Police in the market: bought, not compelled¶

In June 2026 the trade documented in the Databroker Files turned up on the other side of the counter. German police forces were found to be buying commercial location data, the same advertising-derived material that had placed devices inside EU and NATO buildings, and no supervisory authority could name a legal basis for it.

What the survey found¶

netzpolitik.org and Bayerischer Rundfunk asked all sixteen German states on 2 June 2026 whether their police had bought from data brokers. The criminal police offices of Brandenburg and Mecklenburg-Vorpommern confirmed obtaining data from commercial providers. Nine states declined to answer, five denied it, and none of the sixteen state data protection authorities named a concrete legal basis for the practice. Mark Zöller, a law professor in Munich who researches internal security and digitalisation, said that as things stand it would be unlawful.

The Mecklenburg-Vorpommern data protection commissioner set out the mechanism plainly: a judicial reservation would be circumvented by using commercial location data without a legal basis for it. Where the law attaches its safeguard to compulsion, ordering a carrier to hand over what it holds, a purchase compels nobody and triggers nothing.

The states that would not say¶

A week later, on 9 June 2026, opposition parties in eight states were demanding answers: Greens in Berlin, Bavaria and Mecklenburg-Vorpommern, the SPD in North Rhine-Westphalia and Baden-Württemberg, the Left in Hamburg, and BSW in Brandenburg and Saxony. The Berlin formulation, from Gollaleh Ahmadi of the Greens, is the case in a sentence: the rule of law cannot buy itself shortcuts. Most state governments stayed silent or cited operational security.

The two confirmations moved as well. Mecklenburg-Vorpommern’s interior ministry said its criminal police office assumes its procedure is lawful, with the state data protection authority now involved; Brandenburg, having first acknowledged using data brokers, later specified that what it obtained came from commercial platforms such as business information services rather than commercial location data. A practice that is difficult to describe consistently is difficult to supervise.

The same question, at federal level¶

The federal position is not that the purchases are unlawful. It is that the question cannot be asked. In December 2025 the federal government refused to say whether the federal criminal police, the federal police or the three intelligence services buy from brokers, withholding the answer even from members of parliament in classified form, while adding that it does not rule such purchases out. An opinion from the Bundestag’s research service had already found no authorising statute for the federal criminal police or the federal police.

The intelligence service reform published in July 2026 did not close the gap. The draft contains no explicit legal basis for either the domestic service or the foreign one to buy and use commercial data, the ministry relying instead on general clauses; the term ADINT appears only in the explanatory notes to one section of the new foreign intelligence law. The federal data protection commissioner’s objection is that this lacks an expressly defined and legally clear statutory authorisation, and a policy researcher noted the contrast with the United Kingdom, where an approval step involving independent legal oversight applies before a service takes purchased data into its systems.

Not only Germany¶

Austria’s interior ministry extended its licence for Webloc, a tool that reads advertising-industry location data across up to 500 million devices, for 1.85 million euros over two years, which makes Austria the second confirmed EU customer after Hungary, where the national security service took licences in March 2026 alongside two other agencies already buying from the same vendor. The American immigration authority ICE is reported as a user of the same tool.

What the buying changes¶

For the threat model the shift is not that a new capability appeared. It is that the buyer turned out to be the institution that supervises the market, which changes what a remedy has to survive. A rule restricting the trade now restricts an operational capability that several ministries have already paid for, and the purchases sit outside the procedures built for compelled data, so the ordinary trace of an order, a judge, a file, is missing. The commercial extraction model describes the market that supplies it; this is what it looks like when the state joins the queue.

Last reviewed: 2026-08-13.