Privacy Coalition Files Maryland AG Complaint Naming Penlink, Thomson Reuters for Selling Geolocation to ICE

A coalition of privacy and civil rights groups filed a consumer complaint with the Maryland Attorney General on August 20, 2026, alleging that named data brokers — among them Penlink and Thomson Reuters — collect and sell Marylanders’ geolocation data to Immigration and Customs Enforcement. Maryland law bars data brokers from selling personal data to immigration enforcement agencies absent a warrant or other legal requirement, and the complaint argues the named companies are doing exactly that. Both Penlink and Thomson Reuters denied the allegations to NPR, each asserting compliance with state law. The complaint asks the Attorney General to open an investigation rather than seeking relief in court, which makes it a test of whether state data-broker statutes carry enforcement weight against a federal customer.

Penlink is not a new name in this record. DHS holds a $2.9 million no-bid Penlink PLX contract for warrantless real-time interception of phone, text, and web traffic (2026-04-29–dhs-penlink-plx-no-bid-contract-warrantless-realtime-interception) — meaning the same vendor sits on both sides of the purchase-instead-of-warrant arrangement, selling location histories commercially while holding a sole-source federal contract for live interception. The legal architecture that permits this is the third-party doctrine (1976-06-23–united-states-v-miller-bank-records-third-party-doctrine, 1986-10-21–electronic-communications-privacy-act-ecpa): data an individual hands to a company carries no Fourth Amendment protection, so an agency that would need a warrant to compel it can simply buy it. FBI Director Kash Patel confirmed under oath in March 2026 that the Bureau purchases commercially available data and declined to commit to a warrant requirement (2026-03-18–patel-fbi-confirms-warrantless-purchase-commercial-data).

With Congress not moving, the barrier is being built state by state. New Jersey enacted a warrant requirement for geolocation sales to law enforcement on June 30, 2026 (2026-06-30–new-jersey-enacts-costliest-data-broker-law-a5328), Connecticut’s outright ban on geolocation sales takes effect October 1, 2026, and Vermont’s Data Privacy and Online Surveillance Act established broker deletion rights (2026-06-16–vermont-data-privacy-online-surveillance-act-broker-deletion-rights). The FTC’s Kochava settlement barred one broker from selling sensitive location data without consent (2026-05-07–ftc-bars-kochava-selling-sensitive-location-data-settlement). Maryland’s complaint is the enforcement question these laws have not yet had to answer: a statute that prohibits the sale is worth what the Attorney General is willing to do about a company that says it is already complying.