored the consumer complaint on behalf of We Are CASA, which advocates for working class, Black, Latino, Indigenous and immigrant rights, and 11 other organizations that focus on privacy and civil rights, including the Center for Democracy & Technology and the Electronic Privacy Information Center.<\/p>\n
"Through our direct services programming, we have witnessed parents worried about updating their address with state agencies, individuals increasingly cautious about engaging with any institution that collects personal data, even if they meet the program's eligibility requirements," said George Escobar, the executive director of We Are CASA in a statement.<\/p>\n
"Ensuring a more equitable Maryland for all starts with an investigation of these data companies and strict enforcement of our values as laid out in state law," the statement continued.<\/p>\n
A statement provided to NPR by Thomson Reuters reads, "We are confident that we are in compliance with all applicable laws and regulations governing our business and operations." The company specifies on its website that the license plate recognition product it offers, "is not capable of tracking real time locations of a vehicle; it provides access to ad hoc images collected randomly."<\/p>\n
Penlink also denied that it was violating state law.<\/p>\n
"The allegations against Penlink in the complaint are false, as Penlink does not process or sell precise location data of Marylanders in accordance with Maryland privacy law," reads a company statement provided to NPR. "Penlink complies with applicable U.S. privacy laws and data-broker regulations, and we will continue to update our practices as data and privacy laws evolve."<\/p>\n
Maryland's law defines "precise geolocation data" as "information derived from technology that can precisely and accurately identify, within a radius of 1,750 feet, the specific location of a consumer, a mobile device, or a vehicle."<\/p>\n