Mass Surveillance Explained: Who Collects Data and How

Additional resource for the lesson “Mass Surveillance: Actors, Methods and Implications” — Online Anonymity course

Mass surveillance sounds like something from a spy film, but most of it is built from ordinary records: the traces that phones, networks, apps and cameras produce anyway, gathered in bulk by organisations you may never deal with directly. This resource explains, calmly, who collects data at scale, by what methods and within which legal limits, so that you can judge how much anonymity your own life calls for.

A. Why this matters

In this course, privacy means deciding what others know about you; anonymity means being able to act without what you do being tied back to who you are. A targeted investigation starts from a person and looks for their data. Bulk collection works the other way round: it gathers data about many people, almost all of them suspected of nothing, and searches it later.

That is why the topic belongs in a course about anonymity. Data gathered in bulk becomes revealing when it can be linked: a phone number to a name, an advertising ID to a home address, a face to a profile. Knowing who the actors are and how they work shows you which of those links exist in your own life.

None of this means you are being watched personally, or that you should be afraid. Much collection is lawful, limited and supervised; some is not, and courts have said so. The aim here is to swap a vague unease for a clear picture.

What the sources say

A factsheet prepared by the Registry of the European Court of Human Rights together with the EU Agency for Fundamental Rights (FRA), which summarises case law without binding the Court, describes mass surveillance as “systems allowing large-scale technical collection of information in and related to electronic communications”. Summarising the Court of Justice of the EU, it notes that traffic and location data, taken as a whole, “may allow very precise conclusions to be drawn concerning people’s private lives”.

The UN Office of the High Commissioner for Human Rights (OHCHR), in its 2022 report on the right to privacy in the digital age, warns that “indiscriminate surveillance is likely to have a significant chilling effect on free expression and association”. It also describes governments “acquiring data from data brokers and other companies collecting and selling personal data”, and observes that such practices “can circumvent crucial procedural restrictions and safeguards”.

Regulators on both sides of the Atlantic have acted on data brokers. In the United States, the Federal Trade Commission (FTC), the consumer protection regulator, alleged that two location data companies collected and used location data “without obtaining verifiable user consent for commercial and government uses”; its final order of January 2025 restricts what they may do with sensitive location data. In France, the data protection authority, the CNIL, fined a marketing company €900,000 in May 2025 for using contact data bought mainly from data brokers, finding that misleading sign-up forms “made it impossible to obtain free and unambiguous consent”.

B. Key concepts

Six ideas: who collects, how, and what the law asks in return.

Bulk collection versus targeted surveillance

Targeted surveillance concerns a named person or a specific line, usually with a prior reason and an authorisation. Bulk collection gathers whole streams of data, such as the communications crossing a cable or the records of a whole network, and filters them afterwards.

Why it matters to you: In bulk collection you are not selected because of anything you did. What decides how much the data says about you is how easily it can be linked to your identity.

Three kinds of actor

The first is the state, the source of government surveillance: intelligence agencies and police, acting under national laws. The second is the companies whose services you use, which record activity to run, improve and fund them; this business model is sometimes called surveillance capitalism. The third is data brokers, companies you have usually never heard of, which buy, combine and resell personal data.

Why it matters to you: The three overlap. Data collected by a company for one purpose can be bought by a broker and later by a public body, so “who holds my data?” rarely has a single answer.

Metadata in bulk

Content is what you say or write. Metadata, here called traffic or communications data, is the record around it: who contacted whom, when, from where, for how long. In the Big Brother Watch judgment of 2021, the European Court of Human Rights found that such data “are capable of being analysed and interrogated so as to paint an intimate picture of a person”.

Why it matters to you: Metadata is easier to collect, store and search at scale than content. A pattern of calls, places and times can say more about your life than the words in any one message.

Data brokers and bought data

Brokers gather data from apps, websites and other suppliers, often location data from phones. According to the FTC, one of the companies it pursued claimed to collect “more than 17 billion signals from around a billion mobile devices daily”. The final order prohibits them from “selling, disclosing, or using sensitive location data”, except in limited circumstances involving national security or law enforcement.

