The Surveillance Accountability Act Fixes This

It's time to close the databroker loophole

There’s a new bill in the House that Ludlow Institute helped work on called the Surveillance Accountability Act. It does something that sounds almost absurdly simple:

It says that if the government wants to search your life, it needs a warrant. And if it doesn’t get one, you can hold it accountable.

That’s it. That’s the bill.

The Surveillance Accountability Act Fixes This

You might be wondering why we need a law for something that’s already in the Constitution. After all, the Fourth Amendment already requires warrants for searches. But the reality is that decades of outdated legal doctrines have hollowed out that protection so completely that the government can now access your medical records, your financial transactions, your location history, your browsing data, your contacts, and your communications, all without a warrant. It can buy this data outright from brokers. It can demand it from the companies that hold it. It can query massive databases about you with no judge involved and no probable cause.

The Fourth Amendment already says what this bill says. But if this bill were put to a vote, it would likely fail, which tells you everything you need to know about how broken things have gotten.

How did we get here?

Right now, the legal framework courts use to decide whether the Fourth Amendment protects you is called the “reasonable expectation of privacy” test. If a court decides you had a reasonable expectation of privacy in something, the government needs a warrant to access it. If not, it can do what it wants.

Operating inside that framework is something called the third-party doctrine. It provides a specific answer to that question: if you’ve shared information with any third party, the courts say you don’t have a reasonable expectation of privacy in it. The courts have essentially equated giving your bank your financial records to sharing a secret with a friend, saying that once you’ve told someone, you can’t expect it to stay private.

But how does this framework still exist in a world where contracts exist? If I have a contract with a company where they promise to keep my information private, surely I have a reasonable expectation of privacy. The government says no, I don’t, simply because the data passed through a third party. They consider these contracts irrelevant. We literally have privacy policies spelling out what companies can and can’t do with our data, and we’re told that none of it matters when it comes to Fourth Amendment protections.

Meanwhile, our whole lives have migrated to the internet, and the entire internet runs on third parties. Your email provider stores your messages. Your phone company has your location. Your cloud account holds your files. Your apps know where you go, what you search, what you buy, who you talk to, and what patterns your life follows. Our lives moved online, but no constitutional protections followed.

On top of this, most people do not even know they are sharing information with third parties. That sharing happens invisibly, as a byproduct of the infrastructure of the digital age. Your phone pings cell towers. Your browser searches leave digital exhaust across countless servers. Your apps transmit data in the background. How can courts argue that we voluntarily shared information most people didn’t even know existed, with companies most of us didn’t even know had access to it? None of these legal frameworks make sense in a world of modern technology, yet they continue to determine whether individuals have Fourth Amendment protections.

And law enforcement knows it. As FBI Director Kash Patel acknowledged when pressed on whether the FBI buys Americans’ location data: “The FBI uses all tools... to do our mission. We do purchase commercially available information.” The government is searching your life. It’s just found ways to do it without getting a warrant.

What the bill does

The Surveillance Accountability Act fixes this in three key ways.

First, it establishes a presumption of privacy for data held by third parties. The government may not access data, metadata, or personal information held by financial services providers, telecoms, ISPs, cloud storage companies, or data brokers without a valid warrant, regardless of whether the company cooperates. It also makes clear that your contracts with companies should be respected, and the government can’t override them to get access to your data. And if a company wants to reserve the right to hand your data to the government, it can’t bury that in legalese. It has to be stated explicitly and clearly, and the user has to knowingly agree to it first. This directly neutralizes the third-party doctrine. The government can no longer treat your data as fair game simply because a company holds it.

Second, the bill defines “search” the way the word has always been understood: as any purposeful investigative act directed at a specific person, including surveillance, monitoring, and the collection of personal data through digital or automated means. This closes the loophole that agencies have been exploiting for years: the argument that buying a dataset and then querying it somehow isn’t a “search” under the Fourth Amendment. It is. It always was. This bill makes that explicit.

Third — and this may be the most important part — the bill creates a private right of action. If a government official violates your Fourth Amendment rights, you can sue. Right now, the legal avenues for holding the government accountable for warrantless searches are extremely limited. This bill changes that. It says that if the government searches your life without a warrant, there are consequences.

The bill also draws careful lines around what doesn’t require a warrant: plain-view observations, ID checks during traffic stops, genuinely public information, consensual searches, and exigent circumstances. These are the same common-sense exceptions that have always existed in Fourth Amendment law. The bill doesn’t eliminate them, it just makes sure they can’t be stretched to cover mass surveillance or data purchases.

Critically, the bill also makes clear that just because you step outside your front door doesn’t mean the government can scan your face, track your car, or log your movements without a warrant. None of the warrantless exceptions in the bill can be used to justify the collection of facial recognition data, gait analysis, voice recognition, or automated license plate tracking. These are exactly the kinds of tools being deployed right now with no judicial oversight, and this bill draws a hard line against them.

Why it matters

The core promise of the Fourth Amendment was never complicated. The founders understood that information is power, and that the government’s access to information about your life needed limits. This is because the investigative process has a natural bias. Investigators are trying to solve cases and find culprits. That is their job. But it means they are not neutral arbiters of how far they should be allowed to pry into someone’s life. Left unchecked, that bias turns into abuse. It always has, even with the best intentions.

That’s why the founders required a judge in the middle. The idea isn’t to stop investigators, but instead to make sure the government justifies itself before it searches your life, not after. While today much of law enforcement sees warrant requirements as simply bureaucratic paperwork, the warrant requirement is actually a deliberate check on the natural bias of the investigative process.

But today, that check has been bypassed. Investigators are buying giant datasets from brokers and searching them at will. They have unfettered access to troves of personal data with no magistrate involved. And the data they have access to gets bigger and bigger over time. The dirty secret is that the vast majority of the time, if the government went and applied for a warrant, they’d probably get it. But they don’t see warrants as a critical check on power, and instead see them as busywork.

The courts know the current framework is broken. But as Rob Frommer of the Fourth Amendment Project at the Institute for Justice has put it, the problem is the courts don’t know how to get out of it, so they keep creating one-off exceptions rather than really grappling with the rule itself. We can’t wait for the Supreme Court to slowly judge every new piece of technology, one by one.

The Surveillance Accountability Act is the legislature stepping in to do what the courts have been unable to do: reestablish the principle that the government needs a warrant to search your life. It was introduced to the House on April 23 by Rep. Thomas Massie and Rep. Lauren Boebert, and deserves serious attention, because the problem it’s trying to solve affects every single one of us.

Those with power do not get to open up your life for inspection just because they want to see what they can find. They have to name the person. State the reason. Limit the search. Face a judge. And justify themselves first.

That’s all this bill asks. And the fact that we have to ask for it at all should alarm everyone.

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

NBTV. Because Privacy Matters.

Shop.NBTV.media