On 29 June, the U.S. Supreme Court handed down a 6-3 decision in Chatrie v. United States, ruling that a law enforcement geofence constitutes a search under the Fourth Amendment.

Justice Elena Kagan, writing for the majority, held that individuals retain a reasonable expectation of privacy in their location history even when held by a third party, in this case Google. The court meaningfully limited the third-party doctrine by rejecting the government's argument that because the data at issue was handed over to a third party, it retained no Fourth Amendment protections.

However, the court left the specific evaluation of whether the search was reasonable — including whether particularity and probable cause requirements were met at each step of the warrant's multistep process — to the lower court.

Background of the case

On 20 May 2019, an armed robber entered a credit union in Midlothian, Virginia. Security footage captured the suspect walking past a nearby church shortly beforehand, appearing to speak on a cellphone. Police turned to an aggressive digital surveillance technique known as a geofence warrant, transforming a local robbery into a constitutional battleground over the limits of digital privacy.

A geofence warrant reverses traditional policing. Instead of establishing probable cause against a specific suspect and searching their property, law enforcement identifies a physical location and a timeframe, demanding that a company like Google search its user data repositories to figure out everyone who might have been within that area during that window.

In this case, investigators secured a warrant forcing Google to query its centralized Sensorvault database, a repository containing the detailed location histories of hundreds of millions of active user accounts worldwide that were opted into location history, a Google Maps feature through which locations are compiled into a user-facing timeline.

The warrant drew a virtual boundary with a 150-meter radius centered on the credit union, an area encompassing not just the bank, but several football fields of surrounding territory, including local businesses, public roads and the entirety of the neighboring church.

Google executed the request through a mandatory multistage compliance protocol designed to filter the data. In the initial phase, Google searched its vast repository and delivered to investigators anonymized location coordinates for every device caught within the designated circle during a one-hour window surrounding the robbery. This initial sweep captured 19 separate user accounts, the vast majority belonging to innocent bystanders or motorists passing through the area.

Once investigators reviewed the anonymous data points, the process entered its second stage, which ordered Google to provide expanded, two-hour tracking histories for a narrowed list of nine accounts. Crucially, this step allowed police to track the historical movements of these anonymous users completely outside the original crime scene radius, mapping where they went before and after the robbery.

After evaluating these expanded timelines, the third stage of the geofence warrant involved investigators selecting a subset of devices — in this case three — and ordering Google to unmask them by handing over the names, email addresses and subscriber information associated with each device.

One of those unmasked names belonged to Okello Chatrie. Armed with his specific location history, investigators secured a traditional search warrant for his home, recovered evidence linked to the robbery and arrested him.

Chatrie's legal team immediately moved to suppress the evidence, launching a direct constitutional challenge against the validity of reverse-location dragnets. They argued that sweeping up the intimate data of hundreds of millions of innocent people to look for a single suspect functions as an unconstitutional general warrant, violating the core protections of the Fourth Amendment.

The (in)application of the third-party doctrine

Geofence warrants triggered a fierce debate across the judiciary regarding whether citizens maintain a reasonable expectation of privacy in the continuous location logs compiled by their smartphones, and more generally, whether such an expectation of privacy exists for sensitive data that was shared with companies to provide a wide range of digital services.

The government argued that, under the third-party doctrine, users voluntarily forfeit their privacy rights when they store information with a third party; in this case, when they enable location features and agree to a technology firm's commercial terms of service.

Chatrie's defense countered that modern smartphones act as digital proxies for our physical lives, and allowing the government to freely grab any data users entrust to a company in order to provide digital services — from emails to online calendars to storing documents in the cloud — would create an unchecked virtual panopticon.

At the trial level, the district court judge agreed that the geofence warrant at issue plainly violated the Fourth Amendment due to its sweeping breadth. The judge nonetheless refused to throw out the evidence under the good-faith exception, ruling that the officers were operating in uncharted legal territory.

Chatrie was convicted and sentenced to nearly 12 years in prison. He has currently served just about four years of that sentence.

On appeal, an evenly divided en banc panel of the Fourth Circuit issued a split decision that highlighted the deep confusion among judges, with half the court arguing no search had occurred and the other condemning the dragnet as a major constitutional violation.

The Supreme Court ultimately resolved whether the Fourth Amendment is constrained by the third-party doctrine for location data held by companies. Highlighting its prior ruling in Carpenter v. United States — which established a warrant requirement for targeted, long-term location tracking based on cell site location information held by companies that provide cellular service — the court held that the third-party doctrine was inapplicable based on two factors.

First, the sensitivity and revealing nature of the data at issue. Second, the fact that the data was not shared "in the normal sense of wanting a third party to see or use it." Establishing these factors slams the door closed on the notion of the third-party doctrine overriding Fourth Amendment protections for location data, and will have profound implications for an array of other digital data maintained by companies for their users.

What Chatrie leaves unaddressed in the broader privacy landscape

Across the country, dozens of states have passed comprehensive consumer privacy laws that attempt to limit how commercial entities collect, share and use personal information. However, these consumer-facing statutes explicitly stop at the police station door, universally carving out broad exemptions for criminal and administrative processes.

While the commercial sector faces tightening state restrictions, the federal surveillance frameworks that govern how law enforcement accesses that very same data all-too-often remain deeply anchored in a pre-digital era.

The Electronic Communications Privacy Act and the Stored Communications Act were enacted decades before the advent of modern cloud computing and smartphone tracking. The ECPA just enjoyed its 40th birthday.

Given the lack of meaningful legislative reform, statutory thresholds just have not caught up to answer key questions about how law enforcement can access information held by private companies.

This stagnation by policymakers allows police to leverage the commercial marketplace to purchase consumer records directly from data brokers, or to use administrative subpoenas to bypass traditional judicial oversight. The failure to adopt and update privacy statutes leaves the judiciary alone to map out the constitutional limits of digital-age dragnets.

The Chatries of tomorrow

By the time Chatrie made its way to the Supreme Court, Google — the primary known recipient of geofence warrants — had moved location history from its central Google Cloud-hosted repository to on-device storage. Therefore as of today, Google can no longer fulfill geofence warrants, and it's unclear whether other companies retain location data in a way that is responsive to the same geofence warrants issued on Google, or at a scale that would be useful to investigators.

That said, while Google may be unable to provide responsive data to any geofences issued to the company, serious questions remain as to the constitutional boundaries of reverse searches overall. This is especially important as law enforcement increasingly employs not just traditional searches but also more technically complex reverse searches — such as demanding responsive information on all users based on keyword searches or AI chatbot prompts — pressuring companies that gather data to serve their users into running the government's investigations on their behalf.

Search resources

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

IAPP Canada OPC Final Report

The state of enforcement: Part I — Consumer privacy rights

Chatrie v. United States: A privacy victory before the Supreme Court

Independence Day surprise: New Jersey's costly new data broker law

Unpacking the scope of the KIDS Act