Internal documents: the CDC bought location data from millions of phones in the US to analyze compliance with COVID-19 rules, especially in the Navajo Nation
Newly released documents showed the CDC planned to use phone location data to monitor schools and churches, and wanted to use the data for many non-COVID-19 purposes too. Tweets: @timmarchman , @lemonsand , @blackamazon , @josephfcox , @hypervisible , @jackmjenkins , @josephfcox , and @josephfcox Tweets: Tim Marchman / @timmarchman : NEW: CDC bought location data tracking tens of millions of people from a Peter Thiel-backed spy firm; use cases included “hourly monitoring of activity in curfew zones,” activity in schools and houses of worship, and monitoring the Navajo Nation. https://www.vice.com/... Angela Lashbrook / @lemonsand : Google banned this Thiel-backed spy firm from the Play Store in June https://www.vice.com/... https://twitter.com/... @blackamazon : Sooo again remember when multiple people said they would monitor marginalized folks first and folks laughed https://twitter.com/... Joseph Cox / @josephfcox : New: docs on CDC's phone tracking. Saw if people complying with curfews. Bought for COVID response, but said it will use for lots of non-COVID too. Monitoring schools, places of worship. Data came from company funded by former Saudi intel head, Peter Thiel https://www.vice.com/... @hypervisible : “The CDC seems to have purposefully created an open-ended list of use cases, which included monitoring curfews, neighbor to neighbor visits, visits to churches, schools and pharmacies...” https://www.vice.com/... Jack Jenkins / @jackmjenkins : This kind of data tracking is more common than you think — including in churches, where it's been used for political/campaign purposes in the past (see: Steve Bannon). But not sure I expected the CDC to jump on board. https://twitter.com/... https://twitter.com/... Joseph Cox / @josephfcox : While the contract was marked to be ongoing, Google banned the location data vendor, SafeGraph, from the Google Play Store. SafeGraph a controversial data broker in this space https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : Here is the list of use cases proposed by the CDC when buying this location data. It did go through with some. Includes non-COVID measures like monitoring park usage for chronic disease, etc https://www.vice.com/... https://twitter.com/...
Context & Ripple Effects
The CDC's turn to commercial location data began early in the pandemic, when federal, state, and local authorities started using anonymized data from mobile ads to plan their COVID-19 response, alongside private efforts like Unacast's social-distancing scoreboards. The newly released internal documents show how far that emergency arrangement stretched: purchases from SafeGraph covering tens of millions of devices, with planned uses spanning hourly curfew-zone monitoring, schools, houses of worship, the Navajo Nation, and explicitly non-COVID purposes.
The timing matters because the disclosure lands amid a broader reckoning over government agencies buying brokered phone data instead of collecting it themselves — a practice already under a DHS inspector general probe triggered by Democratic senators — and one day before SafeGraph moved to [[a:978559|stop selling location data on visitors to Planned Parenthood and other family planning centers]], citing potential misuse.
First-order effects
- The CDC faces immediate political and legal exposure over uses that go well beyond pandemic response — monitoring schools, churches, curfew zones, and the Navajo Nation — undermining the emergency framing under which the data purchases were justified.
- SafeGraph, the Peter Thiel-backed vendor named in the documents, is directly implicated and already reacting: it cut off sale of family-planning-center location data within a day of the disclosure, and Google has banned it from the Play Store.
Second-order effects
- Other data brokers serving government clients must decide whether to follow SafeGraph's retreat on sensitive categories or absorb the reputational risk, effectively letting each broker set its own line on what locations are too sensitive to sell.
- Congressional scrutiny of agency data purchases widens beyond DHS: the CDC documents give lawmakers a concrete second agency example to fold into oversight of warrantless brokered-location acquisition.
Third-order effects
- If the pattern holds, the durable issue is that agencies can obtain location data through purchase what they would need legal process to compel — pushing the real permission boundary into the hands of private brokers rather than courts or legislatures.
- Sensitive-location categories (places of worship, clinics, tribal lands) are becoming the flashpoint that forces either broker self-regulation or formal data-broker legislation, since case-by-case vendor retreats leave the underlying market intact.
The trend: Pandemic-era emergency access to commercial location data is normalizing government purchase of brokered phone tracking, and the backlash is shifting the question of who may be tracked — and where — from law to voluntary broker policy.