Security services buy commercially available private data
Security services such as police normally need a warrant from a judge in order to collect personal data from people. From phone calls, to location information, in principle there should be a balance between judiciary and executive powers in order to stay withing the margins imposed by the legislative power.
However, collecting data became a business model for many companies online. Since personal data can be purchased virtually by anyone, that would mean police and other security services could simply buy it instead of petition it to a judge[@cox2020Secret Service buys location data that would otherwise need a warrant].
This is just one more example of why user privacy online should be treated as a right and not as an after thought.
These are the other notes that link to this one.