Why it matters to you: A permission you gave a weather or game app can feed a market you never chose to join. This is the actor you can influence most directly, through the permissions you grant.

Cameras and facial recognition

A camera records an image; facial recognition is what can link that image to a name. The difference matters for anonymity: being seen in a crowd is not the same as being identified in it.

As of November 2026, the EU AI Act prohibits “the untargeted scraping of facial images from the internet or CCTV footage” to build facial recognition databases, and it restricts live facial recognition in public spaces for law enforcement to narrow cases. These prohibitions have applied since 2 February 2025.

Why it matters to you: Rules on cameras, and on how faces may be matched to identities, differ from country to country and are still changing. The resource on protest surveillance in this section looks at live facial recognition in more detail.

Necessity, proportionality and oversight

In Europe, the right to privacy rests on Article 8 of the European Convention on Human Rights and on Articles 7 and 8 of the EU Charter of Fundamental Rights, which cover private life and the protection of personal data. In 2020 the Court of Justice of the EU confirmed that EU law precludes requiring telecoms providers to keep everyone’s traffic and location data in a general and indiscriminate way, with an exception for a serious threat to national security that is “genuine and present or foreseeable”, limited in time and reviewed by a court or an independent body. In 2021 the European Court of Human Rights held that a bulk interception regime must have “end-to-end” safeguards, and found that the UK’s regime at the time did not have enough of them.

Why it matters to you: European law does not ban every form of surveillance; it asks whether each measure is necessary, proportionate and supervised by a court or an independent body. That is a standard you can use to think about any measure you hear of.

C. A practical example: Luca’s day trip to Lyon

Luca is 36, lives in Milan and travels often for work. One Tuesday he takes an early train to Lyon for a meeting and is home by midnight. Nothing unusual happens, and nothing about the day is secret. He wonders, half curious and half sceptical, how many organisations could tell the story of that day.

He books the train in the operator’s app, with his name on the ticket. In France his phone connects to a local mobile network. A weather app he installed months ago has his location all the time. He pays for lunch by card, passes through two stations with cameras, and sends a photo of the river to friends in the evening.

What changed when Luca mapped the actors

He did the exercise in section D on the train home:

• He found more than a dozen possible holders of data about his day, in three groups: companies he chose (the train operator, his bank, his messaging app), companies he had not chosen (whoever receives data from the weather app), and public bodies that can request or receive records under national law.

• He noticed that most of what the networks and stations hold is metadata, and that how long mobile operators keep it depends on national rules within the limits set by European courts.
• He saw that the weather app was the one link he could change on the spot, so he set its location access to “only while using the app”.

He kept the train app and his card: the data they hold is part of a service he wants. In the notes for his personal threat model, he wrote one line: his concern is commercial data trails rather than any investigation, so app permissions matter more to him than heavier tools on an ordinary day.

D. Try it yourself: map who could hold data about your day (15 minutes)

Four short steps, on paper or in a note. Use one ordinary day, and write down roles, not secrets: “my bank”, not your account number.

Step 1 — List the moments (4 minutes)

• Pick yesterday, or a typical weekday.
• List the moments when a device, a service or a camera could have recorded something: travel, payments, messages, searches, apps open in the background, places with cameras.
• Ten to fifteen moments are plenty.

Step 2 — Name the possible holders (5 minutes)

Next to each moment, write who could plausibly hold a record of it, using three letters:

• C for a company you chose: your bank, your mobile operator, the app you opened.
• T for a third party you did not choose: an advertising network, a data broker, a partner named in a privacy notice.
• P for a public body that could request or receive the record under the law of your country.

Step 3 — Mark content and metadata (4 minutes)

• Underline the moments where what is held is metadata (time, place, who with) rather than content.
• Circle the moments where two records could easily be linked, for example by your phone number, your card or an advertising ID.
• Notice which letter, C, T or P, appears most often. It is a picture, not a score.

Step 4 — Choose one link and one question (2 minutes)

• Choose one T link you could loosen this week, such as an app permission you no longer need.
• Write one question for your personal threat model: which of these actors would you actually want to keep at a distance, and why?

One link you understand is worth more than a long worry about all of them.

