EU data privacy under fire as brokers sell phone location histories of senior officials

European Union

A new investigation has revealed that the location data of senior European Union officials is being traded by data brokers, exposing deep flaws in Europe’s enforcement of its own privacy laws. Despite the EU’s stringent GDPR framework, journalists found that it was alarmingly easy to purchase and analyse highly sensitive location information belonging to political staffers and government employees.

According to the report by Netzpolitik, a coalition of reporters gained access to a free sample dataset offered by a data broker, containing 278 million individual location points from millions of devices around Belgium. The dataset included detailed movement histories of officials working within the European Commission and European Parliament, both based in Brussels.

Reporters said they were able to identify hundreds of devices linked to EU personnel, including 2,000 location markers from 264 officials and nearly 5,800 markers tied to over 750 devices inside the Parliament. Many of these data points originated from ordinary smartphone apps that collect background location data and sell it to brokers, who then resell it to private companies, governments, and military clients.

EU authorities have acknowledged concerns over the practice and issued internal guidance to help staff reduce tracking risks. However, privacy watchdogs have been criticised for failing to enforce stronger measures against the booming data brokerage industry, now worth billions.

Security experts warn that such data, when exposed, could reveal officials’ commuting routes, workplaces, and private meeting locations—posing national security risks. Users are advised to limit app permissions, anonymise their device identifiers, and reset advertising IDs regularly.

The findings come just a year after U.S.-based data broker Gravy Analytics suffered a massive breach that exposed location data linked to tens of millions of people worldwide, showing how fragile privacy protections remain even under strict regulatory regimes.