Six technologies doing most of the quiet work of modern surveillance — what they are, who uses them, and why current law barely touches them.
TL;DR No single fact is revealing. Combining all of them is.
Data brokers buy, combine, and resell information collected by apps, websites, retailers, and public records — building profiles on people who never agreed to any of it, and often never even used the underlying service.
No single piece of this data is very revealing on its own. The danger is aggregation: combining your location history, purchases, and browsing into a single file can reveal health conditions, relationships, and routines more precisely than almost any single document could.
Advertisers, insurers, employers, landlords — and government agencies, which can buy data instead of getting a warrant for it.
Brokers routinely build files on people who've never interacted with the originating service at all, assembled entirely from other people's data.
Customer databases are frequently sold off in bankruptcy or acquisition — consent given to one company effectively transfers to whoever buys its assets.
TL;DR Passive, warrantless, and wrong more often for some faces than others.
Facial recognition systems match an image of your face against a database to identify you — used by retailers to flag "persons of interest," by police departments, and increasingly by systems scanning public cameras in real time.
Because it's passive, it doesn't require you to do anything wrong, be arrested, or even know you're being scanned. Error rates are also well documented to be uneven across demographic groups, meaning misidentification isn't evenly distributed either.
Stadiums, airports, retail loss-prevention systems, and networked public and private security cameras.
In most places, there's currently no requirement to get a warrant, or even to tell you it happened.
TL;DR Every plate, every time, kept for months. No suspicion required.
Automated license plate readers, mounted on patrol cars, poles, and even parked tow trucks, photograph every plate that passes and log the time and location — building a movement history for cars that were never suspected of anything.
These networks are often shared across agencies and, in some cases, with private companies — meaning a scan in one city can surface in a search run somewhere else entirely.
Scans of ordinary, uninvolved vehicles are frequently kept for months or years, not discarded immediately.
The whole point of the system is to scan everyone, not to target anyone in particular — which is exactly the kind of general, suspicionless collection existing warrant standards were built to prevent.
TL;DR "The algorithm decided" is not an explanation — and today it doesn't have to be.
Automated systems now help decide who gets a job interview, an apartment, a loan, or an insurance rate — often with no notice that a system made the call, no explanation of why, and no one you can appeal to.
Because these systems learn from historical data, they can reproduce and amplify old patterns of discrimination while looking neutral on the surface — and "the algorithm decided" is rarely treated as something a company has to explain.
Some systems attempt to score the likelihood of future conduct — like predicting risk — rather than evaluating what a person has actually done.
Companies commonly decline to explain a scoring model's factors, citing proprietary interest — which leaves the person with no way to know what they'd even need to change.
TL;DR A leaked password can be reset. A leaked fingerprint can't.
Fingerprints, iris scans, voiceprints, and increasingly data from wearables and neural interfaces are being collected by employers, apps, and consumer devices. Unlike a password, you can't reset your fingerprint after a breach.
This category is expanding quickly: emotion-detection software, brain-computer interfaces, and physiological sensors in wearables are all producing new categories of deeply personal data with very little settled law around them.
Biometric data can't be reissued the way a stolen credit card number can — a leak is effectively permanent.
Some systems now attempt to infer mood, attention, or intent from biometric signals, not just identity.
TL;DR Fake you, presented as real you, without your consent.
Tools that generate a realistic likeness of someone's face, voice, or statements — commonly called deepfakes — can now be produced quickly and convincingly, and used to fabricate speech or conduct a real person never engaged in.
The technology has legitimate uses in film, satire, and research. The concern is specifically synthetic media presented as authentic, without the depicted person's consent.
Content clearly and durably labeled as synthetic, along with satire, parody, and commentary, is meant to remain fully protected.
Longer explainers with diagrams — the pipeline behind data brokers, the radio layer most people never hear about, and the car in your driveway.
From four everyday services to one file on you — and why "we don't sell your data" is technically true and functionally meaningless.
See the diagram Deep diveWi-Fi probe requests, Bluetooth advertising, and NRF shelf beacons — how your devices are followed through physical space.
Read it Deep diveTelematics sold to insurers, the V2X rollout for new cars, and tire sensors that make old cars trackable through walls.
Read itTwo things you can do today: protect yourself with the toolkit, and tell your representatives this needs a constitutional answer.