How does the Fourth Amendment protect digital privacy? Riley, Carpenter, and the third-party doctrine

The third-party doctrine holds that when a person voluntarily conveys information to a third party -- a bank, a telephone company, or any other entity -- she loses her Fourth Amendment protection in that information, because she assumes the risk that the third party will reveal it to the government. The doctrine originates in United States v. Miller, 425 U.S. 435 (1976), and Smith v. Maryland, 442 U.S. 735 (1979). In Miller, federal agents subpoenaed microfilm copies of Miller's bank records -- checks, deposit slips, and financial statements -- directly from his bank without a warrant. Justice Powell, writing for the Court, held that Miller had no protected Fourth Amendment interest in those records: the documents were voluntarily conveyed to the banks and exposed to bank employees in the ordinary course of business, so Miller assumed the risk that the bank would share them with the government. Three years later, Smith v. Maryland applied the same logic to pen register data -- the numbers dialed from a home telephone. Police had asked the phone company to install a pen register at its central equipment to record the numbers Smith called, without a warrant. Justice Blackmun, writing for six Justices, held that Smith had no reasonable expectation of privacy in the numbers dialed, because he voluntarily conveyed them to the telephone company by dialing them, and the company records such numbers in the ordinary course of business; Smith therefore assumed the risk of disclosure. Together, Miller and Smith establish that the government may obtain -- without a warrant and often without any individualized showing -- any business records that a customer has shared with a bank, phone carrier, credit-card company, email provider, or similar service, on the theory that voluntary conveyance to a third party eliminates Fourth Amendment protection. In the digital age, nearly every electronic communication and commercial transaction passes through one or more third-party service providers, making the doctrine's scope a first-order question for modern privacy law.

United States v. Jones, 565 U.S. 400 (2012), was the first major Supreme Court confrontation with GPS-era surveillance. FBI agents working with local police attached a GPS tracking device to the undercarriage of Antoine Jones's Jeep while it sat in a public parking lot in the District of Columbia, one day after the authorization on the warrant they had obtained had expired and outside the authorized geographic area. They then tracked the vehicle's location continuously for 28 days, generating approximately 2,000 pages of movement data that the government used to obtain Jones's conviction for drug trafficking conspiracy. The Supreme Court reversed the conviction unanimously on the result, but divided 5-4 on the rationale. Justice Scalia, joined by Chief Justice Roberts and Justices Kennedy, Thomas, and Sotomayor, held that the physical attachment of the GPS device to Jones's Jeep was itself a Fourth Amendment search, grounded in the common-law trespass principle that was part of the amendment's original meaning: the government intruded upon Jones's 'effects' -- the vehicle -- in the course of obtaining information. Because the warrant's authorization had already expired, the search was warrantless and violated the Fourth Amendment. The majority limited itself to the trespass theory and declined to reach whether warrantless GPS tracking is independently unreasonable under Katz v. United States (1967). Justice Alito, joined by Justices Ginsburg, Breyer, and Kagan, concurred in the judgment but disagreed with the majority's reasoning, arguing that the relevant constitutional question is whether the long-term GPS surveillance violated reasonable expectations of privacy. Alito articulated what commentators call the mosaic theory: society's privacy expectations are shaped partly by practical limits on surveillance capacity; historically, 28-day continuous tracking of a person's movements was prohibitively expensive and labor-intensive, so people reasonably did not expect it. GPS technology destroyed that practical limit. By aggregating thousands of individually innocuous location observations into a comprehensive picture of daily movements, associations, and habits, the government created a mosaic of private life that crosses a constitutional threshold even if each individual observation would not. Justice Sotomayor separately joined the Scalia majority but endorsed Alito's reasoning and went further, noting that the mosaic theory's logic almost certainly requires reconsidering the third-party doctrine as applied to digital records, since much of modern private life -- location, communications, associations -- is routinely shared with service providers.

Riley v. California, 573 U.S. 373 (2014), arose from two consolidated cases that presented the same legal question: may police search the digital contents of a cell phone found on an arrested person, without a warrant, under the search-incident-to-arrest exception to the warrant requirement? In the first case, San Diego police arrested David Riley for driving with expired registration tags, impounded his car, and discovered gang-related items; they then searched his smartphone without a warrant, finding photos and videos that linked him to a gang shooting for which he was subsequently convicted on enhanced charges. In the second case, Boston federal agents arrested Brima Wurie for a drug sale they observed, seized his flip phone, and then searched through its call logs, identified a phone number, traced it to an apartment, and obtained a warrant for the apartment where they found drugs and firearms. Chief Justice Roberts, writing for a unanimous Court (9-0), held that police must obtain a warrant before searching the digital contents of a cell phone seized incident to a lawful arrest. The existing search-incident-to-arrest exception is justified by two concerns: officer safety -- preventing the arrestee from reaching for a weapon -- and evidence preservation -- preventing the arrestee from destroying evidence. Roberts held that neither concern applies to cell phone data: digital information stored on a phone cannot physically harm an officer, and the government can secure the phone itself to prevent evidence destruction while applying for a warrant. The more fundamental point, Roberts wrote, is that modern cell phones are categorically different from the physical objects that existing doctrine permits searching incident to arrest. A modern smartphone is the functional equivalent of a personal library containing the most sensitive details of a person's life -- thousands of private messages and emails, years of photographs, detailed location history, health and financial records, browser searches, and social media communications. Searching a cell phone incident to arrest is therefore comparable in its intrusion to searching the person's home -- precisely the type of intrusion the Founders designed the warrant requirement to prevent. Riley made clear that the Fourth Amendment's warrant requirement applies with full force to the vast amounts of personal information stored on a person's phone, even though that information may also be accessible to third-party cloud services.

