A parent in Maryland will not update an address. George Escobar runs We Are CASA. Through the group's programs he has watched people grow cautious about any office that keeps a file, even when they qualify for the thing behind the counter. They will not utilize a benefit they are eligible for, because the file can move.
Maryland already tried to stop that movement. The Data Privacy Act, HB711, was signed in May and took effect on July 1, 2026. It prohibits the sale of location data from phones and cars, the same location We Are CASA says ICE has used to target drivers for deportation. Brokers may not sell or share a Marylander's location unless law enforcement comes with a subpoena or a warrant. They may not sell personal data to an agency that enforces immigration law unless the law requires it or they receive a warrant.
Here's the thing. A 29-page complaint now sitting with Attorney General Anthony G. Brown alleges seven companies kept selling anyway. Some of them, the filing says, sold it to ICE.
The Ban They Already Wrote
The Maryland Online Data Privacy Act passed in 2024. Lawmakers came back in the last session and tightened it. Precise geolocation, under the current statute, is information derived from technology that can identify, within 1,750 feet, the specific location of a consumer, a mobile device, or a vehicle. Your commute lives inside that circle. So does mine.
Brokers are also barred from collecting or sharing a resident's sensitive data, including location, unless they are delivering a product the consumer asked for, or they are answering certain law enforcement demands. For location, that demand has to be a subpoena or a warrant. For an immigration-enforcement buyer, it has to be a warrant, or a sale the law itself requires.
Laura Moy, a Georgetown Law professor, said this when the House passed HB711. ICE is buying detailed information about millions of Americans and thousands of Marylanders. ICE should not be able to buy its way around the Fourth Amendment.
Greg Nojeim at the Center for Democracy and Technology says Maryland's rule is unusual because it also bars brokers from selling personal data to anyone helping with immigration enforcement. A broker in Maryland cannot honor an ICE subpoena for a resident's sensitive data. ICE has to bring a warrant. "Maryland is telling ICE, 'Get a warrant if you want Marylanders' sensitive data.'"
The question on Brown's desk is whether anyone will make the shops obey a law Maryland already wrote.
Seven Names on the Paperwork
Georgetown University Law Center's Technology Law Clinic wrote the August complaint for We Are CASA and eleven other groups, including the Center for Democracy and Technology and the Electronic Privacy Information Center. We Are CASA's legal director, Shana Khader, has seen the other end of the file. Arrest warrants that say ICE was running license plates. That is how they looked for the driver.
The seven companies named are Penlink, Motorola, Thomson Reuters, Insight LPR, LexisNexis, Flock Safety, and ThunderCat Technology. NPR reports that Penlink sells cellphone location through a product called Webloc. Motorola, Thomson Reuters, Insight LPR, LexisNexis, and Flock Safety sit in this filing as car-location shops: automatic license plate readers that log a plate at a place and a time. ThunderCat holds a contract to supply Individual Taxpayer Identification Number data to Homeland Security Investigations, which sits inside ICE.
Several of those shops have contracts with ICE. Penlink is one. Thomson Reuters and LexisNexis sell ICE data tools built from public records and from sources the companies keep as their own. The complaint does not publish a price on those contracts.
The complaint argues the named companies are violating the law by selling location data, or by selling to ICE, or both. It tells Brown to use the full force of the state's privacy laws. It warns that if the sales continue, federal agencies will run dragnet searches through Marylanders' private lives with no judge in the room. Khader said there are most likely additional companies doing the same thing. The complaint named seven.
The Story the Shops Tell
Thomson Reuters told NPR it is confident it complies with every law that governs its business. On its site, the company says its license plate product cannot track a vehicle in real time. It offers "ad hoc images collected randomly." Penlink said the allegations against it are false, that it does not process or sell precise location data of Marylanders in accordance with Maryland privacy law, and that it asked We Are CASA and the other groups to withdraw the complaint and correct what it calls false allegations.
The filing says Penlink's products are being used by Maryland agencies. NPR asked Penlink about a Baltimore County Police contract for Webloc, previously reported by Citizen Lab, and about a proposed Maryland State Police upgrade for a Penlink product called PLX. State records on that proposal list geolocation information among the tool's capabilities. After the story ran, Penlink said PLX is a warrant-based digital evidence platform that helps police organize geolocation data. It does not, Penlink said, provide the data.
Motorola, Insight LPR, LexisNexis, Flock Safety, and ThunderCat did not answer NPR by deadline. CBS Baltimore heard from Penlink and Thomson Reuters only. Both said they comply. Marylanders were told the sale was illegal as of July 1. The shops say the statute does not reach what they sell.
The Desk That Has to Move
Brown's office confirmed to CBS it received the complaint and is reviewing it. It declined to comment to NPR. In late June, before the July 1 date, spokesperson Kelsey Hartman had a line for anyone subject to the new rules: "Entities subject to the law should ensure they are in compliance."
Zainab Chaudry, who directs CAIR Maryland, put the fear in ordinary words. People should not have to worry that police are tracking where they go and who they meet without a warrant. Escobar asked Brown to investigate the companies and strictly enforce the values already written into state law. People skip the institution that would help them, because the institution is also a collector, and the collector's records live in a data-broker ecosystem that did not power down on July 1.
Congress has not closed the federal loophole that lets a broker sell you. Maryland wrote a state version anyway. Brown's office has the filing. Until that review becomes an order, the commute can still be an invoice.
0 comments