On Friday, June 22, 2018, in a 5-4 split, the Supreme Court in Carpenter v. United States, held that the government usually needs a warrant to access an individual’s historical cellphone location data held by third-party carriers. The court rejected the government’s argument that an individual does not have a legitimate expectation of privacy under the Fourth Amendment concerning the location data that third-party carriers collect and keep. This data, essentially logs of the location of cellphone towers used to route calls to and from cellphones, is now entitled to heightened privacy protections despite individual voluntarily sharing such data. The impact of this ruling will be felt not only by law enforcement, but could also impact the way that private companies use such data.
In the past, it was the general view that if individuals voluntarily shared such information with a third-party that police could get that information without a search warrant. Known as the “third-party doctrine,” the idea was that Fourth Amendment protections did not extend to records or information that someone voluntarily shared. The doctrine, largely developed decades ago, came to the court in the case of an individual sentenced to prison following a series of armed robberies. At Timothy Carpenter’s trial, law-enforcement officials used cell-site records from his cellphone provider to establish his location at the time of the crimes. Carpenter argued that such evidence should not be given to the jury because the government did not obtain a warrant for the data. The court of Appeals for the Sixth Circuit, following the third-party doctrine, upheld the conviction finding that a warrant was unnecessary because Carpenter had no expectation of privacy regarding cellphone records maintained by the service provider.
In Carpenter v. United States, the court, acknowledged that times are changing. Indeed, Chief Justice Roberts, explained that this was not a “garden-variety request” for data from a third-party because of the “seismic shifts in digital technology that made possible the tracking of not only Carpenter’s location but also everyone else’s, not for a short period but for years and years.” Roberts noted that individuals would not expect law enforcement to track their location over long periods of time and because people carry their cellphones with them, this data provides “near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.” Roberts explained that the third-party doctrine was developed prior to the digital age. Cellphones provide so much information about their users over a long period of time and because “carrying one is indispensable to participation in modern society” the court found that cellphone users are not exactly “voluntarily” sharing information. Under the court’s analysis, Carpenter had a reasonable expectation of privacy, the third-party doctrine did not apply, and therefore the acquisition of the location data was a search subject to the Fourth Amendment for which the government generally must have a warrant to obtain.
Roberts suggested that the ruling was narrow and applied only to the historical cell location data, identifying several situations in which a warrant may not be necessary. However, Justices Kennedy, Alito, Thomas and Gorsuch all felt it was necessary to write their own dissents. Most interesting for purposes of data privacy concerns, Alito predicted that the ruling would lead to one of two outcomes: “All subpoenas duces tecum and all other orders compelling the production of documents will require a demonstration of probable cause, and individuals will be able to claim a protected Fourth Amendment interest in any sensitive personal information about them that is collected and owned by third parties,” or, the “court will face the embarrassment of explaining in case after case that the principles on which today’s decision rests are subject to all sorts of qualifications and limitations that have not yet been discovered….” which “will inevitably end up ‘mak[ing] a crazy quilt of the Fourth Amendment.'”
Nathan Freed Wessler of The American Civil Liberties Union, who argued the case on behalf of Carpenter, wrote, following the ruling, that “[t]he case specifically concerns the privacy of cellphone location data, but the ruling has broad implications for government access to all manner of information collected about people and stored by the purveyors of popular technologies. In its decision, the court rejects the government’s expansive argument that people lose their privacy rights merely by using those technologies.” Wessler explained:
If the government had its way, virtually none of our sensitive information held by tech companies would enjoy the privacy rights guaranteed by the Constitution. Consider the consequences of that argument: Google and Facebook store of our photographs and messages; many of us own smart devices like Amazon’s Echo, which know our musical tastes, shopping history, and even the contents of intimate conversations; and our health and fitness apps know about our physical activity and sleep patterns. These examples barely scratch the surface when it comes to the information amassed by the websites, apps, and other internet-connected devices we rely on for convenience. The government wants easy access to all of it.
As noted by the court, the law struggles to keep pace with the rapid development of technology. On its surface, the Carpenter opinion appears to bring this privacy issue relating to cellphone location data to the present. However, there are remaining questions and the implications of the ruling will likely play out over the years to come. The majority opinion concerning individuals’ right to expectation of privacy regarding their location data may trigger broader consequences for companies that gather similar such information. It is not difficult to envision advocates for consumers citing Carpenter as a basis for companies to enact stricter privacy protections for this sort of data, or for seeking damages should companies fail to do so. The opinion directly relates to the federal government actions under the Fourth Amendment, but litigation over privacy rights outside of the law enforcement context is likely to look to Carpenter. The recognition of an expectation of privacy in this arena will likely influence how lower courts view businesses’ uses of consumer data.