Summary
Three congressional Democrats said Thursday that federal rules meant to curb foreign access to cell-phone location data still leave major loopholes for sensitive U.S. government sites, including the White House and the CIA’s headquarters.
In a letter, Sen. Ron Wyden of Oregon, Sen. Martin Heinrich of New Mexico and Rep. Sara Jacobs of California warned that the sale of Americans’ location data by data brokers poses a national security risk, particularly when the data involves U.S. government employees and could reveal information that foreign governments might use for espionage.
The lawmakers said the Biden administration spent nearly a year developing the regulations designed to block U.S. adversaries from buying commercial datasets gathered from cell phones at the federal government’s most sensitive locations. They said the resulting list of 736 sensitive locations did not include the White House, Congress or the CIA’s headquarters, among others.
The Democrats urged the Trump administration to address what they described as oversights by expanding protections beyond individual buildings. They asked the administration to create a “protection zone” encompassing the entire Washington, D.C., region rather than relying on a narrower set of designated sites.
The warning letter urged additional action as well, calling on the administration to expand the set of countries of concern barred from acquiring data about Americans. The rules currently bar selling location data on more than 1,000 U.S. devices to China, Russia, Iran, North Korea, Cuba and Venezuela, according to the AP account of the regulations.
The Democrats also said the rule-making approach left out sites because the protected locations were identified by GPS coordinates rather than by geography alone. Wyden’s staff, with assistance from the Congressional Research Service, analyzed the coordinates to determine which U.S. government facilities were included and which were left out, the AP said, citing a spokesman for the senator.
The letter’s national-security argument drew on the broader use of commercial location data by governments and companies. Data brokers, the AP reported, have long sold such information for advertising and other commercial uses, while governments have increasingly used the datasets to enforce laws and gather intelligence, including by mapping patterns and activities of U.S. government personnel.
Officials at the Justice Department declined to comment, and the office of the Director of National Intelligence did not respond to a request for comment, the AP said. The Democrats said the rules, which took effect in April 2025, aim to curb attempts to circumvent restrictions by purchasing smaller data sets, but that the gaps in the protected-site list could still leave key locations exposed.
The lawmakers’ warning comes as the rules restrict access in a targeted way: the designated protected sites prohibit the sale of information about even a single device. The AP also noted that commercially available location data has been used in other contexts to identify sensitive facilities, including examples involving disruptions tied to GPS-enabled technologies and fitness apps during military operations.
This push for a “protection zone” would shift the approach from listing specific protected buildings to shielding an entire metropolitan area, according to the Democrats’ letter. The letter was signed Thursday and directed to Trump administration officials, the AP said.