There was an uproar on Reddit last month when GameStop, the national video-game retailer, announced a policy of fingerprinting customers who turned in used games at all of its Philadelphia locations. Those fingerprints would immediately become accessible in an online database for police to peruse and cross-reference as a deterrent to stolen-game trafficking. The new system would add fingerprint scans on top of photo identification, and critics lashed out against GameStop as if it were the NSA. “A distopian [sic] future,” wrote one commenter, while another added, “It’s an invasion of privacy.”

In fact, GameStops in Florida and Washington have been fingerprinting for years, and within Philadelphia, private data collection is required by law for certain commercial businesses. A municipal ordinance dating back to 2010 mandates second-hand-goods businesses, such as pawnshops, to both collect and log fingerprints in an online database. When GameStop began following this protocol to a tee — even selecting LeadsOnline, Philadelphia’s database of choice since 2012 — many assumed the company had been reclassified by law enforcement to fall under the city’s pawnshop ordinance. But three days later, the company abruptly rebuked the rumors and reversed its policy in Philadelphia. “We realized that we really didn’t fall under those laws,” a GameStop spokesperson said.

And yet the broad data collection of second-hand-goods laws across the country — colloquially known as pawnshop laws — and the increasingly prevalent use of LeadsOnline as a private arm of law enforcement have stirred Orwellian concerns. The ability of police to access private information of customers and merchants, without warrant, has even been denounced by critics as tantamount to “electronic stop-and-frisk.”

Philadelphia isn’t alone. Cities including Chicago and New York have all passed legislation that require pawnbrokers, precious-metals dealers, and in some cases, consignment stores, to upload records of transaction tickets to LeadsOnline. (San Francisco, Seattle and Dallas all subscribe.) Pawnshop tickets usually need to show a thumbprint, digital photograph and driver’s license of any customer taking out a loan or making a purchase. Increasingly, all of that information is accessible to the 3,000 police departments that subscribe to LeadsOnline with the click of a mouse.

More than 31,000 businesses have voluntarily or mandatorily uploaded this information on a daily basis, according to Lindsay Williams, a LeadsOnline spokesperson. Some police departments are paying tens of thousands of dollars for access to the national registry, whether that’s to search a burglary suspect’s name, a description of a missing item or a merchandise serial number. The data has transformed investigations, by allowing police to “cross state lines” and avoid the cumbersome process of inspecting leads on paper records at shops. For example, the database has enabled officers in South Bend, Indiana to track down stolen laptops in Texas and a felony fugitive in Philadelphia. “Previously, law enforcement officers were limited to looking at businesses within their jurisdiction,” says Williams.

The crime-busting technology is on display at LeadsOnline’s homepage, which aggregates articles detailing the millions of dollars in stolen-goods recoveries that the database has assisted with, along with testimonials from police. “I just opened the account today and within five seconds, I solved a theft of over $5,000. A warrant is pending for the offender. Great site!” one Philadelphia detective wrote. And because the data stored in LeadsOnline has remained active since its inception in 2000, “they can even start working cold cases,” Williams says.

But there are civil liberties concerns for customers and store owners. “Police can pull out names, then cross-reference them against lists of parolees and recidivists,” says Paul Solda, a New York-based lawyer who has brought a federal lawsuit against the City of New York and the NYPD (Gem Pawnbrokers v. City of New York) on behalf of the largest collateral loan broker in the city.

The comparison of LeadsOnline to “stop-and-frisk” as a discriminatory investigative tool is twofold. Pawnshop customers tend to be lower-income people who lack access to traditional banking credit. And similar to the broken-windows theory that subjects thousands of young black men to pat-downs, the police can conduct unlimited searches of pawnshops online under the veil of routine patrolling. “It [LeadsOnline] gives police the opportunity to disguise their criminal investigations, by saying ‘we’re doing administrative inspections of books and records,’” Solda says.

In a 1987 Supreme Court decision, New York v. Burger, it was ruled that car junkyards (like pawnbrokers, commercial truckers and gun retailers) are subject to routine administrative check-ups by police without warrant, as they are “closely regulated” businesses in the eyes of the government. But in a pair of 1992 decisions, New York’s highest court ruled that such administrative searches by police could only cover the books and record-keeping — not fishing for criminal activity — and improperly expansive searches would violate the Fourth Amendment in New York state. Solda argues that police are exploiting LeadsOnline as a third-party service to perform warrantless dragnets and exploratory searches of pawnbrokers’ records. “They can reverse engineer investigations of criminal activity,” he says.

Judge Margo K. Brodie of the United States District court has dismissed some of the lawsuit’s claims and allowed others to move forward, including violations of the Fourth Amendment. And Solda suggested he will shed more light on pawnshop laws when he begins interrogation of police officials in court next year: “We know of a credible witness who was once employed by the NYPD and has explained that he was part of the team that set up software programs to data-mine the LeadsOnline information.” Solda added, “this case will hopefully set an extraordinary precedent for the rights of pawnbrokers nationally, as well as their customers.”