Location Data and Third Parties

Location Data and Third Parties

The preceding sections asked whether a particular police technique counts as a search. For dog sniffs, the answer turned on whether officers physically entered a protected area or learned only what no one has a legitimate interest in hiding. A different problem arises when officers never approach the person or the property and instead ask a company for records it already holds. Digital life generates such records constantly, and the government's usual response is that information handed to a third party has lost its protection. Carpenter v. United States limits that response for one important category of data, and it does so by applying the Katz privacy test to modern technology rather than by creating a new test.¹ This section takes the older rule first, then the holding, then the limits that keep the holding narrow.

The government's argument starts from the third-party doctrine, the principle that a person has no legitimate expectation of privacy in information voluntarily turned over to someone else. The reason is that anyone who reveals information to another accepts the risk that the recipient will pass it along. Once a person has chosen to share information with a company, the secrecy the Katz test protects is already gone as to that company, and the government's request to the company intrudes on nothing the person was still keeping private. In Smith v. Maryland, police had the telephone company install a pen register, a device that records the numbers dialed from a phone, and the Court held that no search occurred. It reasoned that a pen register does not capture the contents of calls, that telephone users know they must convey numbers to the phone company, and that a person has no legitimate expectation of privacy in information voluntarily turned over to third parties.² United States v. Miller applied the same idea to a depositor's bank records, which the Court treated as the bank's business records containing only information the depositor had shared with the bank in the ordinary course of business.³ The same logic reached a taxpayer's records in the hands of an accountant, who had discretion to disclose much of that information to the IRS.⁴

That baseline would seem to decide a request to a wireless carrier, and it is exactly what the government argued in Carpenter. The government used a court order directed to a wireless carrier to obtain records of the movements of the defendant's cell phone over a period of four months.⁵ Its position was that the records belonged to the carrier and the customer had conveyed the location information voluntarily, so no search occurred. The Court rejected that position for this kind of data. Individuals have a reasonable expectation of privacy in their historical cell-site location information even though service providers hold the records, and the government generally must obtain a warrant supported by probable cause to get this pervasive, long-term location data.⁶ The enhanced subpoena process available under the Stored Communications Act could not be used to obtain these records.⁷

The Court's reasons come in two parts, and each answers one leg of the older doctrine. The older cases involved limited information, such as the dialed numbers in Smith and movements knowingly exposed on public roads in United States v. Knotts, whereas cell-site tracking compiles a chronicle that implicates privacy concerns beyond those cases.⁸ The voluntary-conveyance rationale also fails for this data, because carrying a phone is indispensable to participation in modern society and a person cannot avoid leaving a trail of location data without disconnecting the phone.⁹ A user who must carry a phone to take part in ordinary life has not meaningfully chosen to hand over a comprehensive record of physical movements.

The data also differ from a glimpse of one trip in how they arise and what they add up to. Phones connect to cell towers, carriers store the record of which tower handled each connection, and the precision of those records has improved over time. Apps contact outside servers so often that the stored records can map a person's movements in increasing detail over long periods, and because most people keep a phone within a few feet of themselves, the record follows the person wherever the phone goes.¹⁰ The concern was not new. In United States v. Jones the government attached a GPS device to a vehicle and monitored it for 28 days, and the Court unanimously held that a search occurred. The five-Justice majority rested on the physical occupation of the vehicle, while concurring opinions voiced the privacy concern, so Carpenter could observe that a majority of the Court had recognized a reasonable expectation of privacy in the whole of a person's physical movements.¹¹

The mechanism behind the holding follows from those facts. A comprehensive record of where a person has been over a long period reveals far more than a glimpse of a single trip, and technology makes that record cheap to compile. If a carrier's possession were enough to remove protection, the government could reconstruct a person's life without any judicial check. That is the same worry that led Katz to abandon a physical-penetration test, since technology lets police see and hear without being physically present.¹² Requiring a warrant restores the check that the reasonableness inquiry is meant to supply.

The two steps differ in what the government collects. Watching one trip captures only what any passerby could see, which is the knowing exposure the Katz corollary leaves unprotected, while the carrier's records are a retrospective chronicle that no passerby could have assembled.¹⁵ Duration, comprehensiveness, and the ability to look backward all move the answer, and the identity of the record holder does not.

A lower federal court applied the same reasoning to GPS data in the case of a defendant named Diggs. Detectives investigating a robbery downloaded, without a warrant, a spreadsheet of time-stamped location entries for a vehicle covering March 1 through April 4, 2017. They obtained it by logging in to the website of the vendor that serviced the car's tracking device, using credentials supplied by a business employee.¹⁶ The court held that acquiring more than a month of historical GPS data was a search, because the defendant had a reasonable expectation of privacy in the record of his movements and did not also need a property interest in the vehicle.¹⁷ A warrantless search is reasonable only if it falls within an exception to the warrant requirement, and the government argued none, so the search violated the Fourth Amendment.¹⁸ This is a lower-court application, so it shows how the reasoning travels to a similar chronicle held by a vendor without adding a Supreme Court holding.

Because protection is tied to the kind of data at issue, the limiting words matter: historical, cell-site, pervasive, and long-term. The decision is fairly narrow, and it does not make every record held by a third party protected.¹⁹ The Court distinguished the older cases on the limited nature of the information involved, and it left open whether real-time cell-site data or short-term collection is protected, as well as collection techniques involving foreign affairs or national security.²⁰ The majority was 5 to 4, and the dissenters would have treated the carrier's records like the single phone record in Smith.²¹ A lower court has likewise held that tweets a user broadcast to the world carried no reasonable expectation of privacy, which shows that ordinary exposure reasoning remains in play for other kinds of data.²²

Students lose this issue in two opposite ways. The first is treating the carrier's possession of the records as the end of the analysis, which applies Smith and Miller to data that Carpenter holds protected. The second is reading Carpenter to protect every record a third party holds, which ignores the limiting words. On an exam stem, ask what the government actually obtained. A long historical chronicle of location from cell-site records calls for a warrant, while a few dialed numbers, bank deposit records, or a short stretch of observation on public roads remains on the older side of the line.²³