Fourth Amendment in the Digital Age: Carpenter v. United States and the Third-Party Doctrine

For decades, Fourth Amendment law operated on a simple rule known as the third-party doctrine. If you voluntarily hand information to someone else, a bank, a phone company, anyone, you give up your reasonable expectation of privacy in that information, and the government can obtain it from that third party without a warrant. The rule comes from two Supreme Court cases: United States v. Miller (1976), which held bank records aren’t protected because customers voluntarily convey their financial information to the bank, and Smith v. Maryland (1979), which held the numbers a person dials on their phone aren’t protected because that information is voluntarily conveyed to the phone company to route the call.

For most of the 20th century, this made a certain kind of sense. The records in question, who you called, how much money moved through your account, were narrow, specific, and required an affirmative act to generate. That assumption stopped holding up once a device in your pocket started generating a permanent, detailed record of everywhere you went, without you doing anything except carrying it.

Timothy Carpenter was convicted of a string of armed robberies partly on the strength of 127 days of his historical cell-site location information (CSLI), obtained by prosecutors from his wireless carriers without a warrant, under the lower legal standard the Stored Communications Act allows for business records. Carpenter argued the government needed a warrant. The government argued the third-party doctrine applied, exactly as it had to Miller’s bank records: Carpenter’s phone shared his location with the carrier every time it connected to a cell tower, so he had no reasonable expectation of privacy in that data.

In a 5 to 4 decision written by Chief Justice Roberts, the Supreme Court sided with Carpenter. The Court held that accessing historical CSLI is a Fourth Amendment search, and that the government generally must get a warrant supported by probable cause before acquiring it. The opinion’s reasoning is specific and worth quoting directly: cell-site records provide a detailed, comprehensive record of a person’s movements, and cell phones are, in the Court’s words, such a pervasive and insistent part of daily life that carrying one is indispensable to participation in modern society. The Court found that a cell phone logs a location record automatically, by dint of its operation, without any affirmative act on the user’s part beyond powering it on, which is fundamentally different from voluntarily dialing a number or making a bank deposit.

The Carpenter opinion contains a paragraph that gets left out of almost every summary of the case, and it is the single most important part for understanding the world the ruling actually created. The Court stated explicitly that its decision is narrow: it does not disturb the application of Miller and Smith, it does not call into question conventional surveillance techniques and tools such as security cameras, and it does not address other business records that might incidentally reveal location information.

That last clause is the entire loophole. Carpenter protects historical cell-site records obtained directly from your wireless carrier. It says nothing about location data that a private company collects some other way, for instance from the location-tracking code embedded in ordinary smartphone apps, and then aggregates and sells on the open market. The third-party doctrine that Carpenter narrowed for carrier CSLI remains, on paper, fully intact for that kind of commercially purchased data. Whether it should apply the same way is a live legal question courts have not definitively resolved. What is not in dispute is that federal, state, and local agencies have been operating as though it does.

This is not speculation about what the gap in Carpenter could theoretically be used for. It is a documented, reported record of what has already happened. In 2022, the Electronic Frontier Foundation filed more than 100 public records requests and found that a company called Fog Data Science had past or ongoing contracts with at least 18 state and local law enforcement agencies, selling access to a tool called Fog Reveal built on location data harvested from ordinary smartphone apps, for prices as low as 9,000 dollars a year. Separately reported federal contracts show the Department of Homeland Security paid more than 650,000 dollars for a year of access to a similar service from a company called Venntel, and that Immigration and Customs Enforcement, Customs and Border Protection, and the FBI have also purchased location data access from data brokers. None of this required a warrant, because none of it was obtained from a wireless carrier under the framework Carpenter addressed. It was purchased on the open commercial data market.

This page focuses on the legal framework. The specific companies, what they collect, and what a person can actually do about it are covered in a separate companion page on the data broker industry itself.

Carpenter did not resolve whether purchased commercial location data requires a warrant. Lower courts have reached different conclusions in different circuits, and the Supreme Court has not yet taken a case squarely addressing government purchase of data-broker location information. In Congress, a bill called the Fourth Amendment Is Not For Sale Act has been introduced in multiple sessions to close this specific gap by statute, requiring the same warrant standard for purchased data that Carpenter requires for carrier data; as of this writing it has not been enacted into law. Until either the courts or Congress act, the legal status of this practice remains what the Carpenter opinion itself said its own ruling was: narrow, and silent on exactly this scenario.