The 29-page consumer complaint, filed Wednesday and reported by NPR, names Penlink, Thomson Reuters, Motorola, Insight LPR, LexisNexis, Flock Safety, ThunderCat Technology, and others. Most of the alleged pipeline is vehicle location captured by automatic license plate readers sold under government contracts. Penlink is accused of selling cell-phone location through its Webloc product. ThunderCat is named over a Homeland Security Investigations contract involving individual taxpayer identification numbers.
The groups want Brown to “use the full force” of Maryland’s privacy statutes and stop agencies from buying commercial data that, they argue, enables mass location tracking without a warrant, a statute, or public debate.
Penlink and Thomson Reuters told NPR they comply with the law. The Attorney General’s office confirmed it received the filing and is reviewing it. Under the Maryland Online Data Privacy Act, only the AG can enforce. There is no private right of action.
What the state law actually bars
Maryland’s commercial privacy law is among the stricter state statutes. Later amendments, including HB 711, tighten sales of personal data when the buyer is in the immigration-enforcement business. Controllers are restricted from selling personal data if they knew or should have known the purchaser wants it for immigration enforcement, and from knowingly selling to a government unit that, in the prior six months, engaged in or supported civil immigration enforcement with staff or material support.
Precise geolocation is defined tightly: technology that can place a consumer, a phone, or a vehicle within about 1,750 feet. That definition is built for phone pings and plate-reader hits, not for a vague “we have some location.”
Advocates say the statute was written for exactly this fact pattern: brokers packaging movement data and selling it into federal enforcement without a judicial warrant. ICE has expanded its use of commercial databases and surveillance tools. The complaint treats that market as the violation, not only a policy fight in Washington.
We Are CASA helped lead the filing. Legal director Shana Khader told CBS Baltimore that arrest paperwork has cited license-plate runs. “That’s accessing state data in order to find information about these drivers.”
ALPR is the volume product
Plate readers are not new in Maryland. What changed is density. Local reporting this month said reader networks, including Flock deployments, nearly doubled in 2025 and logged about 1.1 billion scans. Those cameras sit on poles, lots, and patrol routes. The product is a searchable history of which car was where, and when.
Thomson Reuters and LexisNexis already sell ICE a mix of public records and proprietary files. Combining that with live or near-live vehicle movement is what turns a people-search tool into a travel log. The complaint’s theory is that Maryland residents did not consent to that reuse, and that state law no longer treats “we sold it to government” as a free pass when the government customer is doing civil immigration work.
Why brokers matter more than a single camera
A city can argue its own reader is a local policing tool. A broker that ingests many jurisdictions and licenses the feed to a federal customer is doing something else: assembling a statewide or national movement graph and putting a price on queries. Phone-location products sit on the same shelf. Once both feeds exist, the buyer does not need the state’s DMV to hand over a file. It buys the trail.
That is the loophole state privacy laws keep trying to close. Public-records exceptions and “government customer” clauses let a lot of data move. Maryland’s newer text tries to cut the immigration-enforcement sale even when the data started as a traffic camera or an app ping.
Whether Brown’s office agrees the named companies meet the statute’s knowledge standard, the “sale” definition, and the enforcement window (MODPA processing rules apply to activity on or after April 1, 2026) will decide if this stays a letter or becomes a case.
What companies in the location business should assume
If you sell, license, or query-enable precise location or plate history, and any customer is federal, state, or local law enforcement, inventory the Maryland traffic. Know whether the buyer supported civil immigration enforcement in the last six months. Do not treat an administrative subpoena as a substitute if the statute wants a warrant. Document the legal basis for each feed. If you cannot say who ends up querying a Maryland plate, you cannot say you complied.
The complaint is not a finding. It is a demand that the one official who can sue actually look. For data brokers and ALPR vendors, the message is already operational. Maryland wrote a rule aimed at this market. Someone has asked the AG to use it.