Germany’s intelligence overhaul leaves a back door through the advertising-data market

Germany’s government has produced hundreds of pages of new law for the BND and Federal Office for the Protection of the Constitution without answering a basic question: may intelligence agencies buy personal data from advertising brokers when the underlying collection was probably unlawful? netzpolitik.org reports that the draft contains no specific rule for advertising-based intelligence, or ADINT.

The gap is no longer hypothetical. The Databroker Files investigation showed that app-derived advertising data can reconstruct precise movements around government buildings, military facilities and intelligence sites, potentially identifying employees and revealing sensitive routines. German reporting has already established that at least one state criminal-police office used advertising data. Security agencies in the United States, Hungary and Austria have also purchased or used similar datasets.

Ordinary surveillance law sets purpose, necessity and authorization thresholds before the state can obtain location or communications data. A commercial purchase can invert that order: tracking companies collect information for marketing, brokers aggregate it, and an agency buys the result without invoking the power that would have governed direct collection. The government has argued that merely observing publicly available information is not an interference, while acknowledging that systematic use of personal data can affect fundamental rights and requires a legal basis. Brokered phone-location histories are not meaningfully public in the ordinary sense.

The opposition disagrees about the remedy but not the omission. Green MP Konstantin von Notz wants explicit statutory rules instead of broad general clauses. The Left’s Clara Bünger argues that agencies must never exploit unlawfully created datasets; she would contemplate only subsidiary access when a person cannot otherwise be found, with especially sensitive data excluded.

The earlier debate about new operational powers focused on how Germany should supervise more capable intelligence services. ADINT exposes the complementary problem: oversight can scrutinize the powers written into law while missing surveillance purchased outside them. If the bill is meant to create a durable post-court framework, it needs to regulate acquisition by effect—what the dataset reveals—not by whether the state collected it itself.