US law enforcement agencies get much of their information from data brokerage firms, which collect and aggregate information from public records and private sources, e.g., drivers licenses, mortgages, social media, retail loyalty card purchases, professional credentials, charities’ donor lists, bankruptcies, payday lenders, warranty registrations, and other sources who sell personal data. This information is then sold to customers willing to pay for it. Not even the FTC can find out exactly where the data brokers get their information because brokerages cite trade secrecy as an excuse not to divulge their sources.
Law enforcement agencies not only uses data collected by private firms, they also use corporate IT platforms and proprietary software applications (e.g., Palantir, Microsoft, Amazon) to store, share and analyze data. Palantir provides an interface that runs on top of other data systems, including legacy systems, making it possible to link data points across separate systems.
Source: Sarah Brayne (2020) Predict and Surveil: Data, Discretion, and the Future of Policing, Oxford University Press, pp. 24-25, 41-42.
They can purchase data from 3rd parties, but it is a felony to wiretap someone without the government asking you to. You need the user's cooperation to install an app with a nasty ToS or something of that nature. Lots of people are using VPNs too. This section is, from what I understand, what allowed them to add a "gag order" to the surveillance demand to companies as well? If they want google or apple to spy on someone without a warrant, this is the only way to force them without them making that information known to the public.