Your Digital Footprint

While you read this page

Reading this page takes about two minutes. In that time, your phone will check in with Google once or twice, even if it stays in your pocket. Your presence on this site has already been auctioned: the moment a page with ads loads, your location and interests go out to hundreds of bidding companies. If a smart TV is on in the room, it is photographing its own screen right now and uploading a fingerprint of whatever is playing — every 15 seconds on an LG, every minute on a Samsung.

None of that is hypothetical. Each number in this report comes from a measurement study or a regulatory filing, and each one is about an ordinary person with default settings. Not a suspect, not a public figure. You.

Somewhere in Arkansas, and in a few dozen other places, there is a file about you. You never opened an account. There is no login. You cannot read it. But it is for sale, and it is startlingly complete.

The Federal Trade Commission opened nine data brokers' books in 2014 — firms like Acxiom, CoreLogic, and Datalogix — and found they held data on almost every U.S. household. One broker carried 3,000 separate attributes on nearly every American consumer. Another held 1.4 billion consumer transactions and 700 billion data elements. A third was adding three billion records a month. Your file draws from bankruptcy filings, voter rolls, warranty cards, purchase histories, and your web browsing. Seven of the nine brokers feed each other, so an entry in one file propagates to the rest.¹

The file is not just facts. It is judgments. The FTC found brokers sorting people into segments with names like “Urban Scramble” and “Mobile Mixers” (low-income Latino and Black consumers), “Rural Everlasting” (older, poor, less educated), and “Diabetes Interest” and “Cholesterol Focus.” If an algorithm ever quietly charged you more, showed you worse offers, or screened you out, a segment like these may be why.

Your phone's weather apps, game apps, and even prayer apps sell where you stand. Many of them carry advertising software that transmits precise GPS coordinates, and those coordinates flow to location brokers. In 2019, reporters at the New York Times obtained a database of 12 million phones. The data was nominally anonymous. It took the reporters minutes to attach names, following a phone from an office to a house — and they could do it for a Secret Service agent guarding the President.²

What a stranger can learn from your trail

The broker SafeGraph sold a data package tracing everyone who visited any of Planned Parenthood's roughly 600 clinics. When researchers checked in August 2022, thirty-two other brokers were selling similar feeds. Your trips to a clinic, a church, a protest, a lawyer, a casino: each is a row in a product.

The FTC has spent four years suing its way through this market: X-Mode, InMarket, Avast (an antivirus company that sold its own customers' browsing histories), Mobilewalla (which kept the personal data it saw in ad auctions it lost on purpose), and Kochava, whose case ended a few weeks ago with a court order banning sales of sensitive location data without real consent.³ Every one of those cases is about data that came off phones like yours.

The customer you didn't expect: the government

In 2018, the Supreme Court ruled in Carpenter v. United States that the government needs a warrant to pull your location history from your phone carrier, because a location trail exposes, in the Court's words, “the privacies of life.” Federal agencies read that decision and went shopping instead.

If you have ever emailed, messaged, or called someone abroad, your side of the conversation may sit in an NSA database. FISA Section 702 lets the government collect foreign targets' communications without a warrant, and Americans on the other end are swept in as “incidental” collection. The government has never counted how many Americans are in the trove. Estimates run to the millions. The FBI can search that warrantless database for Americans by name, email, or phone number, including in ordinary criminal cases. In 2021 it ran roughly 3.4 million such searches.⁴

Congress responded in April 2024 by renewing the program and widening it. The new law reaches “any other service provider who has access to equipment” that carries or stores communications — language critics summarized as “everyone who touches a router.” It did add guardrails on FBI searches, requiring supervisor approval, a written factual basis, and special sign-off for searches on politicians and journalists. A warrant requirement failed on a 212 to 212 tie.

Then the program outran its own law. The statute hit its sunset on April 20, 2026; Congress passed two short patches, blew the June 12 deadline, and Section 702's statutory authority expired at midnight. Collection continues anyway, because court certifications approved in March 2026 stay valid for a year. A federal court, meanwhile, ruled in the Hasbajrami case that searching 702 data for an American ordinarily requires a warrant. Thirteen years after Snowden, the fight is still unsettled.

Your television watches you. Samsung and LG, who sell about 41 percent of the world's smart TVs, both run Automatic Content Recognition: the TV periodically captures what is on its own screen and uploads a fingerprint to identify what you are watching. Researchers measured LG sets capturing the screen every 10 milliseconds and reporting every 15 seconds. It kept reporting when the TV was just an HDMI monitor for a laptop. The one good finding is that switching ACR off in settings actually stopped the traffic.⁵

Your car is worse

Mozilla reviewed the privacy policies of 25 car brands in 2023 and failed every single one — the worst score of any product category it had ever tested.⁶ What the brands' own policies admit:

If a photo of your face has ever been on the public internet, assume it is in a police search tool. Clearview AI scraped what court filings describe as up to 50 billion images to build a face-matching product for law enforcement. The class in the resulting lawsuit was defined, in effect, as anyone whose face had been posted online. You have not been paid for it and probably never will be.

A settlement approved in March 2025 would have given the class 23 percent of the company — valued around $51.75 million — because a cash judgment would have bankrupted Clearview. On July 13, 2026, days before this report, an appeals court threw the settlement out. Seven years in, the scraping stands and no one has been compensated.⁷

In April 2024, a hacker listed a database for sale claiming 2.9 billion records on Americans. The seller was not a bank or a tech giant. It was National Public Data — a background-check operation in Florida run essentially by one man, which had scraped public records into a product and stored the result badly. If your Social Security number was in it, you did not choose that company. It chose you.

Breach numbers inflate, and this one is a lesson in reading them:

No comprehensive federal privacy law. That is the headline after three decades of trying. What you actually have depends on your state.

About two dozen states now grant rights to see, delete, and stop the sale of your data. Most of those laws exempt “publicly available information,” which is exactly what people-search sites aggregate — so the industry that lists your address next to your relatives' names is largely untouched.

Everything else is enforcement at the margins: the FTC picking off egregious brokers one consent order at a time, courts slowly extending the Fourth Amendment, and a Congress that has now let its own surveillance statute lapse rather than decide what the rules are.

Turning off ACR stopped the TV studies' tracking cold. Denying app location permissions shrinks your trail at the source. An idle iPhone contacted its platform about 50 times less than an idle Android in the Vanderbilt measurements — defaults matter, and you can change many of them. If you live in a state with deletion rights, use them; if you are in California, DROP takes one request.

But be clear-eyed about the rest. You cannot opt out of the county property record, the voter file, or the breach of a broker you never chose. You cannot take your face off servers that scraped it years ago, and you cannot make an agency unbuy your location trail. The 747 daily broadcasts happen whether or not you are careless, because the architecture — not your behavior — produces them.