Terms of Service Do Not Eliminate Fourth Amendment Rights in a Google Account

So holds the Second Circuit, in a new decision.

As regular readers may recall, I argued in a recent article that terms of service to an Internet account have little or no effect on Fourth Amendment rights in the account:

Almost everything you do on the Internet is governed by Terms of Service. The language in Terms of Service typically gives Internet providers broad rights to address potential account misuse. But do these Terms alter Fourth Amendment rights, either diminishing or even eliminating constitutional rights in Internet accounts? In the last five years, many courts have ruled that they do. These courts treat Terms of Service like a rights contract: by agreeing to use an Internet account subject to broad Terms of Service, you give up your Fourth Amendment rights.

This Article argues that the courts are wrong. Terms of Service have little or no effect on Fourth Amendment rights. Fourth Amendment rights are rights against the government, not private parties. Terms of Service can define relationships between private parties, but private contracts cannot define Fourth Amendment rights. This is true across the range of Fourth Amendment doctrines, including the "reasonable expectation of privacy" test, consent, abandonment, third-party consent, and the private search doctrine. Courts that have linked Terms of Service and Fourth Amendment rights are mistaken, and their reasoning should be rejected.

I'm pleased to say that the Second Circuit handed down a ruling in United States v. Maher this week rejecting the claim that terms of service waive Fourth Amendment rights, at least in the important context of a Google account.  The decision is written in a somewhat narrow way, but I think it gets the basics correct.  Here's the key passage from Maher:

The government argues that Maher's expectation of privacy in the Maher file that he emailed to his own Google account was extinguished by Google's Terms of Service, which advise users that Google (1) "may review content to determine whether it is illegal or violates our policies," App'x 113, (2) "may" report "illegal content" to "appropriate authorities," id. at 142, and (3) "will share" users' information with law enforcement when necessary to comply with applicable law, id. at 131.

This court has not had occasion to address what effect, if any, a private company's terms of service might have on a defendant's reasonable expectation of privacy. It may well be that such terms, as parts of "[p]rivate contracts[,] have little effect in Fourth Amendment law because the nature of those [constitutional] rights is against the government rather than private parties." Orin S. Kerr, Terms of Service and Fourth Amendment Rights, 172 U. PA. L. REV. 287, 291 (2024) (summarizing case law). We need not here draw any categorical conclusions about how terms of service affect a user's expectation of privacy as against the government. On this appeal, it suffices that we conclude that Google's particular Terms of Service—which advise that Google "may" review users' content, App'x 113—did not extinguish Maher's reasonable expectation of privacy in that content as against the government.

In reaching that conclusion, we adopt the reasoning of the Sixth Circuit in United States v. Warshak, 631 F.3d at 286–87 (holding that government violated Fourth Amendment when, without warrant, it compelled internet service provider to surrender contents of user emails). There too, the government argued that an internet service provider's contractual reservation of the right to access user emails extinguished a defendant's expectation of privacy in his emails. In rejecting the argument—at least with respect to a reservation phrased in terms of what the provider may do, see id. at 287 (quoting Acceptable Use Policy provision stating that provider "may access and use individual Subscriber information in the operation of the Service and as necessary to protect the Service" (emphasis in original))—the Sixth Circuit held that "the mere ability of a third-party intermediary to access the contents of a communication cannot be sufficient to extinguish a reasonable expectation of privacy" as against the government, id. at 286 (emphasis in original). As the court explained, that conclusion finds support in the seminal Fourth Amendment case, Katz v. United States, 389 U.S. 347 (1967), where "the Supreme Court found it reasonable to expect privacy during a telephone call despite the ability of an operator to listen in." United States v. Warshak, 631 F.3d at 287 (noting that telephone companies could then "listen in when reasonably necessary to protect . . . against the improper and illegal use of their facilities" (internal quotation marks omitted)). It also finds support in cases recognizing that hotel guests retain a reasonable expectation of privacy in their rooms, "even though maids routinely enter hotel rooms." Id.; see United States v. Stokes, 733 F.3d 438, 443 n.7 (2d Cir. 2013) ("Hotel guests retain a legitimate expectation of privacy in the hotel room and in any articles located in their hotel room for the duration of their rental period."). We too conclude from these precedents that Google's Terms of Service, advising users of what the company "may review," App'x 113, did not extinguish Maher's reasonable expectation of privacy in his emails as against the government.

Nor is a different conclusion compelled by the fact that Google's Terms of Service also warn users that the company "will share personal information outside of Google if . . . reasonably necessary to[] . . . [m]eet any applicable law." Id. at 131 (emphasis added). As noted supra at 7 n.5, federal law requires electronic service providers such as Google to file a report with the NCMEC when they have "actual knowledge" of child pornography on their platforms. 18 U.S.C. § 2258A(a)(1)(A), (B). But the same law specifically does not require Google "affirmatively [to] search, screen, or scan" for such material. Id. § 2258A(f)(3). Not surprisingly then, Google does not tell users that it will engage in the sort of content review for illegality that could trigger disclosure obligations under § 2258A(a)(1)(A), (B). Rather, it tells users only that it "may" engage in such review. App'x 113. Indeed, in the next sentence, Google emphasizes that it "does not necessarily . . . review content," and tells users, "please don't assume that we do." Id. at 114 (emphasis added). Such qualified language is hardly a per se signal to Google users that they can have no expectation of privacy in their emails, even as against the government. Cf. United States v. Rosenow, 50 F.4th 715, 730 (9th Cir. 2022) (stating, with respect to § 2258A, that "[m]andated reporting is different than mandated searching" (emphasis in original)).

In a different context that is nevertheless instructive here, the Supreme Court declined to construe even unqualified language in a private contract as extinguishing a person's expectation of privacy as against the government. See Byrd v. United States, 584 U.S. 395 (2018). There, a car rental agreement expressly forbade anyone not identified in the contract from operating the leased vehicle. The government argued that this meant any driver not so identified had no reasonable expectation of privacy in the vehicle. The Court, however, declined to derive such a "per se rule" from the contract's identified-operator provision. Id. at 405. Recognizing that "car-rental agreements are filled with long lists of restrictions," id. at 407, the Court adhered to the "general rule" that a person "in otherwise lawful possession and control of a rental car has a reasonable expectation of privacy" against the government in that vehicle even if he is not authorized by the rental agreement to be operating the car, id. at 398–99.

Here, we need not decide whether terms of service pertaining to content review might ever be so broadly and emphatically worded as to categorically extinguish internet service users' reasonable expectations of privacy in the contents of their emails, even as against the government. See United States v. Warshak, 631 F.3d at 287 (declining to foreclose possibility). We conclude only that Google's Terms of Service, repeatedly qualifying the content review that the company "may" conduct, do not effect such a complete extinguishment.

This issue is pending in a bunch of courts right now, and I hope (and expect) that the Second Circuit's ruling will have a significant influence on how other courts view the issue.