A Free Download Revealed a Colleague's Movements
A new special report from the Committee to Protect Journalists (CPJ) opens with a striking example of how casual mass surveillance from online advertising has become. Journalist Nicolas Baudoux, working at the Belgian newspaper L'Echo, obtained location data on a colleague without paying a cent. A U.S.-based data broker supplied mobile device tracking data covering just two weeks in 2025, information that, according to CPJ, was detailed enough to reconstruct where that person had been.
The example is not an isolated stunt. It illustrates a much larger point CPJ makes throughout the report: the commercial advertising ecosystem, built on constant collection of location, app usage, and behavioral data from ordinary smartphones, has created an infrastructure that can just as easily be turned against reporters, editors, and their sources.
Why the Advertising Ecosystem Is a Surveillance Risk
Online advertising runs on a vast, largely invisible pipeline of data collection. Every time a phone connects to an app, a real-time bidding system, or a location-based service, it can generate a data point that gets logged, packaged, and sold. Data brokers aggregate these points from many different apps and services, then resell them, often with few restrictions on who the buyer is or what they plan to do with the information.
CPJ's reporting draws on interviews with experts who explain that this creates risk for journalists in two main ways. First, journalists working in hostile environments or in exile can be tracked through the same commercial data streams that advertisers use to serve targeted ads. Second, because this data changes hands through commercial markets rather than through legal process, it can bypass many of the protections that would normally apply if a government agency tried to obtain the same information directly from a phone carrier or tech company.
The report also highlights a transnational dimension to the problem. A journalist reporting from one country can be tracked using data purchased from a broker based in an entirely different jurisdiction, which complicates any effort to apply local privacy law or press freedom protections. CPJ notes that existing legal frameworks have not kept pace with how easily this kind of data crosses borders and changes ownership.
Gaps in Protection and the Road Ahead
One of the more sobering points in the CPJ report is how few effective legal guardrails currently exist around this kind of data trade. Much of the information brokers collect is treated as a commercial product rather than sensitive personal data, which means it often escapes the kind of legal scrutiny applied to government surveillance requests. CPJ's experts also raise concerns about how artificial intelligence tools could make it even easier to analyze and cross-reference these datasets, potentially accelerating the ability to identify and track individual journalists at scale.
This is not a purely European or purely American issue. Because data brokers operate internationally and sell to a wide range of buyers, the risks described in the report extend to journalists reporting on corruption, conflict, or authoritarian governments anywhere in the world. A reporter's location history, once available for purchase, does not respect borders.
Lawmakers in the United States have started to take notice of the broader data broker problem, even if the response has not yet fully caught up with the scale CPJ describes. For instance, Rep. Burchett's H.R. 9800 targets a specific data broker loophole that has allowed government agencies to buy data they would otherwise need a warrant to obtain. While that bill focuses on government purchases rather than commercial resale to any buyer, it reflects growing bipartisan concern that the data broker industry needs clearer rules.
What This Means For You
You do not need to be a journalist to be affected by this. The same advertising data pipelines that CPJ describes collect information from anyone carrying a smartphone with location services and ad-supported apps installed. If a data broker can sell two weeks of a journalist's movements for free, similar data likely exists for millions of ordinary users, available to whoever is willing to buy it.
For journalists specifically, the report is a reminder that operational security now has to account for commercial surveillance, not just direct government monitoring. Reducing exposure means being deliberate about which apps have location access, using privacy-focused browsers and search tools, and understanding that ad-supported free apps often come with a hidden data cost.
Takeaways You Can Act On
Start by auditing which apps on your phone have access to your precise location, and revoke that access for anything that does not need it to function. Consider using a reputable VPN alongside privacy-hardened browser settings to limit how much tracking data advertisers and brokers can collect in the first place. Journalists working on sensitive stories should assume that commercial data brokers, not just government agencies, are a realistic surveillance vector, and should factor that into how they communicate with sources and colleagues. Finally, keep an eye on legislative efforts aimed at closing data broker loopholes, since public pressure and awareness are often what push these bills forward.
