In the J6 case they used a subpoena, yes. The OP article says that they're now going around the legal process by simply buying the data.
But my point is that the article implies that there's some uncertainty as to whether this data can be used to identify everyone present at a place and time, and there isn't. It has been done before.