As AI radically increases the ease and efficiency of analyzing bulk data, the stakes of limiting what information the government can collect about its own citizens are growing rapidly. Constraining this power doesn't require restricting AI progress—it requires closing legal loopholes that predate AI entirely.
The Government Surveillance Reform Act (GSRA), a bipartisan bill introduced in March by Senators Lee, Wyden, Warren, and Lummis, and Representatives Davidson and Lofgren, illustrates how to constrain the government's ability to surveil its own citizens without undermining the power of the U.S. relative to its adversaries. In broad strokes, the bill closes loopholes that intelligence agencies can use to surveil Americans, while preserving their ability to collect information on foreign persons of interest.
The GSRA primarily addresses two sets of problems. First, it reforms Section 702 of the Foreign Intelligence Surveillance Act (FISA)—the programmatic surveillance authority that sweeps in Americans' communications and lets agencies query them without a warrant. Second, it closes several loopholes that arise from the third-party doctrine — the legal principle that you lose your expectation of privacy in information you share with a third party, which agencies exploit to purchase sensitive data from commercial brokers rather than obtaining a warrant.
Reforms to Section 702
Requiring warrants for backdoor searches of Section 702 data
Section 702 authorizes the government to conduct surveillance of non-U.S. persons located abroad by directing U.S. electronic communication service providers to supply their communications. Rather than requiring individualized warrants for each target, the Foreign Intelligence Surveillance Court approves broad annual certifications authorizing entire categories of foreign intelligence collection—counterterrorism, cybersecurity, drug trafficking—and reviews the government's procedures for targeting and querying. The proceedings are one-sided (only the government appears), and the court has never rejected a certification outright. While in theory only foreigners can be targeted, Americans' communications are inevitably swept up when they communicate with those targets. This “incidental collection” is stored in classified databases, retained for up to five years, that agencies can then query.
Before 2024, the FBI could run queries of the 702 database for purely criminal purposes, though accessing the content results required an order from a FISA judge. The 2024 Reforming Intelligence and Securing America Act (RISAA), which last reauthorized Section 702, banned such queries entirely. However, this had limited practical effect because most queries can be framed as having a dual foreign intelligence and law enforcement purpose, and those queries require no judicial approval. The GSRA would close this gap by requiring a warrant for all access to Americans' communications in the 702 database, regardless of the stated purpose. Like every other warrant requirement in Fourth Amendment law, this comes with exceptions for genuine emergencies: the warrant requirement does not apply when a federal agent has a reasonable belief that an emergency exists involving an imminent threat of death or serious bodily harm, when the subject consents, or when the subject is already under a FISA order or criminal warrant.
Repealing the expanded surveillance infrastructure
RISAA broadened what kind of companies the government can compel to assist with Section 702 surveillance to include not just telecom providers and similar, but anyone who "has access to equipment that is being or may be used to transmit or store wire or electronic communications." The FISA Court's own appointed amicus has warned that this language is broad enough to encompass landlords, data centers, and essentially any business with a Wi-Fi network. The GSRA would repeal this expansion entirely and revert the definition to its original 2008 scope, which still covers telecom carriers, email providers, and cloud computing services, but not landlords, data centers, or businesses that simply operate a Wi-Fi network.
Reforms beyond Section 702
Closing the data broker loophole
Currently, federal law enforcement agencies can purchase detailed location histories, browsing data, app telemetry, and communication metadata on millions of Americans from commercial data brokers with no warrant. FBI Director Kash Patel confirmed in March 2026 that the FBI purchases Americans' data for law enforcement purposes. Patel refused to deny the collection of location data in particular.
The legal theory that agencies often advance is that, although the Supreme Court ruled in Carpenter v. United States (2018) that the government needs a warrant to compel a carrier to hand over location data, purchasing the same data from a broker is different. The Court did not actually address that question, calling its ruling narrow. In fact, no court has addressed whether purchasing the data is more permissible than compelling it. But the Roberts Court's reasoning in Carpenter makes this distinction hard to sustain: the Court held that location data is constitutionally protected specifically because cell phones are "indispensable to participation in modern society" and collect location information automatically. Chief Justice Roberts writes that “in no meaningful sense does the user voluntarily” share this data. With the Supreme Court having declined to answer whether agencies can purchase this admittedly involuntarily shared data, agencies have answered the question for themselves. In the absence of courts taking up this issue, a legislative fix is necessary. To that end, the GSRA would ban the federal government from buying Americans’ information from data brokers without a warrant.
Requiring warrants for modern data types
The GSRA would require law enforcement to obtain a warrant to access Americans’ location data through any means—compulsion, purchase, or voluntary handover. The legislation defines “location information” as meaning “information derived or otherwise calculated from the transmission or reception of a radio signal that reveals the approximate or actual geographic location” of a person. GSRA separately requires warrants to compel disclosure of Americans’ web browsing history, internet search records, and AI chatbot interaction logs.
Voluntary handover of Americans’ non-location data by service providers would not require a warrant, and is an area where the bill could arguably be strengthened. This gap reflects the broader problem with third-party doctrine: under current law (and even under the GSRA, if enacted), when a provider voluntarily shares your data with the government, you may have no Fourth Amendment protection because the data was “shared” with a third party. Carpenter began to chip away at this doctrine in the particular case of location data being compelled, but voluntary disclosure remains largely unregulated. At a minimum, Congress should consider requiring conspicuous, informed user consent—something more meaningful than a buried clause in a terms-of-service agreement that nobody reads — before a provider can voluntarily disclose an American’s data to a federal law enforcement or intelligence agency.
AI Raises the Stakes
Bulk location data, browsing histories, and communication metadata are of limited use if a human analyst has to manually review each record. However, modern AI systems can synthesize millions of data points into comprehensive reconstructions of individuals' movements, associations, habits, and beliefs at scale, in real time, and with decreasing marginal cost per person analyzed. The combination of bulk purchased data and frontier AI gives the government powers that are qualitatively different from either in isolation. In fact, it enables the infrastructure for surveilling an entire population, not just individual suspects.
The GSRA would close a set of loopholes that, left open, could allow the domestic surveillance apparatus to scale alongside AI capabilities in ways that would be very difficult to reverse once established. There are genuine tradeoffs with domestic law enforcement—requiring a warrant will make some investigations marginally slower—but this is the same tradeoff the Fourth Amendment already imposes on house searches, wiretaps, and bank records. For policymakers looking for a concrete, ready-to-go intervention to limit AI-driven power concentration, this bill is a strong contender.
