European intelligence agencies are increasingly acquiring bulk commercial data to aid in surveillance efforts, marking a significant shift from traditional methods such as wiretapping telephone cables and intercepting internet traffic. According to a recent study by German security researchers, commercially obtained bulk intelligence—sometimes referred to as advertising intelligence or Adint—has become a primary source of information for government agencies on both sides of the Atlantic.
The study, conducted by academics and published by a European technology and surveillance think tank, draws on data from regulators overseeing intelligence activities in 11 European countries, interviews with former intelligence operatives, and information from companies that collect and broker user data. It highlights how Adint allows agencies to purchase detailed profiles of individuals by linking their internet activity and mobile devices’ unique identifiers with a wide range of personal information.
Thorsten Wetzling, one of the study’s authors, explained that national security agencies typically buy reports containing information such as users’ age, sex, and location histories, as well as more sensitive inferred data including political views, sexual orientation, and religious beliefs. This granular data, amassed by commercial brokers through consumer tracking on social media platforms, apps, and other digital services, often surpasses the detail available through state-operated surveillance methods.
The report also notes potential abuses of these techniques, including the targeting of family members or associates of primary surveillance targets to increase pressure or gather additional intelligence. Wetzling emphasized that these practices are expanding rapidly not only in the United States, where they have been more widely reported, but increasingly in Europe due to the vast amount of commercially available data points.
Despite the growing reliance on Adint, regulatory oversight remains inconsistent. While wiretapping and mass data collection are subject to strict legal frameworks in many countries, rules governing the use of commercially sourced bulk data are often vague, incomplete, or entirely absent. This regulatory gap allows intelligence agencies to exploit legal loopholes by purchasing data either directly or through intermediaries, sometimes to obscure their involvement.
Calls for greater regulation have been mounting among European oversight bodies. Agencies themselves have acknowledged the legal uncertainties surrounding commercial data exchanges. In 2021, France’s Directorate-General for External Security (DGSE) reportedly urged legislators to establish legal controls on the use of commercial data in intelligence operations, but no comprehensive laws have yet been enacted. Meanwhile, the expansion of Adint practices shows little sign of slowing as governments seek to leverage the vast troves of consumer data amassed by commercial data brokers.