They Don't Need a Warrant for What They Can Buy - Part 1
How Safe Are Canadians from US Surveillance they Never See? (Part 1 of 3)
This is the first of three short posts discussing one simple question: “How much of a Canadian's digital life can US authorities reach without you ever knowing?” Part 1 looks at the advertising technology you don’t notice and how it quietly became a tracking tool that governments can simply buy. Part 2 covers direct legal demands to companies like hyperscalers. Finally, part 3 looks at how Canadian law protects you, or doesn’t.
The Auction You Never See
Every time a free app loads an ad, a hidden auction runs. And in about the time it takes the screen to appear, roughly a tenth of a second, your phone sends out a request to sell the advertising space before your eyeballs. This is called real-time bidding, or RTB, and it's the engine behind most digital advertising. [1]
The curious amongst us may ask: “What is in the request?” and “What is it telling potential advertisers about me?”
Here we find it usually includes your device's advertising ID, the app you're using, your phone model, your IP address, and very often your location with dedicated fields in the standard for latitude and longitude. [1][2] That data package is sent so that advertisers can decide how much to bid to reach you. Yes, you specifically.
What may concern you more is that this request is broadcast. Based on the advertising agency documentation a single broadcast about a single person can potentially be sent to thousands of companies at once. [3] Google alone permits 4,698 companies to receive this data, and Microsoft's ad exchange says it may pass data to 1,647 others. [3][4] Even though only one company wins the auction all companies in the auction receive the data. Once that data is sent there is no technical way to restrict what those companies do with it once they have it. [3] Some researchers estimate that an American’s online activity exposes their location though RTB hundreds of times each day. [4]
And from the “We are not surprised” department, some companies take part in these auctions not to advertise, but simply to harvest the stream of location data flowing through them. [7]
From Advertising Auction to Government Surveillance
Once broadcast, the data stream doesn't stay in the advertising world. Data brokers collect it, package it, and sell it. And some of the buyers are government agencies.
Cast your mind back to March 2026, when the news outlet 404 Media reported based on an internal Department of Homeland Security (DHS) document obtained through a public records request. 404 Media reported that the US Customs and Border Protection (CBP) agency bought location data drawn from the online advertising ecosystem to track people's movements over time. The data was pulled from ordinary apps such as mobile games, dating apps, fitness trackers. [5]
Enter the usual suspects, the same reporting noted that US Immigration and Customs Enforcement (ICE) had already bought similar tools which were capable of monitoring the phones in an entire neighbourhood. [6] Combined with their expressed desire in procurement documents that it wanted to buy even more "ad tech" data for its investigations. These revelations prompted a group of around 70 US lawmakers to ask the DHS watchdog to open an investigation. [5]
And before you think this is a new sensation, keep in mind that the Irish Council for Civil Liberties (ICCL) had already documented that DHS and other US agencies were obtaining advertising-derived location data and using it for warrantless phone tracking. [4] Johnny Ryan of the ICCL, whose organisation measured the scale of this data flow, described the material plainly: “goldmine for tracking where every person is...". [5]
Buying Instead of a Warrant
In the US context, to retrieve someone’s location history US law enforcement needs a warrant. In this case a Judge has to agree that law enforcement has a compelling reason for access to this data. However this only applies to situations where the law must compel the data from an organization. It has no effect if the same location data is already for sale on the open commercial market. US Law enforcement agencies have argued they can simply purchase it with no warrant, no judge, and no notice to you.
However the US Federal Trade Commission has begun pushing back and in 2024 it took action against the data brokers Mobilewalla and Gravy Analytics for selling precise location data without proper consent, and in one of those cases it specifically restricted how the broker could use data pulled from ad auctions. [7] But enforcement is patchy, and the market is enormous as the RTB industry was worth over $117 billion in the US and Europe in 2021 alone. [4]
But what about Canada?
RTB auctions don't stop at the border. The major advertising exchanges are US companies, and a Canadian using a free app is in the same “bidstream” as everyone else. [4] The location data leaving your phone can end up in the same brokers' hands and the same US-controlled systems as any American's. So there is no so-called “American Exceptionalism” here.
That's the uncomfortable starting point for this series:
A Canadian's movements can be collected, packaged, and sold into US government hands through a system built for selling ads with no warrant and no notification. This is a concern as we are already aware of American Law Enforcement attempting to retrieve a Canadian’s personal information following their social media posts critical of Donald Trump's administration.[8]
References
IAB Tech Lab, OpenRTB (the real-time bidding standard), https://iabtechlab.com/standards/openrtb/
Google, OpenRTB Integration guide (device geolocation is typically included in the bid request), https://developers.google.com/authorized-buyers/rtb/openrtb-guide
Irish Council for Civil Liberties, Real-Time Bidding (a single broadcast can reach thousands of companies; no way to restrict data once broadcast), https://www.iccl.ie/rtb/
ICCL, The Biggest Data Breach — report on the scale of RTB broadcasts in the U.S. and Europe (thousands of firms receive Google RTB data; U.S. users exposed hundreds of times per day), https://www.iccl.ie/news/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/
Joseph Cox, "CBP Tapped Into the Online Advertising Ecosystem To Track Peoples' Movements," 404 Media (Mar 3, 2026), https://www.404media.co/cbp-tapped-into-the-online-advertising-ecosystem-to-track-peoples-movements/
"Inside ICE's Tool to Monitor Phones in Entire Neighborhoods," 404 Media, https://www.404media.co/inside-ices-tool-to-monitor-phones-in-entire-neighborhoods/
US Federal Trade Commission, action against data broker Mobilewalla (restrictions on the use of real-time-bidding data) — https://www.ftc.gov/node/86848
“Canadian sues U.S. Homeland Security, which allegedly sought his Google data after critical social media posts”, CBC News, https://www.cbc.ca/news/world/us-dhs-aclu-lawsuit-canadian-john-doe-9.7187851
