The National Security Agency (NSA) became a target for ire after the public learned in 2013 that it had been scooping up millions of Americans’ phone records without warrants or disclosure, and holding on to all of them. A change in the law in 2015 significantly changed the way and volume in which the NSA is legally authorized to scoop up data… but the net it casts is still pretty broad, pulling in 151 million phone records last year.

The data comes from an annual transparency report that, for some reason, the Office of the Director of National Intelligence hosts on Tumblr.

According to that report, in calendar year 2016 the NSA collected 151 million phone metadata records — the who, where, and when, but not the “what” of calls — and contacts from “U.S. persons.” That doesn’t mean 151 million different persons, though, by any stretch. Each query related to a single phone number counts separately. So if someone under surveillance made calls to 40 different other numbers that the NSA knows about, that would count as 40 different records.

Still, 151 million is not exactly a small number of records. And further, as Reuters notes, the secretive Foreign Intelligence Surveillance Court (FISC) only authorized warrants to spy on 42 terrorism suspects in 2016, in addition to “a handful” identified in 2015.

Plain old math then suggests that either each of those 42 people generated roughly 3.6 million records in 365 days (about 9,800 per day, rounding down), or that some other folks’ communications are being scooped up, too.

The NSA’s bulk data surveillance program has followed a complicated, winding road over the past few years.

Former defense contractor Edward Snowden’s leaks about wide-scale NSA data collection hit the news in June, 2013. In the wake of those revelations, government agencies and officials almost immediately faced a slew of lawsuits from privacy and civil rights advocates.

A judge dismissed the ACLU’s suit in Dec. 2013, finding that the mass data collection was legal. But in 2015, an appeals court overruled the dismissal and kicked the suit back down to the lower court to be heard. That case eventually got dismissed again for other reasons later in 2015.

But between the second and third rulings, the law itself changed when Congress passed the USA FREEDOM Act in 2015. That law did not end NSA surveillance programs, but it did force them to cut back a little bit. The bulk phone data collection that the NSA ran under Sec. 215 of the Patriot Act officially ended, to be replaced with a slightly different phone data collection program.

That newer version is supposed to scoop up fewer Americans’ phone records willy-nilly — and despite 151 million being a pretty big number, it actually is a significant reduction from the NSA’s previous scope. Back in 2014, a government study [PDF] estimated that the NSA was collecting billions of records from millions of Americans each year.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.