Groundbreaking Ruling Recognizes Our Right to Privacy in Location Data

We’ve been fighting to protect people from the prying eyes of government for many years, but one of our longest-running battles is against warrantless police access to location data generated by our cell phones. In 2018, in a Supreme Court case called Carpenter v. United States, we had a huge victory. To link a defendant to a string of robberies, the government obtained 127 days’ worth of cell tower data—without a warrant—to try to place him at the scene. The Court held definitively that the Fourth Amendment protects historical cell phone location information.

Part of EFF’s core mission is to maintain the civil rights that we’ve always had in the offline world in an era when technologies like cell phones, computers, activity trackers, or smart home devices capture more personal details about us than ever before. These modern conveniences have made it easier for us to connect with family and friends, find our way around the world, and do so much more. But they have also made it easier for companies, governments, and especially law enforcement to track us and learn intimate details about our lives.

Part of EFF’s core mission is to maintain the civil rights that we’ve always had in the offline world in an era when technologies like cell phones, computers, activity trackers, or smart home devices capture more personal details about us than ever before.

I believe it’s vital that the government not be able to track us everywhere we go, and equally important that we benefit from new technologies. If we know that the government has access to records of our sensitive information, we may be less likely to use those tools. More importantly, we may be less likely to participate fully in society when we know the government is watching. This chilling effect is especially true for communities that are already over-policed or marginalized. For example, when the NYPD was surveilling Muslim communities in New York and New Jersey, community members reported they were less likely to talk to people they didn’t know, shopkeepers changed television channels to avoid Arabic language programs, and parents encouraged their children not to speak out against the government.

As far back as 2005, we’ve challenged law enforcement’s warrantless access to location data—sometimes at the invitation of judges when there wasn’t even a defendant yet—explaining cell phone technology to the courts and arguing the Fourth Amendment requires a warrant for location data. On the other side, the government has argued that we have no reasonable expectation of privacy in this data because it is collected by and shared with a “third party”—the phone company. As cases started going up to appellate courts, we kept losing one case after the next with the courts feeling hamstrung by earlier Supreme Court opinions. Despite these setbacks, we carried on because we believed the courts were wrong and that they were setting dangerous precedents, not just for cell phones, but for all the other data we share with companies as a byproduct of how many technologies now operate.

Finally Carpenter made it up to the Supreme Court. We filed an amicus brief urging the Court to take another look at how the Fourth Amendment should apply to the vast amount of data collected by third parties like cell phone companies and by other technologies we rely on every day.

In its landmark 5-4 opinion, the Court agreed with our arguments, even citing our amicus brief. The Court held the Fourth Amendment protects data, even when shared with or collected by a third party. The Court recognized that location information creates a “detailed chronicle of a person’s physical presence compiled every day, every moment over years.” As a result, police must now get a warrant to access it.

Although the Supreme Court explicitly tried to limit Carpenter to historical cell phone location information, the language in the opinion is so sweeping that we think it would apply easily to other technologies.

We are now pushing the limits of Carpenter by urging courts to apply it to other data stored with third parties and to other instances when law enforcement collects location information without a warrant. One technology we’re focusing on is automatic license plate readers (ALPRs)—cameras mounted on utility poles, police cars, and even vehicles operated by private contractors that scan all license plates that cross their paths and record the time, date, and location of the scan. Law enforcement and surveillance companies are building databases of billions of plate scans from ordinary people who’ve committed no crimes. We’ve now filed amicus briefs in several federal and state appellate court cases challenging warrantless access to this data. So far, the lower courts have ruled that law enforcement don’t need any kind of legal process at all to access it.

Law enforcement likes to make the argument that when you’re driving in public, you can’t expect privacy over your license plate because anyone can see your car, and you should know you are being watched. But one thing I’ve found in my work is that most people don’t agree at all with this argument. When people find out that police and private surveillance companies are tracking their location they find it surprising and often really creepy.

It is creepy. And it goes against the Constitution and the democratic principles on which the United States was founded. With your help, we’ll keep fighting to protect your data and your location from the government’s prying eyes.

Shedding light upon law enforcement’s data access and surveillance capabilities

It has long been easy for U.S. law enforcement to find out who people communicate with, where they travel, and what they believe. Using technology like pen registers—electronic devices that record metadata like all numbers called from a particular phone line—and other tools, police can collect an abundance of data on anyone who uses the Internet or a mobile phone, including who they call and what websites they visit. Government’s use of these powers has also long been secret.

Federal laws such as the Pen Register Act, Stored Communications Act, and Wiretap Act give law enforcement the authority to obtain this information. The vast majority of these cases are filed under seal and remain that way indefinitely. The secrecy surrounding these orders is further heightened by the varying docketing practices of federal courts across the country, which means there’s often not even a public docket for such materials—making it impossible to know basic facts and when and how frequently government requests this data.

