I’m inclined to think this is hype, but if true, it means the level of data recorded and indexed by AI systems is staggering. And if they keep this kind of detailed information for photographs, how much information are they collecting and keeping on users, from data brokers, app developers, cellular carriers, ISPs…? And it does seem to fit with the prices of memory and SSDs skyrocketing, so is the rush for data centers about storage and building massive profiles on every single person? The surveillance capabilities of the Mark of the Beast system is going to be inescapable, and it’s ramping up fast.
https://reclaimthenet.org/the-new-geography-of-being-watched
The most unsettling part is not that the machine can find you, but how little it needs to start.
By Ken Macon
The police are using a new AI-powered tool that can locate where a photo was taken – even if it’s an indoor photo – and identify the exact home, by matching it to online listings on property sites.
The tool, called Raven, is made by Graylark Technologies, and 404 Media reports that the Los Angeles Police Department and the Miami-Dade Sheriff’s Office have bought access to it.
Graylark CEO Daniel Heinen explained on LinkedIn that Raven provides “the ability to geolocate interior images across millions of short-term rental units worldwide.”
In one demonstration of how the tool works, a photo of a washer/dryer taken from X and posted online led to an Airbnb listing in Charlotte, North Carolina. In another, a bathroom photo taken from social media and run through Raven led to a Vrbo listing in Montecito, California.
The report said that the tool can find the home “without using location data or other metadata attached to the image.” Instead, it relies on the content of the photo to match it with property listings.
Graylark’s Heinen said that the company had not set out to develop this capability. “I’ll be honest, we didn’t train it to do that,” he is quoted as saying.
The Miami-Dade police spokesman said that the force’s use of Raven “has been limited and largely exploratory.”
“Something as mundane as a Zillow picture leftover from when your house was previously listed for sale can be enough to pinpoint your address,” said Neeraj, of Coin Center.
He added, “The warrant has been replaced by an invoice.”
Data brokers, according to Coin Center, “gather records from advertising exchanges, apps, retailers, credit bureaus, public filings, loyalty programs, websites, and even other brokers.”
They then connect those fragments using digital markers like cookies, and the result is “a profile of a particular person: where they live, where they work, where they travel, their interests, and even who they spend time with.”
They don’t just stop at the information that is useful to advertisers. According to California’s privacy agency, brokers can also infer health searches, “whether or not you have children,” “how much you’d be willing to pay for a given product.”
This information is sold “to advertisers, compliance departments, insurance agencies, and increasingly, the government,” Coin Center says. The California privacy agency also warns that brokers “may also sell information to buyers with malicious intent, such as hate groups, hostile foreign governments, and scammers.”
Much of the location data that ends up with brokers actually originates in the real-time bidding (RTB) process that powers the online ad auction system. The US Customs and Border Protection (CBP) agency’s own documents show that “RTB-sourced location data is recorded when an advertisement is served.”
Citizen Lab has described the ad auction system as “designed to enable targeting single individuals based on their mobile advertising ID, cookie ID, IP address, and other identifiers.”
But how does the government fit into this system? According to Coin Center, “when a private company has already collected the data and is happy to sell it, then the government does not need a warrant. It is simply engaging in a typical commercial transaction in the open market.”
The Associated Press has reported that the US Supreme Court has never addressed the issue of the government buying data from brokers, although in 2018 it ruled in the Carpenter v. United States case that police needed a warrant to obtain historical movement data from cellphone companies on a criminal suspect.
Chief Justice John Roberts wrote at the time that cell-site location information gives the government “near perfect surveillance and allow it to travel back in time.” But the ruling was narrow and only covered the situation when the data is compelled from a carrier, not when it is bought from a broker.
The AP report said that the Supreme Court has not addressed this specific issue, but there have been attempts in Congress to stop the practice. The Fourth Amendment Is Not For Sale Act, which would have prohibited agencies from buying personal information from data brokers, passed in the House in April 2024 but never got a vote in the Senate.
Even the Federal Trade Commission (FTC) has not been able to impose a blanket ban on the practice, as seen in the case of Gravy Analytics, which was prohibited from selling location data “except in limited circumstances involving national security or law enforcement.”
Meanwhile, the FBI claims it doesn’t need a warrant to use this type of information for investigations, although this has not been tested in court yet.
The Office of the Director of US National Intelligence (ODNI) said in its 2022 report that the government would never have been allowed to “compel billions of people to carry location tracking devices on their persons at all times,” but that is exactly what is happening with the help of data brokers.
The report also spelled out that this type of data, known as commercially available information (CAI), “could be used, for example, to identify every person who attended a protest or rally based on their smartphone location or ad-tracking records.”
Senator Ron Wyden has been vocal in his criticism of the practice, calling it an “outrageous end-run around the Fourth Amendment” and proposing legislation that would force the government to get a warrant before buying personal data from brokers.
The FBI has been quite open about it, with director Kash Patel telling the Senate in March this year, “We do purchase commercially available information that is consistent with the Constitution and the laws under the Electronic Communications Privacy Act – and it has led to some valuable intelligence for us.”
