Trade papers from the bazaar (a resource collection)

Almost everything known publicly about this market comes from one continuing investigation by netzpolitik.org with a rotating set of broadcast partners, running since July 2024. The pieces below are the primary record. Where an English version exists it is given, since much of the reporting appeared first in German and some of it only in German.

Phase one: the German file, July to November 2024

How data brokers sell our location data and jeopardise national security, netzpolitik.org with Bayerischer Rundfunk, 16 July 2024. The English summary of the opening phase, and the shortest route into the whole story: 3.6 billion location points from Germany, obtained as a free sample. It is also the piece that puts a price on the goods, around 14,000 dollars for the continuous stream the sample previews, where the German report of the same day does not.

Firma verschleudert 3,6 Milliarden Standorte von Menschen in Deutschland, 16 July 2024. The mechanics of the acquisition: the marketplace, the seller, the coverage claimed of up to 163 countries refreshed hourly, and the video verification call that some sellers ask for and this one did not. Useful for anyone who wants to know what a record actually contains.

Wie Datenhändler Deutschlands Sicherheit gefährden, 16 July 2024. The sites: Bad Aibling, the domestic intelligence service in Cologne, the special forces barracks at Calw, Büchel air base. Also the identification method, which is directories and professional profiles rather than anything exotic, and the aggregation findings: 131 identifiers at both military facilities and brothels, 160 at both brothels and government buildings.

Wie Datenhändler NATO und US-Militär blossstellen, netzpolitik.org with WIRED and Bayerischer Rundfunk, 20 November 2024. Thirteen installations counted, with record counts and device numbers per site, the latter given as upper bounds. The clearest single source on the scale of military exposure, and the origin of the line that an institution can only sensitise, warn and hope.

Phase two: the international file, 2025

New data set reveals 40,000 apps behind location tracking, 15 January 2025. The apps named: 380 million records and 47 million advertising identifiers across 137 countries, from one day’s collection. A German version appeared the same day.

Outing durch Standortdaten, netzpolitik.org with NRK, 25 May 2025. The Norwegian case, and the best short demonstration that pseudonymity survives one dataset and not two.

Phase three: institutions and state customers, 2025 to 2026

Databroker Files: Targeting the EU and Datenhändler verkaufen metergenaue Standortdaten von EU-Personal, netzpolitik.org with Bayerischer Rundfunk, L’Echo, Le Monde and BNR, 4 November 2025. The Brussels reporting in English and German: the Commission, the Parliament, NATO headquarters, and five identified officials.

All you need to know about how adtech data exposes the EU to espionage, 4 November 2025. The overview piece, including the institutional responses and the split between enforcing existing law and demanding new prohibitions.

Handy-Daten exponieren Begleiter von Emmanuel Macron, 10 December 2025. The French file, roughly a billion records, and one person identified as working for the gendarmerie.

Bundesregierung macht Datenkauf zum Staatsgeheimnis, 19 December 2025. The German government’s refusal to say whether its agencies buy, and the summary of the Bundestag research service opinion.

Deutsche Polizei nutzt offenbar rechtswidrig Databroker, 2 June 2026. The survey of the sixteen state police forces and their data protection authorities, and the argument about judicial authorisation being circumvented by purchase.

Regierung in Österreich will Menschen mit illegalen Daten orten können, 30 June 2026, and Orbán-Regierung soll neuartige Überwachungsprogramme angeschafft haben, 10 April 2026. The two confirmed EU customers, with the Austrian contract value and the vendor’s wider catalogue.

Gefährliches Überwachungs-Werkzeug breitet sich aus, 11 August 2026. The offer to LVMH, and the note that the tool’s known users until then were governments rather than private companies.

How the market works

Im Dschungel der Datenhändler, 12 February 2025. Every intermediary asked to account for itself, with the answers printed next to each other. The single most useful source for the responsibility question, and the backbone of the graph. It also carries two findings that turn up everywhere else: brokers giving ageing records fresh timestamps to sell them on as new stock, and the check on Google’s certified bidders, of which nearly a third had unreachable websites in February 2025.

ADINT: Gefährliche Spionage per Online-Werbung, 19 July 2024. The surveillance industry built on advertising infrastructure, from the 2017 coinage of the term to the vendors selling it now.

Werbe-IDs damals und heute, 3 September 2024. A decade of advertising identifier history, and the best short answer to why the reset button has not helped much.

Datarade: Geschickte Geschäfte im Graubereich, 25 July 2024, and Das gefährliche Geschäft mit Standortdaten geht weiter, 16 September 2025. The Berlin marketplace, first examined and then revisited. The second piece carries the supervisory position exactly: while a marketplace does not process the data itself and only puts buyers and sellers in touch, the Berlin authority has no handle on it.

Abgeordnete kritisieren Staatsgeld für Datenmarktplatz, 31 July 2024. Public venture money in the shop window, and a ministry explaining that it has no influence over the fund it largely paid for.

The opinion of the Bundestag’s research service on whether security authorities may buy personal data from brokers carries the reference WD 3 - 3000 - 065/25, runs to twenty-five pages, and is published as a PDF on bundestag.de. Its conclusions, as reported: the federal criminal police and the federal police lack an authorising basis for such purchases, while for the three federal intelligence services a purchase might be justified in individual cases, under very limited conditions. The opinion also treats the purchase as a potentially serious interference with fundamental rights, for which the bar is correspondingly high. The report on the government’s refusal to answer of 19 December 2025 is the source for all of this, since the PDF itself has proved unreachable from here.

On film

Dangerous apps: in the web of data brokers, DW Documentary, April 2026. The televised version of the same investigation, described as an analysis of around ten billion location records, following among others an Egyptian journalist living in exile in Berlin and senior European Commission staff. Its framing of the trade as an exfiltration that is legal in appearance is the journalistic statement of what the responsibility graph shows structurally.