No one broke in. No one asked a judge. Someone just bought what was already for sale.
Also known as Data broker loophole / purchased surveillance
A way to learn everything a warrant would normally require permission to learn, without ever needing the warrant, because the information was already collected by someone else and is now simply for sale. The buyer never touches a device, never serves a subpoena, and never has to justify the search to anyone. The most instructive versions are the ones where nobody broke any law at all. That is the loophole: the barrier was never legal, so there was never a law being routed around, only a market nobody had gotten around to closing.
Truth-adjacency
Truth-independent: the pattern works regardless of whether the claim is true
Where it shows up
Platforms and algorithms
How it works
The phrases and tells that mark this pattern in the wild:
commercially available datawe didn't collect this, we licensed itaggregated and anonymized, but still traceable to one personno subpoena was requiredthe subject was never notifiedThe tell is what’s missing from the story: no warrant, no subpoena, no notice to the person the data is about, and usually no law broken by anyone in the chain. The data was collected once, under one set of terms, by an app or platform the person actually used. It is then sold, licensed, or “aggregated” to a buyer operating in a completely different context, for a purpose the original terms never had to anticipate because reselling was already permitted in the fine print. The consent that existed was real, on paper, and utterly disconnected from what actually happens to the data next.
A researcher using a public, aggregated dataset that cannot be reversed into any individual’s identity is not this pattern. A person who reads a privacy policy, understands what will be shared, and consents to a specific, disclosed use is not this pattern either. The loophole requires that a specific person becomes identifiable to a party they never agreed to be visible to, through a resale step that launders away the context their original consent was given in.
One of these two real scenarios is The data broker loophole. The other is a different pattern entirely. Which one is which?
The tell
A company using aggregated, non-reidentifiable data to understand a market is not this pattern. A person choosing to share data with a service that discloses its practices clearly, in exchange for a service they actually want, is not this pattern either, even if a third party could theoretically buy an anonymized version of it later. The pattern requires that a specific, identifiable person's behavior becomes visible to a party they never agreed to be visible to, through a resale step that launders away the original context of consent, without any legal process standing in the way.
Data is gathered for a commercial purpose you agreed to in some form. It is then resold, and the resale carries none of the context the agreement was made in.
Because there is nothing to object to at any single point. Each transfer was permitted and each disclosure sat in a policy, and the harm exists only in the assembled result, which no one party is responsible for having assembled.
The protection everyone assumed they had was attached to the act of asking, and nobody had to ask.
How this pattern gets misused
Someone calls any purchase of aggregate market data a version of this pattern, including data that is genuinely anonymized, non-reidentifiable, and used for purposes no individual would recognize themselves in. The term is for data that can be, and is, traced back to one identifiable person for a purpose that person never agreed to and was never told about, not for population-level statistics no one could reverse into a name.
What it looks like when you're wrong about it
A company using aggregated, non-reidentifiable data to understand a market is not this pattern. A person choosing to share data with a service that discloses its practices clearly, in exchange for a service they actually want, is not this pattern either, even if a third party could theoretically buy an anonymized version of it later. The pattern requires that a specific, identifiable person's behavior becomes visible to a party they never agreed to be visible to, through a resale step that launders away the original context of consent, without any legal process standing in the way.
Not sure? Describe the situation to someone outside it. If they do not see the pattern, pause before you name it.
The name is designed to spread. The hook is designed to stick. If you recognized something, share the name.
Seen a real example of the data broker loophole? Suggest it for the Register →