Previously, in 2023, then-director Christopher Wray told senators that the FBI had in the past bought location data, but was not doing it at the time.
The NSA is a different story, and in January 2024, Senator Wyden released documents showing that the agency “buys Americans’ internet records, which can reveal which websites they visit and what apps they use.” Wyden had to fight “for nearly three years” to make this public, and put a hold on the nomination of the NSA director to get it.
In a letter to the Director of National Intelligence (DNI) Avril Haines, Wyden said, “The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans’ privacy are not just unethical, but illegal.”
The ODNI report that was eventually declassified confirmed that the data in question “clearly provides intelligence value” and “can reveal sensitive and intimate information about individuals.”
Meanwhile, the Department of Homeland Security (DHS) in January asked industry how “commercially available advertising data” might help its deportation and enforcement mission.
In June, 404 Media said a $10 million procurement order it had seen indicated that ICE was buying records related to immigrants’ tax identifiers. Senator Wyden reacted by saying, “It looks for all the world like Trump is trying to skirt the law and a court order to fuel his mass-deportation campaign.”
Citizen Lab published a report about Webloc, which is sold by Penlink, and described it as “a global geolocation surveillance system that monitors hundreds of millions of people based on data purchased from consumer apps and digital advertising.”
The Canadian group said that Webloc offers records “from up to 500 million mobile devices across the globe” and lets customers look “up to three years in the past.”
Those customers, Citizen Lab said, include the US military, ICE, the Texas Department of Public Safety, NYC district attorneys, and police in Los Angeles, Dallas, Baltimore, Durham, Tucson, and Elk Grove.
The ATF ran a Webloc “pilot,” but that ended after lawmakers learned of “more than 300 warrantless searches,” more than 200 of which were tied to active cases.
In one instance, a prosecutor and a judge in an arson case both objected to the use of the tool; the ATF “was ultimately forced to backtrack and obtain a traditional court order.” The agency then said Webloc “does not meet our needs” and cancelled it, the AP reported in June.
The AP report said, “Other law enforcement agencies, including the FBI and the Department of Homeland Security continue to buy commercial geolocation data.”
A report by Georgetown’s American Dragnet in 2022 said, “ICE could locate 3 in 4 adults through their utility records,” and that the agency “has access to the driver’s license data of 3 in 4 (74%) adults.”
“In 1989 much of your life was already on file. It just wasn’t in any one file,” Kyle Schneps wrote in Coin Center’s newsletter.
“Privacy was inherent in that cost,” he explained.
The Supreme Court recognized this in 1989, in the Department of Justice v. Reporters Committee case, and named it: “practical obscurity.”
But, Schneps continued, “AI erases these last vestiges of practical obscurity.”
With AI, a model “returns not a pile but a biography: where you have lived and with whom, what you were sued over, what all of it seems to mean.”
The difference is that “assembling you costs nothing, and staying unassembled is your job alone.”
Schneps added, “the biography is also often partly wrong, which is its own harm – you cannot correct a file you never see.”
“Cookie banners, privacy policies, opt-outs, broker removal requests – all exist only if you find and act on them, and they protect you precisely as far as you keep up,” Schneps wrote.
“Government surveillance used to be limited by both the amount of work it took to track the movements of a single person and protections of the 4th amendment. AI completely eliminates that first part,” Coin Center wrote.
So, how do you starve the data brokers of your data, or at least, of as much of it as possible?
Kill the ad ID, and make sure you do not give apps permission to access your location unless they really need it, and then only when you are using them.
On an iPhone, go to Settings, then Privacy & Security, and then Tracking, and turn off “Allow Apps to Request to Track.” Apple explains that if you do this, an app “can’t access the system advertising identifier (IDFA).”
On Android, go to Settings, then Privacy, then Ads, and “Delete Advertising ID.” Google says that after deletion, “Any attempts to access the identifier will receive a string of zeros instead of the identifier.”
Next, restrict apps’ access to your location. On an iPhone, go to Settings, then Privacy & Security, then Location Services. Here you can turn off Precise Location for apps that don’t really need it – and they will “only see an approximate area.” And set apps to only be able to access your location while you are using them.
On Android, go to Settings, then Privacy, then Permission Manager, and then Location. Here you can “Always prefer Approximate for apps that do not need exact GPS.”
While you are at it, remove apps you do not use since each install is a potential data leakage point. We said this back in March 2026.
Malwarebytes advises using a separate email for important accounts, and aliases for shopping and newsletters, “making it harder for brokers to build a unified profile.”
If you live in California, you can tell more than 600 data brokers to delete your data – all in one go, via the state’s Delete Request and Opt-out Platform (DROP).
DROP was launched in January 2026, and data brokers had until August 1, 2026, to start processing the requests, and then they have 90 days to do it. After that, they have to “re-check and delete new matching data at least every 45 days.”
The service requires your name, date of birth, and ZIP code to submit a request, but the more information you enter, the better, as “the more likely your data will be deleted.”
