Privacy advocates call on Maryland to investigate data brokers

An automatic license plate reader (ALPR) camera monitors traffic on August 19, 2026 in Silver Spring, Maryland. Chip Somodevilla/Getty Images hide caption

Maryland has passed some of the strictest data privacy provisions in the country. But privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders' geolocation data, as well as selling information to federal immigration authorities.

A coalition of privacy and civil rights groups filed a consumer complaint Wednesday that calls on the state attorney general to investigate specific companies and take enforcement action against them. The complaint comes as U.S. Immigration and Customs Enforcement has been ramping up its use of commercially-available personal data and surveillance tools to track and deport immigrants as well as monitor protesters .

Two of the named data brokers, Penlink and Thomson Reuters, denied the allegations and told NPR they were in compliance with the law.

The complaint alleges Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety and others, are collecting and selling personal information and location data on Maryland residents to law enforcement customers in violation of state privacy law. Penlink sells cell phone location data through its Webloc program, while the other companies sell car location data captured by license plate readers .

Several of the named companies have contracts with ICE, including Penlink. Thomson Reuters and LexisNexis provide data tools to ICE that contain a wide range of personal information from public records and proprietary data sources.

The complaint also names ThunderCat Technology, which has a contract with Homeland Security Investigations, which is part of ICE, to provide the agency with individual taxpayer identification numbers (ITIN) data.

The complaint calls on Maryland Attorney General Anthony G. Brown to "use the full force" of the state's strong privacy laws, "and take immediate action to rein in agencies' use of commercially purchased data that enables mass surveillance of Americans without judicial, legislative, or public oversight."