Already covered in the Online Privacy course

What Can My Internet Provider See? Home Connection Privacy
It explains what your own internet provider can see of your home connection and what encrypted DNS changes; this resource steps back to the wider picture of who collects data at scale, by what methods and within which legal limits.

E. Videos, articles and further resources

International and European sources first, then US and French regulators. All in English.

International and European institutions

UN Office of the High Commissioner for Human Rights — The right to privacy in the digital age (A/HRC/51/17, 2022)
The UN human rights office’s report on surveillance, encryption and governments buying data from brokers.
https://digitallibrary.un.org/record/3985679

European Court of Human Rights and EU Agency for Fundamental Rights — Joint Factsheet: Mass surveillance
A plain summary of the main European court rulings on bulk interception and data retention, updated regularly.
https://ks.echr.coe.int/documents/d/echr-ks/mass-surveillance

Court of Justice of the European Union — Press release No 123/20: Judgments in Case C-623/17, Privacy International, and joined cases
The 2020 rulings on general and indiscriminate retention of traffic and location data, and their exceptions.
https://curia.europa.eu/jcms/jcms/p1_3252415

European Commission, AI Act Service Desk — Article 5: Prohibited AI practices
The text of the AI practices banned in the EU, including untargeted scraping of facial images and real-time remote biometric identification.
https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5

Regulators

FTC (US) — FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data Tracking Consumers to Sensitive Sites
The 2024 complaint against two location data brokers, with the scale of data they claimed to collect.
https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers

FTC (US) — FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data
The final order of January 2025 and what it prohibits.
https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data

CNIL (France) — Data brokers: SOLOCAL MARKETING SERVICES fined €900,000
A European data protection authority’s 2025 decision on marketing data bought from data brokers without valid consent.
https://www.cnil.fr/en/data-brokers-solocal-marketing-services-fined-eu900000

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding who collects data at scale before deciding which links in your own life to loosen.

Skills

• Telling bulk collection apart from targeted surveillance.
• Sorting the possible holders of your data into companies you chose, third parties and public bodies.
• Recognising metadata in your own day and the identifiers that link it to you.

Awareness

• Understanding that data collected for one purpose can travel to actors you never chose.
• Knowing that European law asks surveillance measures to be necessary, proportionate and independently supervised.
• Seeing surveillance as context for your choices, not as a reason for fear.

Secure Behaviour

• Granting location and other permissions only to apps that need them.
• Treating your personal threat model as the place where this context becomes decisions.
• Revisiting your map of actors now and then, as apps, habits and rules change.

G. Questions to sit with

• Which actor on your map would you most like to know more about, and what would you ask it?
• Where in your day do you trade data for a service you value, and where are you no longer sure the trade is fair?
• If one link between your data and your name could be cut tomorrow, which would make the biggest difference to you?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. What you feed into commercial data flows

• R13 — Check what your apps can do: an app’s location permission is one of the ways data reaches brokers you never chose.
• R12 — Turn off Bluetooth and location when you are not using them, so that your phone produces fewer location records in the first place.

Minimum commitment: today, set one app that has no clear need for your location to “only while using the app” or “don’t allow”.

2. Knowing the rules that apply to you

• EU data protection law lists a right of access among your data protection rights: when you are curious about a company on your map, its privacy notice is usually where to find how to ask what it holds about you.
• When you hear of a new surveillance measure, ask the three European questions: is it necessary, is it proportionate, and who supervises it? Rules vary by country and change over time.

Minimum commitment: this month, read the privacy notice of one company marked T or C on your map and find the section on who it shares data with.

In short

• Mass surveillance collects data about many people first and selects later; how revealing it is depends on how easily the data links back to you.
• The main actors are states, the companies whose services you use, and data brokers, and data can move between them.
• In Europe, courts have ruled that general and indiscriminate data retention needs strict limits, and that bulk interception needs safeguards from start to finish.
• Understanding the actors is the context for your personal threat model; the permissions you grant are the link you control most directly.

Related resources in this course

• Protest Surveillance: What It Means for Your Rights
• Internet Censorship Around the World: How Blocking Works
• Age Verification and Anonymity: What Changes for You
• Your Personal Threat Model: How Much Anonymity Do You Need?

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.