Carpenter v. United States, 585 U.S. 296 (2018), is the Supreme Court's most direct confrontation with the third-party doctrine in the digital age. In 2011, FBI agents investigating a series of armed robberies in Ohio and Michigan obtained court orders under the Stored Communications Act, 18 U.S.C. Section 2703(d), compelling two wireless carriers to disclose historical cell-site location information for four suspects including Timothy Carpenter. Section 2703(d) allows a court to compel disclosure upon a showing of 'specific and articulable facts' giving 'reasonable grounds to believe' that the records sought are 'relevant and material to an ongoing criminal investigation' -- a standard lower than the probable cause required for a search warrant. The FBI received 127 days of historical CSLI for Carpenter, which placed him near the scene of multiple robberies and contributed to his conviction. Chief Justice Roberts, joined by Justices Ginsburg, Breyer, Sotomayor, and Kagan, held 5-4 that the Fourth Amendment required the government to obtain a warrant before compelling the CSLI. Roberts acknowledged the force of the third-party doctrine: Carpenter's CSLI was generated by his phone and held by his carriers. But Roberts held that the third-party doctrine's ordinary logic -- that voluntary conveyance to a business defeats any reasonable expectation of privacy -- cannot apply to comprehensive, retrospective location records of this character. First, CSLI is not truly voluntary: a cell phone generates location data automatically whenever it connects to a network, which it does continuously to provide basic functions; a person who carries a cell phone does not meaningfully choose to share each moment's location with the carrier. Second, the comprehensiveness and retrospective reach of CSLI create a surveillance capacity unlike anything the founding-era third-party doctrine contemplated: 127 days of historical CSLI creates a near-perfect record of everywhere Carpenter went, functionally equivalent to the 28-day GPS tracking the Court addressed in Jones. Roberts emphasized that the Court's doctrine must account for 'seismic shifts in digital technology' and must not allow the third-party doctrine -- designed for discrete, isolated business records -- to eviscerate Fourth Amendment protection in the digital age. The majority expressly declined to disturb Miller and Smith or to rule on shorter CSLI durations, real-time CSLI, foreign-national surveillance, email content, or other digital records, leaving those questions open. Justices Kennedy, Thomas, Alito, and Gorsuch each wrote separate dissents.

Carpenter's deliberate narrowness left an expanding frontier of digital-privacy questions for lower courts and the next Supreme Court. Courts continue to address whether the government needs a warrant for real-time CSLI as opposed to historical records, for durations shorter than 127 days, for location data generated by third-party apps installed on a phone rather than by the carrier's network, and for social media content and non-content records compelled from platforms. The Stored Communications Act's two-track structure -- requiring only a subpoena for records in remote storage for more than 180 days, but a warrant for records within 180 days -- predates smartphones and does not map cleanly onto modern cloud services. AI-based facial recognition technology is a rapidly expanding government surveillance tool that presents a distinct Fourth Amendment problem: a face is visible in a public space, which traditional doctrine treats as outside Fourth Amendment protection, but large-scale continuous facial scanning converts individually visible observations into a comprehensive surveillance infrastructure analogous to the GPS tracking the Court found constitutionally significant in Jones. Section 702 of the Foreign Intelligence Surveillance Act (50 U.S.C. Section 1881a), reauthorized by Congress in April 2024, authorizes warrantless electronic surveillance of non-U.S. persons located outside the United States; because the targeted communications often pass through U.S. infrastructure and incidentally include communications of U.S. persons, Section 702 raises contested Fourth Amendment questions that no Supreme Court case has resolved. For the 2028 presidential election, Fourth Amendment digital privacy is a first-tier issue. A 2028 president directs the executive branch agencies -- the FBI, NSA, DEA, and DHS -- whose surveillance programs are bounded by the Fourth Amendment and its statutory analogs; the president's attorneys general and national security advisers set policy on how those programs are pursued and how Carpenter's limits are interpreted. Congress's authority to authorize or restrict surveillance tools -- facial recognition bans, location data warrant requirements, FISA reform -- intersects with the legislative priorities of whichever party controls the Senate after the 33 Class II Senate elections on the 2028 ballot. The Supreme Court Justices and federal court of appeals judges confirmed by the post-2028 Senate will resolve the open questions Carpenter deliberately left, defining the outer limits of digital privacy protection for the coming generation.