A newly declassified government report confirms for the first time that U.S. intelligence and spy agencies purchase vast amounts of commercially available information on Americans, including data from connected vehicles, web browsing data, and smartphones.

By the U.S. government’s own admission, the data it purchases “clearly provides intelligence value,” but also “raises significant issues related to privacy and civil liberties.”

The Office of the Director of National Intelligence (ODNI) declassified and released the January 2022-dated report on Friday, following a request by Sen. Ron Wyden (D-OR) to disclose how the intelligence community uses commercially available data. This kind of data is generated from internet-connected devices and made available by data brokers for purchase, such as phone apps and vehicles that collect granular location data and web browsing data that tracks users as they browse the internet.

The declassified report is the U.S. government’s first public disclosure revealing the risks associated with commercially available data of Americans that can be readily purchased by anyone, including adversaries and hostile nations. The United States does not have a privacy or data protection law governing the sharing or selling of Americans’ private information.

“In a way that far fewer Americans seem to understand, and even fewer of them can avoid, [commercially available information] includes information on nearly everyone that is of a type and level of sensitivity that historically could have been obtained” by other intelligence gathering capabilities, such as search warrants, wiretaps and surveillance, the report says.

In a statement following the report’s publication, Wyden said: “This review shows the government’s existing policies have failed to provide essential safeguards for Americans’ privacy, or oversight of how agencies buy and use personal data.”

“According to this report, the ODNI does not even know which federal intelligence agencies are buying Americans’ personal data,” Wyden added.

The report corroborates a stream of media reports that found U.S. government agencies were buying huge datasets on Americans. The Internal Revenue Service bought access to a huge database storing the location data of millions of Americans’ phones to try to catch tax cheats, while similar phone location data was used by Homeland Security for immigration enforcement.

Government agencies must typically secure a court-approved warrant to obtain Americans’ private data directly from a phone or tech company, such as private messages. But the ODNI’s report states that in the cases where Americans’ information — like location data — is openly for sale to the general public, U.S. intelligence agencies can purchase it. (Though, this theory has yet to be scrutinized in federal court.)

Although this data is generally sold in bulk — often millions of data points at a time — the ODNI’s report warns that commercially available data can be easily deanonymized to identify individuals, including Americans. Location data, for example, can be used to infer where people live and work, based on where their phones and vehicles are at certain times of the day.

Commercially available information can also reveal “the detailed movements and associations of individuals and groups, revealing political, religious, travel, and speech activities,” the report says, such as being used to “identify every person who attended a protest or rally based on their smartphone location or ad-tracking records.”

“In the wrong hands, sensitive insights gained through [commercially available information] could facilitate blackmail, stalking, harassment, and public shaming,” the report said. The report noted that in 2021, commercially available location data collected from a gay dating app was used to out a Catholic priest, who later resigned. The report also referenced the collection and sale of location data from a Muslim prayer app to the U.S. military.

Wyden called for Congress to pass legislation to “put guardrails around government purchases, to rein in private companies that collect and sell this data, and keep Americans’ personal information out of the hands of our adversaries.”