As a result of EFF’s work on behalf of the Pulitzer Prize-winning newspaper The Stranger, the public will get access to basic facts about law enforcement’s use of these powers in Seattle. In 2018, EFF represented the newspaper to file a petition with a Washington state federal district court aimed at ending secrecy surrounding electronic surveillance orders. The petition asked the court to make public historically sealed electronic surveillance orders while also requesting that the court adopt procedures to ensure greater transparency moving forward. EFF was proud to represent The Stranger because the newspaper is committed to government transparency and has a distinct history of reporting on law enforcement surveillance capabilities.

The amount of information that law enforcement is able to obtain without a warrant right now is already invasive. In addition to just being able to obtain info that details private info about us, we know that law enforcement are increasingly pushing the boundaries of these authorities to try to use them in new ways. This is problematic because without public scrutiny, law enforcement can aggregate power to itself and too often, judges fail to check that growing power. And given the secrecy, neither the public nor Congress has enough information to actually protect individual privacy and limit law enforcement.

This is problematic because without public scrutiny, law enforcement can aggregate power to itself and too often, judges fail to check that growing power.

For example, the blockbuster Supreme Court case U.S. v. Carpenter, which ruled that police must get a warrant before obtaining historic cell-site location information, originated from a Stored Communications Act order issued in 2011. It took seven years for the case to wind its way through the courts. And it was only because a criminal defendant who was actually charged with a crime challenged the order that we are able to enjoy these new protections.

The secrecy also limits courts and lawmakers from meaningfully developing the law to protect individual privacy. So many of these surveillance orders are issued and the target whose emails or communications metadata are collected doesn't learn of that invasion because they are never prosecuted or are not the target of the criminal investigation.

After EFF filed the petition for The Stranger, the federal court in Seattle agreed to track and docket warrantless surveillance orders and requests, and then publicly disclose them twice a year. The agreement requires that, beginning in 2020, the court will publicly post a list of the cases involving these requests and orders that will include basic information about them, such as when they were sought and what crimes police were investigating.

Providing greater transparency will help everyone learn sooner how law enforcement is using its surveillance powers, which will hopefully allow people to more proactively challenge those powers, either in court or by passing new laws.

Keeping companies transparent and accountable for online censorship

As a lifelong digital rights advocate, I have seen careless moderation of online content lead directly to broad censorship. Though originally intended to protect users from offensive or illegal content, companies have increasingly added complexity to their public-facing rules, internal guidelines, and content moderation practices, silencing many forms of expression.

Inconsistent and overbroad content moderation has a negative impact on all kinds of individuals and groups, from political protestors in Egypt or Poland to businesses both small and large. I’ve seen overly complex policies and moderation errors harm LGBTQ+ organizations, bra companies, Catalan independence activists, poets, religious figures, and many others.

While many of these policies are unfairly restrictive, EFF believes in a company’s right (guaranteed by CDA 230) to moderate their own platform. But we also believe that they should be transparent and communicative about what they remove, and accountable to their users when they make wrong decisions by offering a means for them to appeal. No one is immune from overbroad content moderation, which is why one remedy is to ensure that all users are treated fairly and offered consistent tools for recourse.

No one is immune from overbroad content moderation, which is why one remedy is to ensure that all users are treated fairly and offered consistent tools for recourse.

For many years, EFF has been a leader in advocating for transparency and accountability. Through our Who Has Your Back project, we’ve pushed for companies to produce regular transparency reports and inform their users about the decisions they make—but with platform censorship on the rise, we knew we needed to do more. In February of 2018, we convened digital rights and free speech-focused groups and academics alongside a conference in Santa Clara, California to determine what needed to be done.

From that meeting emerged the Santa Clara Principles on Transparency and Accountability in Content Moderation, which serve as a starting point for companies. The principles outline a minimum set of standards for companies for reporting on transparency; providing notice to users on content takedowns and account deactivations; and supplying users with an appeals process when their content has been wrongly removed.

Last year, along with more than one hundred organizations from all over the world, we penned an open letter calling on Facebook CEO Mark Zuckerberg to incorporate the Santa Clara Principles into Facebook’s practices. To our surprise, Facebook responded publicly. The company committed to providing users with an expanded appeals process, and shortly after receiving our letter, published their first report offering transparency around content moderation decisions. While their commitments fell short of our demands, the company further pledged to engaging more robustly with the global digital rights community.

The process of collaboration amongst so many disparate groups has also led to the creation of a loose global coalition of organizations concerned with the policies and practices of content moderation. The coalition holds regular learning calls and has planned meetups at upcoming events.

I’m looking forward to conducting more advocacy campaigns directed at tech companies whose policies fall short of the Santa Clara Principles, and even adapting or expanding the principles as time goes on to keep up with new trends. By working together, I know we can ensure that more tech companies operate with transparency and accountability to respect their users.