Consulting Director of Privacy at the Stanford Law Center for Internet and Society, Albert Gidari, comments on the landmark U.S. Supreme Court’s decision on location tracking in Carpenter v. United States:

The Supreme Court has decided a singularly important privacy case in Carpenter v. United States. The Court ruled that a warrant is required to access historical cell site records — the records that a mobile phone company creates, maintains and even monetizes which show a person’s location as they use or carry their cell phone around. The Court decided that a person has a “legitimate expectation of privacy in the record of his physical movements.”  This was a 5-4 decision, written by Chief Justice Roberts, with each of the dissenting Justices writing separately.

The ink is barely dry on the Opinion, and much will be written about its reasoning, meaning and impact in the days and weeks and probably years ahead, but here are a few observations on the case at first reading.

What a Difference a Week Makes.  The government sought seven days of records from the carrier; it got two days. The Court held that seven days or more was a search and required a warrant. So can the government just ask for 6 days with a subpoena or court order under the Stored Communications Act? Here’s what Justice Roberts said in footnote 3:  “[W]e need not decide whether there is a limited period for which the Government may obtain an individual’s historical CSLI free from Fourth Amendment scrutiny, and if so, how long that period might be. It is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search.” You can bet that will be litigated in the coming years, but the real question is what will mobile carriers do in the meantime – it could be a long wait for an appellate court to see a criminal defendant whose conviction rests on 6 days of location data, and in the meantime, it could tomorrow when a carrier discloses a week of location data on less than a warrant.  As I said, what a difference a week makes.

Does the Decision Really Make a Difference to Law Enforcement? The dissents were concerned about taking away a valuable tool for law enforcement and making it harder to investigate cases. The location record here was obtained by means of a court order issued after judicial review of an affidavit under section 2703 of title 18, the Stored Communications Act. As some have observed, it is a short step from the affidavit to a warrant application, and in fact, prosecutors are getting warrants for location information today having seen some handwriting on the wall after the oral argument in Carpenter and not wanting to risk their cases. Frankly, if you can make the case for a warrant for seven days of data, the more particular and narrow request for six days or less seems just as easy. The Court also said unequivocally that location data in emergency cases was unaffected by the decision, and in my experience in private practice and as carrier transparency reports indicate, emergency requests for location data are the most common.

Are All Business Records in the Hands of Third Parties Now Protected? No. But, the majority’s view of the third party doctrine seems to create a new test and probably a lot of uncertainty. As Justice Gorsuch says in his dissent, the majority keeps the third party doctrine on “life support” when it comes to settled cases involving phone and bank records, but now there is open a wholly new inquiry.  Here’s Chief Justice Roberts’ answer:

The Government’s position fails to contend with the seismic shifts in digital technology that made possible the tracking of not only Carpenter’s location but also everyone else’s, not for a short period but for years and years. Sprint Corporation and its competitors are not your typical witnesses. Unlike the nosy neighbor who keeps an eye on comings and goings, they are ever alert, and their memory is nearly infallible. There is a world of difference between the limited types of personal information addressed in Smith and Miller and the exhaustive chronicle of location information casually collected by wireless carriers today. The Government thus is not asking for a straightforward application of the third-party doctrine, but instead a significant extension of it to a distinct category of information.

So what are the new categories of information in the hands of third parties deserving of protection? We don’t know and the Court doesn’t tell us.

Does It Matter Whether You Voluntarily Give the Data to a Third Party? The third party doctrine depends in part on the voluntary conveyance of the information to the third party to demonstrate one’s diminished expectation of privacy in the data.  In location cases and in Carpenter, a lot of time was spent on whether a phone user actually voluntarily discloses his or her location and whether he or she must subjectively understand that is the case. The Court has an interesting answer to that question:

Neither does the second rationale underlying the third party doctrine—voluntary exposure—hold up when it comes to CSLI. Cell phone location information is not truly “shared” as one normally understands the term. In the first place, cell phones and the services they provide are “such a pervasive and insistent part of daily life” that carrying one is indispensable to participation in modern society. Riley, 573 U. S., at ___ (slip op., at 9). Second, a cell phone logs a cell-site record by dint of its operation, without any affirmative act on the part of the user beyond powering up. Virtually any activity on the phone generates CSLI.

So the lack of an affirmative act of the user, or the pervasive data collection in the ordinary course of an ubiquitous network’s operation, may not constitute “voluntary exposure” at all. This is a description of the operation of the Internet itself, and suggests that in no meaningful way does a user “share” or “expose” their online activities to a third party voluntarily in terms of the third party doctrine when the network operator captures each keystroke or action to build a profile, serve ads, or track behavior. Much of that transactional data has been available to law enforcement under the Stored Communications Act with the same type of order used to obtain CSLI in Carpenter.

Where You Walk and Perhaps Your Mere Presence in Public Spaces Can Be Private.  The Court said this clearly: “A person does not surrender all Fourth Amendment protection by venturing into the public sphere. To the contrary, “what [one] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.””  This is the most important part of the Opinion in my view. It’s potential impact is much broader than the location record at issue in the case. As the Court intimated, location collection hardly is a volitional act in the cell phone context – a point which diminishes the potential application of the third party doctrine to the record. The same certainly is true is about third party collection of all manner of data about you — in the news most recently, the kerfuffle about  collection, use and disclosure to law enforcement of facial recognition data by Amazon for example.  I’d add to the list, smart city data. Justice Kennedy, in dissent, argued that the location data at issue in the case wasn’t all that precise, but the majority looked to future advancements: “At any rate, the rule the Court adopts “must take account of more sophisticated systems that are already in use or in development.” Kyllo, 533 U. S., at 36. Thus, the Court made it clear that it’s decision is an effort to future proof the 4th Amendment against ever more refined technological invasions of privacy, even when the invasion occurs in a public space.

Will Magistrates Still Revolt?  Carpenter is the culmination of years of revolt by a number of federal magistrate judges like Judge Stephen Smith (SD-TX) who questioned the government’s demand for orders to obtain to location information – both historical and prospective – on less than a warrant based on probable cause. Carpenter vindicates these judges who were both prescient and principled, and leaves a little more room for revolution. My guess is that there are a few judges out there who think 6 days of location tracking records is just as problematic as 7 days.

Carpenter will be studied for a long time, and a lot of scholars already are asking good questions and raising good issues. See First Thoughts on Carpenter v. United States by Professor Orin Kerr for some great analysis.

Albert Gidari is the Consulting Director of Privacy at the Stanford Center for Internet and Society.