ICE appears to be purchasing records tied to immigrants' tax identification numbers from a commercial data broker, according to a $10 million procurement document reviewed by 404 Media on June 17, 2026. The contract targets Individual Taxpayer Identification Numbers — ITINs — which the IRS issues to people who lack a Social Security Number, including those without lawful immigration status.

The Data and the Infrastructure Behind It

ITINs exist specifically to allow people to file taxes and participate in the financial system regardless of immigration status. The American Immigration Council notes that an ITIN can be obtained by individuals with no lawful standing in the United States — which is precisely what makes this procurement notable. The IRS designed the number for tax compliance, not as a population-tracking mechanism.

Data brokers sit at the intersection here. They aggregate names, addresses, Social Security numbers, purchase histories, and, in this case, apparently ITIN-linked records, then sell that compiled profile data to clients that increasingly include federal agencies. The commercial data broker market has long operated in a legal grey zone when it comes to government procurement: agencies can buy what they could not constitutionally collect on their own through direct surveillance.

This procurement does not exist in isolation. In April 2025, the IRS and DHS agreed to share immigrant data for criminal investigations, subject to statutory privacy protections — but Bloomberg Tax reported in February 2026 that the IRS had already overshared thousands of records with ICE beyond those limits. Buying ITIN-linked records from a broker would give ICE a parallel channel to similar data, one that operates outside the inter-agency agreement's constraints.

A Broader Surveillance Stack

The ITIN procurement is one layer of an increasingly dense surveillance architecture ICE has assembled through commercial channels. 404 Media reported in March 2026 that CBP has used location data sourced from the online advertising ecosystem — bid-stream data, effectively — to track individuals' movements. In May 2025, 404 Media documented that local police departments were feeding ICE immigration-related searches through Flock Safety's AI-powered automatic license plate reader network. ICE also deploys a mobile identification app called Mobile Fortify, reported by KQED, capable of identifying individuals in the field.

On the enterprise software side, Thomson Reuters' CLEAR tool — which aggregates public records, utility data, and other PII — is integrated with ICE systems. 404 Media reported in April 2026 that Thomson Reuters shareholders formally demanded an investigation into those contracts. CLEAR, Flock's ALPR network, ad-tech location data, and now broker-sourced ITIN records are all pieces of the same mosaic.

DHS documents ICE's data systems through Privacy Impact Assessments. PIA DHS/ICE/PIA-038, covering the FALCON-DARTTS system, records that the Specially Designated Nationals list contains PII including names, addresses, dates of birth, SSNs and TINs, and passport numbers — confirming that tax identifiers already appear in ICE's existing investigative databases.

The Regulatory Gap

The legal mechanism enabling all of this is the same one civil liberties organizations have pushed Congress to close for years. The Fourth Amendment constrains direct government collection of certain data without a warrant, but it does not govern purchases from private intermediaries. The Brennan Center for Justice has specifically called on Congress to prohibit government agencies from purchasing Americans' sensitive data from brokers. The House passed legislation in 2024 addressing this loophole, according to Cato Institute commentary from March 2026, but no comprehensive federal statute has closed it.

Worth flagging: the scale and specificity of these procurements — spanning ad-tech data, ALPR networks, enterprise PII aggregators, mobile biometrics, and now tax identifiers — means ICE is not relying on any single vendor or legal theory. Each procurement is individually defensible under current law. The aggregate effect is a surveillance capability that would have required court orders and interagency negotiations to assemble a decade ago, now purchasable through standard government contracting.

The ITIN case adds a particular dimension: unlike a license plate or a phone's advertising ID, a tax identification number carries an implicit promise. The IRS built ITIN specifically to encourage tax compliance among undocumented residents, and the number's utility depends on a degree of trust that it will not become a targeting vector. Whether Congress ultimately acts on the data broker loophole or not, that implicit architecture is now visibly under strain.