The liability sink¶

A location record leaving a phone in Brussels passes through five or six businesses before it reaches somebody who wants to know where a particular person sleeps. Every handover is a contract between two consenting companies. Each company can explain its own step in a sentence, and most can point at the step before as the place where the interesting question lives. The result is an outcome none of them owns, which looks less like a market that went wrong than like one built to this shape.

The graph¶

The fourth column holds what each sender says about a transfer, rather than a purpose anybody has established. Those accounts show how a party presents its own edge. They say nothing about whether the purpose named there survives the next handover.

The properties that do the damage are the ones a data flow diagram leaves out. The graph runs one way and has no return edge, so no question asked at edge 1 has a path to edge 8. Purpose attaches at edge 1 and stops there: every later edge inherits the records without the reason that authorised them, transferability being the one property nobody claimed for consent and the one the market runs on. And the out-degree at edge 4 is in the hundreds, which is where provenance dies. A broker’s refusal to name its sources is barely needed once the sources can no longer be reconstructed.

Each record carries coordinates, an advertising identifier and a timestamp, with no name and no telephone number, which is what keeps every edge defensible in isolation. Pseudonymity, though, is a property of one dataset rather than of two, as the join shows.

Every edge is defensible¶

Asked where the data came from and where it went, the participants answer for their own edges, and the answers fit together into nothing at all. Developers describe the kits as third-party software and say they trust their partners. Brokers cite contracts that forbid naming sources. One German demand-side platform confirmed processing 1.8 billion bid requests a day and denied selling any of it onward. A Lithuanian adtech firm whose own documentation describes collecting identifiers, coordinates and addresses denied a broker relationship with the company that had named it as a source. Google and Apple deflected the question of what their certification certifies, and nearly a third of 540 certified bidder websites turned out to be unreachable. Datarade holds that proactively reviewing every listing for possible legal violations is neither practically possible nor legally required.

None of these positions is obviously false, which is the difficulty. A lawyer at the privacy organisation noyb, quoted in netzpolitik.org’s survey of the intermediaries put the aggregate flatly: the system is not legal. It continues anyway. Enforcement spread the length of a chain like this is work nobody has been resourced to do.

Assessed by the edge, because that is how the law looks¶

Data protection law presumes a controller: an identifiable party that decided what would be collected and why, and can therefore be asked about it. The question is asked per processing operation, which is to say per edge. A market assembled from many small controllers, each answerable for one edge and for nothing on either side of it, answers that question correctly at every point and produces a movement profile of a named person at the end of it.

This is not a loophole in the sense of an oversight. Each edge really is a separate decision by a separate company, with a separate claimed lawful basis to test, and any supervisor who picks one up finds a defensible transaction between two businesses. The aggregate has no vertex. There is no party in the graph whose decision produced the outcome, because the outcome is a property of the path, and paths are not legal persons.

What the shape produces¶

A graph like this predicts its own enforcement history, and the record so far has been obliging. Pressure lands on the smallest legible node, usually an app developer, because that is the party a supervisor has jurisdiction over and a citizen has heard of. Removing a broker changes little: Datastream Group announced it had permanently ceased selling location data, and the capability carried on, the structure being a lattice of substitutable nodes rather than a chain with a keystone. Institutions that discover their staff in the files reach for the one actor they can instruct, which is the person at edge 1 holding a handset, and the remedy lands there because nowhere else in the graph is reachable from a personnel department. Buyers appear at the far end because the far end is the only position with an unobstructed view of the whole.

A market in which everybody earns and nobody answers is not one that forgot to assign responsibility. It is one that assigned it carefully, in pieces small enough that no holder can be made to carry what the pieces add up to.

The clerk’s brief¶

December 2025: The purchase becomes a state secret¶

On 19 December 2025 the federal government refused to say whether its criminal police, federal police or three intelligence services buy from brokers, withholding the answer even from members of parliament in classified form, while adding that it does not rule out such purchases in individual cases. An opinion from the Bundestag’s research service (WD 3 - 3000 - 065/25) had found no authorising basis in the statutes governing the federal criminal police and the federal police, while allowing that for the intelligence services such a purchase might be justified in individual cases, under very limited conditions. The clerks note that a purchase whose legality is contested and whose existence is classified cannot be litigated by anyone who might have standing to try.

November 2025: The Commission prefers the law it has¶

Alongside the reporting on EU staff, the Commission’s position on remedies was that existing data protection law wants enforcing rather than replacing. Members of the Parliament read the same evidence and asked for a trading ban on sensitive location data and a register of brokers. The clerks observe that the enforcement position requires a party to enforce against, and that the graph was drawn specifically to make that party hard to name.

September 2025: The supervisor with no mechanism¶

Returning to the Berlin marketplace in September 2025, netzpolitik.org recorded the missing piece: the city’s data protection authority said that as long as a marketplace does not process the data itself, and only puts buyers and sellers in touch, it has no handle on it. Individual listings came down after press enquiries; the shop stayed open. The clerks file this as the cleanest illustration on record, the supervisor and the supervised in the same city and no procedure connecting them.

July 2024: The ministry with no influence¶

On 31 July 2024 members of four parliamentary groups criticised public money sitting in Datarade through the High-Tech Gründerfonds, more than half of whose 320 million euros comes from the federal economics ministry. The ministry replied that it takes the matter very seriously and has no influence over the fund’s investment decisions. The clerks record the sink reproduced inside the state: money at one end, no lever at the other, and the arrangement working exactly as designed at both.

The chain of hands¶

Every edge in this market has an owner, and the outcome has none. Supervisors can reach app developers, who are numerous and poor, and the marketplace, which lists rather than sells; along the auction fan-out there is nobody to reach. Public money funds a node the state cannot instruct, and the federal government has made its own purchases unanswerable. The clerks’ standing assessment is that the distribution of answerability here is engineered rather than accidental, and that any remedy aimed at a single node will be absorbed by the node next to it.