Once you submit your request, you will get “your 8-digit DROP ID” – which you should save for future reference.
Oregon, Texas, and Vermont also require data brokers to register with the state, but as Malwarebytes put it, “only California currently offers a centralized platform like DROP.”
Malwarebytes advises people in those states to “follow their listed processes to submit requests directly to each broker” and to “maintain a spreadsheet with dates, brokers, and confirmations.”
In California, brokers who ignore the request face “penalties of $200 per day, plus enforcement costs.”
If you’re in the UK or EU, there’s no single portal to turn to in order to stop data brokers, but there are rights you can exercise.
The right to object is covered in GDPR’s Article 21, which states that citizens have the right “to object at any time to processing” for direct marketing, “which includes profiling.”
The next paragraph of the same article adds that once an objection is raised, “the personal data shall no longer be processed for such purposes.”
The UK’s Information Commissioner’s Office (ICO) says that for direct marketing, “organisations cannot refuse if you object to this.”
In addition, the ICO advises that the right to erasure can also be invoked when data is processed for direct marketing purposes. The regulator even provides a template for this, which states, “I wish to exercise my right of erasure under data protection law.”
After an erasure request is made, the organisation should “tell anyone else they have shared your data with about the erasure,” the ICO said.
There’s a one-month deadline for this, “starting from the day they receive the request,” unless it’s a complex request, in which case it can take up to three months.
The ICO’s template for an erasure request ends with, “Please send a full response within one calendar month confirming if you will comply with my request.”
However, the ICO also notes that organisations “can keep your name on a suppression list”.
If your request is ignored, the next step is to complain to the ICO. But be prepared to wait – the regulator says that complaints it needs to look at in more detail “are currently being assigned to case officers around 10 months after submission.”
The ICO adds, “The ICO can’t award compensation.”
This is not exactly reassuring, given that the ICO took on Experian in 2020 over “significant ‘invisible’ processing” that affected “millions of adults in the UK” – and the case was only resolved in 2024, in Experian’s favour.
If you don’t want to do it yourself, there are companies that will do it for you – for a fee. The best-known are DeleteMe, Incogni, and Optery.
DeleteMe says, “We Remove Private Information from 969 Data Brokers.”
Incogni covers “420+ data broker sites” and charges $7.99 a month, billed annually. Optery, meanwhile, says its higher plans cover “625+ Sites.”
But should you pay for these services? A 2024 test conducted by Consumer Reports and Tall Poppy of seven services, using 32 volunteers, found that “as a whole, people-search removal services are largely ineffective.”
Out of 332 listings, “only 117, or 35%, were removed within four months.”
The same test showed that removing data manually was more effective – 70% of the time. However, as Consumer Reports noted, this method was also “far from perfect.”
The best of the services tested were Optery and EasyOptOuts, which removed 68% and 65% of the data, respectively, in four months. DeleteMe, meanwhile, managed to remove only 27% of the data during the same period. Incogni was not included in the test.
The cost of EasyOptOuts is $19.99 per year. Consumer Reports said that information “sometimes doesn’t actually get removed, sometimes doesn’t get removed for weeks or months, and sometimes gets removed but then reappears.”
We have not tested these services ourselves, and the verdict is based on the Consumer Reports’ test.
There are also things the forms, whether submitted manually or by a paid service, miss.
Like old listing photos. The Coin Center writes that a picture that real-estate site Zillow left up from when your house was previously for sale can be enough to pinpoint your address.
Airbnb, meanwhile, said that it strips location metadata from photos, shows hosts’ approximate location, and only shares the address “after a reservation is confirmed.” But the photos stay up on the service.
Consumer Reports found that people-search sites were the most responsive to manual opt-out requests – 70% of listings were removed within a week. But some reappeared.
In California, “grocery stores, clothing retailers, or other apps may collect your purchase history,” the state’s authorities are warning residents. The advice is to avoid using your full name and home address, “especially true for rewards and loyalty programs.”
The same goes for car and insurance driving apps. In January 2025, Texas sued Allstate and Arity for “secretly embedded software in mobile apps, such as Life360” that collected data which the state said was used to raise insurance rates.
The data collected this way included people’s location, driving habits, and personal information, and Texas Attorney General Ken Paxton said that Arity built “the world’s largest driving behavior database” and that the two companies used this data “to justify raising Texans’ insurance rates.”
Paxton’s office described the lawsuit as the first of its kind, launched by a state attorney general to enforce a comprehensive data privacy law.
DROP doesn’t reach everything. In California, “Information that you provide to a business directly, for example, when you sign up for a new subscription or create an account for a new service, is not subject to deletion by DROP.” Exempt from deletion are also “Public records, like vehicle or real estate ownership or voting records.”
Health data covered by the Health Insurance Portability and Accountability Act (HIPAA), credit data covered by the Fair Credit Reporting Act, and financial data covered by the Gramm-Leach-Bliley Act are also not covered.
The aim of any efforts you make to take advantage of the new rules should be to make your file thinner from this day forward.