Reasonable Expectations of Privacy in the Age of Digital Surveillance

On June 22, 2018, the Supreme Court decided Carpenter v. United States, 138 S. Ct. 2206 (2018), and fundamentally altered the Fourth Amendment landscape for digital information. In a 5-4 decision authored by Chief Justice Roberts, the Court held that the government’s acquisition of historical cell-site location information (CSLI) — records showing a person’s physical movements over an extended period — constitutes a search under the Fourth Amendment and requires a warrant supported by probable cause.

The decision was not merely an incremental application of existing doctrine. It was a structural shift in how the Court thinks about privacy in an age when the government can reconstruct a person’s entire movement history without ever setting foot on private property.

Before Carpenter: The Third-Party Doctrine

Under the third-party doctrine, established in United States v. Miller, 425 U.S. 435 (1976), and Smith v. Maryland, 442 U.S. 735 (1979), a person has no legitimate expectation of privacy in information voluntarily turned over to a third party — bank records, dialed telephone numbers, and, by logical extension, cell-site records held by a wireless carrier. For decades, the government relied on this doctrine to obtain CSLI without a warrant, using only a court order under the Stored Communications Act, 18 U.S.C. § 2703(d), which requires a showing of “specific and articulable facts” rather than probable cause.

Carpenter did not overrule Miller or Smith. But it declined to extend the third-party doctrine to CSLI, drawing a line between limited categories of business records and the “deeply revealing” nature of long-term location data.

The Carpenter Holding

The Chief Justice’s opinion rested on several distinct rationales. First, CSLI is fundamentally different from the records at issue in Miller and Smith because it is not truly “voluntary” — cell phones are “a pervasive and insistent part of daily life,” and carrying one is not a meaningful choice. Second, CSLI generates a “detailed and comprehensive record of the person’s movements” that the individual himself does not possess — the data is created automatically, retained by the carrier, and accessible only through legal process. Third, the retrospective quality of CSLI — seven days of historical location data, in Carpenter‘s case — enables the government to reconstruct movements with a precision that would have been unthinkable when the Fourth Amendment was ratified.

The Court limited its holding in two important respects. First, it declined to extend the warrant requirement to all forms of digital data, explicitly reserving the question of real-time CSLI, tower dumps, and other surveillance techniques. Second, it declined to disturb the third-party doctrine in its traditional applications — bank records, phone numbers, and other routine business records remain outside the warrant requirement.

The Dissents

Justice Kennedy, joined by Justices Thomas and Alito, dissented on the ground that Carpenter “unhinges Fourth Amendment doctrine from the property-based concepts that have long grounded the analytic framework” and replaces a clear rule — the third-party doctrine — with a vague balancing test. Justice Thomas wrote separately to argue that the Fourth Amendment should be understood as protecting property interests, not reasonable expectations of privacy. Justice Alito emphasized that the Court should have waited for Congress to address the issue legislatively. Justice Gorsuch dissented on the ground that CSLI may be the defendant’s property — or at least his bailment — and thus entitled to Fourth Amendment protection on property-based grounds.

Open Questions After Carpenter

Carpenter raised as many questions as it answered. Lower courts continue to grapple with whether Carpenter requires a warrant for: (1) real-time CSLI; (2) tower dumps (records of every device that connected to a particular cell tower during a particular period); (3) GPS data from a vehicle; (4) IP address records; (5) financial transaction data; (6) facial recognition matches; and (7) smart-home device data. The common thread in these cases is the question of how “revealing” the data is and whether its disclosure is truly “voluntary” — both of which are fact-intensive inquiries that resist bright-line rules.

The Stored Communications Act

For federal practitioners, the interplay between Carpenter and the Stored Communications Act is critical. The SCA, 18 U.S.C. §§ 2701-2712, provides the statutory framework for government access to electronic communications and records held by service providers. Section 2703(d) orders — sometimes called “D-orders” — remain the primary mechanism for obtaining records that fall outside Carpenter‘s warrant requirement. Understanding which types of data require a warrant, which require a D-order, and which may be obtained by subpoena is an essential competency in federal criminal defense.

Practice Note

In any federal case involving digital evidence, the first question should be: how did the government get this data, and what legal process supported the acquisition? A motion to suppress under Carpenter should be considered whenever the government obtained CSLI or other location data without a warrant. Even if Carpenter does not directly apply — because the data is real-time, or from a tower dump, or from a different type of sensor — the motion should argue that Carpenter‘s reasoning extends to the data at issue. The law is unsettled, and every suppression motion shapes the developing doctrine.