The Big Apple's
Big Brother Problem.

The Background

LinkNYC was built as a public Wi-Fi network. It also functions as a surveillance one.

Starting in 2015, New York City began replacing its remaining payphones with 9.5-foot steel kiosks offering touchscreens, USB charging ports, and free gigabit Wi-Fi. The program, called LinkNYC, was framed as a digital-equity measure for residents without home broadband. By the end of its first deployment wave, it was the largest public Wi-Fi network in the United States.

The kiosks are owned and operated by CityBridge LLC, a private consortium formed in 2014 to win the franchise. CityBridge has three corporate members: Intersection, an advertising and data company that handles the kiosks' commercial inventory; Qualcomm, which built the hardware; and Boldyn Networks, which manages the infrastructure. According to CityBridge's published privacy policy, the kiosks continuously collect device identifiers, camera footage, and environmental sensor readings from anyone within range, regardless of whether they connect to the Wi-Fi.

That collection sits outside the accountability rules the city wrote for its own police department. The Public Oversight of Surveillance Technology Act (POST Act), passed in 2020, requires the New York Police Department to publish impact and use policies for every surveillance tool it operates, including who may access the data, under what conditions, and how long it is retained. CityBridge is not part of the NYPD, and the POST Act does not apply to it. The franchise agreement, negotiated in 2014 before most of the kiosks' surveillance capabilities were public, contained no equivalent disclosure obligation. The result is a surveillance network covering all five boroughs that is not required to publicly account for how it works or who can use it.

The Finding

The NYPD needs a court order to do what LinkNYC does by default.

Under the POST Act, the NYPD's official Impact and Use Policy for “WiFi Geolocation Tracking Devices” requires probable cause and a court order before officers may deploy such a device. CityBridge operates the largest Wi-Fi geolocation network in New York City, and its kiosks rely on the same underlying capability. Neither the franchise agreement nor the company's published privacy policy imposes an equivalent legal threshold. Collection is continuous and does not require a warrant.

The Machine

LinkNYC kiosks identify devices that never connect to them.

LinkNYC replaced approximately 13,000 obsolete payphones beginning in 2015, offering free gigabit Wi-Fi, USB charging, and free domestic calls in exchange for the use of city sidewalks. The program operates at no direct cost to taxpayers; its revenue model is based on digital advertising and data services rather than municipal funding.

Intersection, the advertising and data subsidiary within the CityBridge consortium, markets the kiosks to brands as a “context-aware platform” for reaching pedestrians as they move through physical space. According to NYCLU testimony delivered to the New York City Council Committee on Technology in June 2023, Intersection's marketing materials describe targeting cohorts such as “18-to-34-year-old high-income college graduates” based on behavioral data drawn from the kiosks' immediate environment. To deliver that level of targeting, each kiosk operates first as a sensor platform and second as a Wi-Fi access point.

Each kiosk carries two HD cameras, Wi-Fi access points, Bluetooth beacons, and environmental sensors that monitor noise, temperature, light, and air quality. According to CityBridge's privacy policy, camera footage is retained for seven days. The Wi-Fi and Bluetooth radios continuously scan for nearby devices, logging the unique MAC address each device broadcasts whenever Wi-Fi or Bluetooth is enabled. Collection occurs whether or not the device's owner connects to the LinkNYC network, and whether or not the owner is aware the kiosk is present. The The 32-foot Link5G towers introduced in 2022 represent a massive escalation in hardware scale. According to the city's 2021 Design Proposal, the height is a technical requirement to support multi-tenant 5G transmitters while complying with FCC safety regulations. To mitigate the “bulky presence” of these industrial poles, the consortium utilized translucent materials and stainless steel finishes designed to “reduce the perceptual impact” and “humanize the scale” of what is effectively a citywide cellular grid.

Modern smartphones partially mitigate passive identification through MAC address randomization, a feature in which the operating system broadcasts a fresh, fake identifier to each new network. Academic research has shown that the defense is incomplete. A 2024 survey published in Security and Safety documents that Wi-Fi probe requests still leak structured timing patterns and behavioral fingerprints, and that a device's radio hardware emits a distinguishable physical signature — Radio Frequency Fingerprinting (RFFI) — that persists across software-level address changes. A 2025 paper introducing the MobRFFI system applies the technique specifically to non-cooperative re-identification of mobile devices for mobility-intelligence applications, the category that includes networks like LinkNYC.

The CityBridge consortium has three corporate members: Intersection (advertising and data), Qualcomm (hardware), and Boldyn Networks (connectivity, which also operates the city's subway Wi-Fi). The three companies jointly manage the data flows generated by the kiosks under the franchise agreement. The NYCLU has summarized the result in a single sentence.

“LinkNYC is a barely mitigated privacy disaster.”

Users who wish to opt out of passive identification cannot do so by declining to log in to the LinkNYC network. The kiosks read the broadcasts that phones emit automatically when Wi-Fi or Bluetooth is enabled, independent of any user action. Effective mitigation requires disabling Wi-Fi and Bluetooth on a device, typically by enabling Airplane Mode, while the device is within range of a kiosk. Civil-liberties advocates have cited the absence of any practical opt-out as evidence that the network operates without a meaningful consent mechanism.

