SYSTEM-DRIVEN: U.S. data governance rules aimed at limiting how commercial location data can be bought and sold near sensitive government facilities are facing new scrutiny after lawmakers identified major gaps in their coverage, including the exclusion of some of the most important federal sites.

The rules in question were designed to restrict foreign adversaries from purchasing commercially collected smartphone location data that could reveal the movements of people working at or visiting sensitive government locations.

The policy targets data brokers, companies that aggregate and sell anonymized but highly precise location information generated by mobile devices, apps, and advertising networks.

Such datasets can be used to reconstruct movement patterns, identify regular visitors, and infer operational details about government facilities.

A group of congressional Democrats is now warning that the implementation of these restrictions leaves out several high-profile and strategically critical sites, including the White House, the U.S. Capitol complex, and the headquarters of the Central Intelligence Agency.

The concern is not that these locations are entirely unprotected in a physical or classified sense, but that they were not explicitly included in the geofenced list of protected coordinates used to trigger the strongest data-sale prohibitions.

The rules reportedly cover hundreds of federal sites by defining precise geographic coordinates around which commercial location data cannot be sold in a granular form to designated foreign countries.

These countries include major geopolitical adversaries such as China, Russia, Iran, North Korea, Cuba, and Venezuela.

Within those zones, even the sale of data showing a single device’s location can be prohibited, reflecting an effort to prevent intelligence agencies from reconstructing sensitive activity through commercial datasets.

Lawmakers argue that the omission of core institutions undermines the logic of the system.

Their position is that adversaries do not need to target obscure or secondary facilities if they can still potentially purchase or infer location data linked to the highest-value government sites.

They are urging officials to expand protections into a broader geographic model that would cover entire metropolitan zones rather than relying on individually mapped buildings.

The mechanism at the center of the concern is the commercial data economy itself.

Modern mobile ecosystems routinely generate continuous location signals through apps, advertising identifiers, and device sensors.

Even when anonymized, this information can often be re-identified or used in aggregate to map behavior patterns.

Intelligence analysts have long warned that such data can reveal patterns such as staff commuting routes, shift timing, and high-traffic security windows around sensitive facilities.

Supporters of stronger restrictions argue that the current framework reflects a structural mismatch between how data is sold and how national security risk is distributed.

By focusing only on selected coordinates, they say the system leaves exploitable gaps that can be pieced together using adjacent datasets or indirect movement tracking.

Government agencies have not publicly responded in detail to the specific criticism, but the debate highlights an ongoing tension in U.S. policy: how to regulate a commercial data market that is global, fragmented, and difficult to fully control, without imposing sweeping restrictions that could disrupt digital services or advertising ecosystems.

The dispute is now shifting toward whether the existing list of protected sites will be expanded and whether a broader regional model will replace the current building-by-building approach, a decision that would determine how comprehensively the United States can shield sensitive government activity from commercially available surveillance data.