Sen. Ron Wyden, Oregon Democrat, said the practice had been a "legal gray area," with data brokers quietly obtaining and reselling the internet "metadata" without the users' consent. He said the NSA has been trying to keep the whole thing under wraps.

In a letter to Director of National Intelligence Avril Haines, the senator said the government needs a "wake-up call," and he called for new rules limiting purchases only to data that Americans have consented to be sold.

He also asked for Ms. Haines to take an inventory of what the government already has and toss out any information that doesn't meet the standard of consent.

"The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal," he said.

He released a letter from Army General Paul M. Nakasone, director of the NSA, detailing and justifying the agency's actions.

Gen. Nakasone said it acquires what it calls "commercially available information" but said the acquisitions are limited. They don't include location data from phones "known to be used in the United States," and they don't buy or use location data from automobiles in the U.S.

They do buy "non-content" data "where one side of the communication is a U.S. Internet Protocol address and the other is located abroad."

The general said that information was critical for "the U.S. Defense Industrial Base."

"NSA understands and greatly values the congressional and public trust it has been granted to carry out its critical foreign intelligence and cybersecurity missions on behalf of the American people," Gen. Nakasone wrote.