The Audit

A 2021 audit found that CityBridge had violated its privacy obligations for years.

In 2021, the New York City Office of Technology and Innovation (OTI) commissioned KPMG to audit CityBridge's compliance with the privacy provisions of its franchise agreement. The resulting report was posted to an OTI web page in January 2023 with significant redactions and no accompanying public announcement. The NYCLU obtained the document and surfaced its findings six months later, in June 2023, in testimony to the New York City Council Committee on Technology.

Who Pays

The neighborhoods with the fewest privacy alternatives bear the largest share of the surveillance load.

Residents with private home broadband or unlimited cellular data can largely avoid using LinkNYC. Lower-income residents, undocumented immigrants, and unhoused New Yorkers who rely on public Wi-Fi for routine internet access often cannot. For these users, the network functions less as an optional service than as primary infrastructure.

The scale of this reliance is documented in the network's own usage figures. In 2025, LinkNYC facilitated approximately 473,000 free phone calls per month, with the New York State EBT helpline consistently ranking as the most frequently dialed number from both kiosks and Link5G poles. For many New Yorkers, the trade-off between privacy and accessing essential state benefits is not a choice, but a structural requirement of survival.

This structural reliance complicates the “public support” narrative marketed by the consortium. While a 2025 HarrisX survey commissioned by LinkNYC claims that 77% of New Yorkers support the installation of Link5G smart poles, the report notes that support strengthens only after hearing a brief description of their benefits. Critics argue that this framing masks the surveillance trade-off, presenting the infrastructure as a neutral public utility rather than a dual-use sensor grid.

Academic and civil-liberties literature uses the term digital redlining to describe systems in which historically underserved communities receive expanded service only when that service is bundled with monitoring or extractive terms. According to NYC Mayor's Office documents, the 13 community districts designated for mandatory Link5G deployment under the renegotiated franchise are characterized by high broadband deficit, low median income, and long documented histories of intensive policing. The same neighborhoods that are slated to receive the largest share of new kiosks are therefore also the neighborhoods most likely to experience the kiosks' data flows in the context of law-enforcement use.

A 2025 report by the Surveillance Technology Oversight Project found that this population has been integrated into the city's broader surveillance apparatus through other means as well. According to the report, the Adams administration connected NYCHA security cameras to the NYPD's Domain Awareness System using NYCHA's own Wi-Fi infrastructure, without notification to residents, the City Council, or public housing administrators. The report states that one NYCHA campus was already streaming live to NYPD smartphones at the time of its publication and that the program contemplated expansion to 19 additional campuses. S.T.O.P. also cites prior NYPD acknowledgments that officers had used DAS camera feeds in NYCHA buildings for non-investigative purposes, including, in the report's wording, “for entertainment.”

“Facial recognition gets it wrong, leading to the false arrest of New Yorkers of color — and can be easily weaponized against protesters, activists, or religious communities exercising their fundamental First Amendment rights.”

S.T.O.P. has further documented downstream consequences of the city's data integration. According to the organization, U.S. Immigration and Customs Enforcement (ICE) has accessed NYPD automated license-plate-reader data, and sealed records — records legally protected from disclosure under New York State law — have been shared with federal agents and used against a pro-Palestinian protester in deportation proceedings. The organization has also identified private contractors that simultaneously advise city agencies and ICE's enforcement operations. For undocumented New York City residents who rely on LinkNYC as a primary internet connection, the report concludes, these documented downstream uses materially affect the privacy implications of using the network.

A separate municipal program, Big Apple Connect, indicates that the city has an existing alternative for delivering broadband to its lowest-income residents that does not depend on the LinkNYC infrastructure. According to a September 2025 announcement from the Mayor's Office, Big Apple Connect provides free in-home broadband and basic cable to approximately 330,000 NYCHA residents across 220 developments. The program does not use ambient sensors, captive portals, or third-party advertising infrastructure, and was extended in September 2025 to run through June 2028. Civil-liberties advocates have argued that the program demonstrates that municipal broadband initiatives need not incorporate the data-collection model used by LinkNYC.

The deployment pattern observed in New York has been replicated in other cities. A 2025 academic paper published by Taylor & Francis, titled “Digital policing of homeless and other marginalised groups in smart cities,” tracked the rollout of InLinkUK smart kiosks in London's Tower Hamlets and identified a parallel correlation between kiosk deployment in lower-income neighborhoods and intensified data-driven policing operations. The authors attribute the similarity to comparable public-private funding and contracting structures in both cities.

What Can Be Done

The Digital Fairness Act would change the legal status of LinkNYC's data collection.

The New York State Legislature is considering legislation that would directly address the legal gap that allows LinkNYC's current data-collection practices. The Digital Fairness Act, introduced as Senate Bill S4276 and Assembly Bill A3308 in February 2025, is currently under review by the State Senate Committee on Internet and Technology. According to NYCLU analysis, the bill remains positioned to move out of committee during the current legislative session if it receives sufficient constituent engagement.