Congress Wants to Know Why the Pentagon’s Ad Tracker Ban Didn’t Stop Troop Tracking

US Senator Ron Wyden and Representative Pat Harrigan sent a letter to the Department of Defense’s Inspector General on Friday, September 4, 2026, asking for a formal investigation into a problem the Pentagon was supposed to have already fixed: commercially purchased location data is still exposing where American troops are, months after the military told Congress it had closed the loophole.

The letter, reported by The Register, is not the opening chapter of this story. It is a follow-up to a bipartisan warning from May, and it exists because the fix that followed that warning has not actually stopped the underlying problem. That gap between “the vulnerability is patched” and “the data is still leaking” is a familiar shape in enterprise security, and it is worth understanding in detail because the same data supply chain that exposes troop movements also runs through every organization that manages a fleet of mobile devices.

A Threat the Pentagon Says It Already Knew About

In May 2026, Wyden, Harrigan, and 12 other bipartisan members of Congress, including Senators Martin Heinrich, Elizabeth Warren, Edward Markey, and Alex Padilla, revealed in a joint press release that foreign adversaries were buying commercial location data to track and target US servicemembers in the Middle East. According to that release, US Central Command (USCENTCOM) “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater” during Operation Epic Fury, and lawmakers warned that such data “can be used to identify where U.S. troops congregate and their pattern of life” for the purpose of targeting missiles, drones, and intelligence operations.

The lawmakers noted that the Department of Defense has been aware of this general threat since at least 2016. What made the May disclosure notable was not that data brokers existed, but that the mechanism was so ordinary: everyday advertising software development kits (SDKs) baked into ordinary phone apps, quietly harvesting and reselling location data at scale, with military personnel swept in along with everyone else.

The Fix: Turning Off One Identifier

The May letter, addressed to Defense Department Chief Information Officer Kirsten A. Davies, called for two concrete steps: disabling advertising identifiers on DoD-issued smartphones, and requiring that advertising identifiers be disabled on any personal device brought into DoD facilities or carried overseas. A mobile advertising identifier, often shortened to MAID, is a reset-able string of characters that apps and ad networks use to build a profile of a device across different services without needing a name attached to it.

The Pentagon moved on the first request. According to Task & Purpose, the Army, Navy, Air Force, Marine Corps, and Special Operations Command have all since confirmed disabling MAIDs on government-issued devices. Wyden’s May press release separately noted that USCENTCOM had, “for the first time,” gained the capability to disable location sharing on the smartphones it manages.

A Rollout With Gaps

The response was not simultaneous across the services. Task & Purpose reported that the Air Force only directed its personnel to disable ad trackers in July 2026, roughly two months after the initial disclosure, while other branches said they had already done so by summer. That gap between branches is one of the specific things the September letter to the Inspector General now asks about directly.

Three Theories, One Unanswered Question

The core problem the new letter raises is straightforward: despite the branch-by-branch rollout of MAID-disabling, commercial location data tied to DoD personnel and facilities is still turning up for sale. Wyden and Harrigan wrote to the Inspector General, as quoted by The Register: “We commend these service branches for implementing this cybersecurity defensive best practice on government devices. However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions.”

The lawmakers offer three possible explanations, and they are asking the Inspector General to determine which one, or which combination, is correct:

• Some DoD components may have only disabled advertising identifiers as recently as July 2026, meaning months of exposure were never actually closed.
• Disabling advertising identifiers alone may no longer be sufficient to prevent location data from being collected and resold.
• The leaking location data may be coming entirely from the personal devices of DoD personnel and contractors, which fall outside the scope of a government-device-only policy.

Why Turning Off One Setting Was Never Going to Be Enough

What a Mobile Advertising ID Actually Does

Zach Edwards, a staff threat researcher at the security firm Infoblox, told The Register that disabling MAIDs on government phones is a genuinely useful step, since it protects service members and their families, especially those deployed overseas. But he was also direct about what the identifier does and does not solve. MAIDs, he explained, function as “join keys for tracking people” that can “link different datasets” together, letting otherwise separate records about the same device be merged into a single profile.

“This change will essentially ensure that military device location data isn’t being included in bulk data sales being done by numerous vendors,” Edwards said. He added a second, less obvious benefit: the same identifier was also being broadcast to every ad system participating in those bidding auctions, not just to whichever company ultimately won a given ad placement.

The Regulatory Gap Behind the Technical One

Edwards was blunter about the limits of a device-level fix. “It’s truly unfortunate that Google and Apple have not effectively reformed their mobile advertising IDs, even after it’s been well documented that it’s the primary piece of data being used by data brokers to connect up people’s mobile phone location data for bulk sales,” he said.

He also pointed to a gap that a Pentagon device policy cannot close on its own: a handful of US states, including California, Vermont, Texas, and Oregon, maintain data broker registries, but he said he is unaware of any Russian or Chinese ad-tech vendors that have registered with any of them. Those companies, he noted, do not need to run their own tracking software. They can obtain the same location data simply by partnering with Western publishers and mobile apps that already collect it through ordinary advertising arrangements.

A Problem Bigger Than a Single Switch

Taken together, the technical and regulatory gaps point toward the same conclusion the lawmakers’ third theory raises: the most likely remaining leak is not government-issued hardware at all, but the personal phones that service members, contractors, and civilian DoD employees carry every day, running the same consumer apps and the same advertising SDKs as everyone else. A policy that only reaches government-owned devices was always going to leave that channel open, and it is the channel the September letter now asks the Inspector General to examine directly.

Wyden framed the stakes plainly in comments to Task & Purpose: “The sale of location data, particularly that of U.S. government personnel, poses a serious threat to national security.” Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, offered a more optimistic read on the specific fix that has worked so far, calling the decision to disable MAIDs “a very simple and straightforward way that you can close a loophole.” Both statements are true at once. Closing one loophole was simple. Closing the data broker economy that keeps producing new ones is not.

What Happens Next

The Defense Department’s Inspector General has not published a timeline for reviewing the request, and neither the DoD nor the individual service branches has issued a substantive public response to the September letter as of this writing. In the meantime, the underlying commercial data supply chain that created the problem (ordinary advertising SDKs, real-time ad auctions, and a resale market with no meaningful international registration requirement) continues operating exactly as it did before the Pentagon’s policy change.

For any organization managing a mobile device fleet, not just the Pentagon, the lesson generalizes cleanly: disabling an advertising identifier reduces one specific channel of location exposure, but it does not touch the personal devices employees bring to work, and it does nothing to the ad-tech auction infrastructure that many of those same apps still rely on for revenue. Congress is now asking the DoD’s own watchdog to find out how much of that gap remains. The answer will matter well beyond one branch of government.