The Fight to Protect Our Phones: A Multi-Prong Approach to Spyware Reform

Take a moment to think about how much your cellphone knows about you. How many hours have you spent in front of that screen in the last day? Did you exchange messages or make a video call to a loved one? Have you searched for information about a health condition or read specific news articles about current events? Were you sending confidential emails on your work account? Even when you were off your cellphone, was there any point during the day when your phone was more than 10 feet away from you? When was the last time you went anywhere without it?

There is no device in the world better suited to surveillance than a modern cellphone. In 2024, 98% of Americans had a cellphone, and all but 7% of those were smartphones.¹ These devices collect precise location data not only with horizontal accuracy (i.e., latitude and longitude) but also with vertical accuracy precise enough to pinpoint the specific floor of the building the device is on.² Cellphones are a pocket-dwelling gateway that could, if properly probed, reveal your whole life story. The Supreme Court of the United States has gone so far as to describe cellphones as “such a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy.”³ Unfettered access to your devices would reveal your deepest secrets, your relationships, your activities, your words, and your habits in high resolution.

Enter spyware.

Spyware can make all of these granular data points accessible to malicious actors on an ongoing basis, creating a digital private investigator that follows you everywhere. The idea of spyware is not new—indeed, digital surveillance tools have existed since the dawn of computer networking—but current spyware is both extremely sophisticated and in high demand by criminal groups and government intelligence services alike. The malicious use of spyware is expanding beyond the shadowy world of federal spies and criminals. Spyware is now marketed to state and even local government agencies. People are often unsure what technical and legal protections are available to them. Individuals frequently have trouble even confirming whether they have been a target of spyware, since verifying a spyware infection can usually be done only by technical experts specializing in forensic device analysis.

This report serves as a background primer on government surveillance of individuals through the deployment of spyware and includes a strategic assessment of accountability levers for spyware under current laws as well as areas for future improvement. The first part of the report outlines the landscape, defines spyware, describes the harms it poses, and explains steps taken to curb its proliferation. The second part of the report summarizes state laws across the United States that could provide legal mechanisms to limit the harms of spyware use. These laws are detailed in the appendices. The third part lays out an in-depth, positive vision for spyware regulation and identifies specific states with the highest potential for impact litigation under their existing laws.

EPIC recommends a complete prohibition on the acquisition and use of spyware by state government entities. For states that are not considering a full ban on government spyware use, EPIC outlines an alternative proposed policy model that bans the use of spyware except in extremely limited circumstances, laying out various concrete definitions and safeguards to address each step in the spyware lifecycle: development, government acquisition, deployment, and oversight provisions. These proposed safeguards provide much-needed protections short of a full ban.

The wide-scale use of spyware by state and local governments is not a foregone conclusion. We can take proactive steps now to curtail the use of spyware at the state level and to protect human rights, privacy, and our democratic values.

1. Olivia Sidoti et al., Mobile Fact Sheet, Pew Rsch. Ctr., https://www.pewresearch.org/internet/fact-sheet/mobile/. ↩︎
2. Susan Landau, A Radical Proposal for Protecting Privacy: Halt Industry’s Use of ‘Non-Content,’ Lawfare (Sept. 8, 2023), https://www.lawfaremedia.org/article/a-radical-proposal-for-protecting-privacy-halt-industry-s-use-of-non-content; see also, FCC Fact Sheet, Improving Wireless 911 Caller Location, Sixth Further Notice of Proposed Rulemaking, PS Dkt. No. 07-114 (Mar. 6, 2025), https://docs.fcc.gov/public/attachments/DOC-410028A1.pdf; FCC, Indoor Location Accuracy Timeline and Live Call Data Reporting Template (Jul. 26, 2021), https://www.fcc.gov/public-safety-and-homeland-security/policy-and-licensing-division/911-services/general/location-accuracy-indoor-benchmarks (noting that the vertical accuracy information is typically collected for 911 triangulation purposes. It is unclear how this data is shared, but there is the distinct possibility that it was sold pre-2022). ↩︎
3. Riley v. California, 573 U.S. 373, 385 (2014). ↩︎