The Volokh Conspiracy
Mostly law professors | Sometimes contrarian | Often libertarian | Always independent
Are There Fourth Amendment Rights in Google Search Terms?
A noteworthy decision, even if there's no majority opinion.
The Pennsylvania Supreme Court handed down its long-awaited ruling in Commonwealth v. Kurtz today, on whether there are Fourth Amendment rights in Google search terms. Among the seven Justices, three took on that question and said no, the Fourth Amendment and the state constitution do not apply. (One Justice said that she would say no if she had to reach it, but she didn't have to reach it, so she would not take a position.)
In the case, the police were trying to find out who committed a sexual assault of a person known in the opinion by her initials, "K.M." Police figured that whoever committed this crime may have googled K.M.'s name or address before committing the crime. Investigators obtained what is known as a "reverse keyword search warrant," asking for Google to hand over the I.P. address of whoever may have googled the name or address of the victim shortly before the crime. Google responded that someone at a particular I.P. address had conducted two searches for K.M.'s address a few hours before the attack. The I.P. address was in use at the home of the defendant, Kurtz. The police had not suspected Kurtz in the crime, but they started to watch Kurtz closely, obtained a DNA sample, and found a DNA match from the crime.
Kurtz challenged the warrant, arguing that it was not based on probable cause. The government responded that whether the warrant was valid or not was irrelevant, as there are no Fourth Amendment rights in search terms. The first issue in Kurtz was whether the traditional third-party doctrine applies, under which you don't have Fourth Amendment rights in information you share with others, or whether search terms are protected by the Fourth Amendment under the exception to the third party doctrine carved out in Carpenter v. United States(2018) applied instead.
Writing for a total of three of the seven Justices, Justice Wecht agreed with the government that the third-party doctrine applies and that search terms are not covered by the exception to that doctrine carved out by Carpenter:
Resolution of the central question in this case—whether a person has an expectation of privacy in his or her unprotected internet searches—rests upon whether such actions are governed by Carpenter's "narrow" rejection of the third-party doctrine, or fall instead under the traditional third-party doctrine. The Court's deviation from the traditional doctrine in Carpenter in large part was predicated upon the inextricable relationship between the contemporary person and his or her device. Because the Court considered mobile devices to be "indispensable to participation in modern society," the Carpenter Court held that their use in public is an unavoidable part of modern life. As such, the Court held, a person does not make a voluntary choice to place CSLI generated by cell phone use into the hands of third parties. Rather, such transmission happens automatically.
A reasonable comparison can be made between the prevalence of the internet in modern society and the prevalence of cell phone usage. Such similarity, however, does not mean that they are one and the same for purposes of the third-party doctrine. Rather: "Carpenter's expectation of privacy ruling was based upon more than just the fact that a contemporary American and his or her phone rarely, if ever, detach from one another. Nor was the decision premised exclusively upon the widespread coverage provided by cellular towers, or upon the fact that the records generated from connections to those towers can create an allencompassing roadmap of the person's movements. The ruling resulted from the amalgamation of these factors. Indeed, the linchpin of Carpenter was that, because of the inseparable relationship between a person and his cell phone, it is not objectively reasonable to expect that a cell phone user can avoid the creation of the records as he or she travels through the public sphere. Because the user has no reasonable way to limit the creation of the records, and because of the extensive information compiled by those records, the Court found that a reasonable expectation of privacy existed. The inverse must also be true: if a person can limit the creation of the records, or if the device or instrumentality at issue is not so inextricably and unavoidably attached to modern life, no such expectation of privacy would prevail."
It is beyond cavil that the internet is extensively intertwined with nearly every aspect of contemporary life. We use it to schedule appointments, to communicate with friends and former schoolmates, to play games, to hold meetings, and to conduct research on any number of topics. The list goes on and on. However, unlike smart phones, the internet is not a "feature of human anatomy." The use of the internet is not involuntary, as cell phones have become. To the contrary, every time a person logs on to the internet, that person makes a choice. She chooses to input data into a network owned and operated by an internet service provider. While users (reasonably) may believe that their searches are private, they nonetheless willingly transmit data to a third party whenever they type terms into a search engine and hit the "Enter" key. Unlike the cell phone user who cannot avoid creation of a data trail, the internet user can avoid or minimize the creation of such records by using other methods of research. A person seeking a restaurant reservation can telephone or visit the establishment rather than using the internet to book it. Someone hoping to learn more about dinosaurs or galaxies can conduct research in print materials at the library.80 Persons seeking privacy can shield their browsing history.81 The point is that the data trail created by using the internet is not involuntary in the same way that the trail created by carrying a cell phone is.
That one should not expect absolute privacy in the routine use of the internet should not come as a surprise. It is common knowledge that websites, internet-based applications, and internet service providers collect, and then sell, user data. Nearly every time a person opens an internet-based application for the first time on a smart phone or home computer, he or she is notified of such expansive data collection and is given the option to opt out of it. It is not at all infrequent that a person searches online for a product today, only to receive electronic advertisements for that same product tomorrow. The point is that, even the ordinary, everyday use of the internet provides strong indicators that there is no privacy in the terms or information that the user voluntarily enters into a search engine.
In the case before us, Google went beyond subtle indicators. Google expressly informed its users that one should not expect any privacy when using its services. Under the "Privacy" tab situated on the bottom right-hand corner of Google's home page, at the time of the searches at issue in the case sub judice, Google informed its users of the following: [long quote of Google's terms of service omitted]. Thus, when a person performs a Google search, he or she is aware (at least constructively) that Google collects a significant amount of data and will provide that data to law enforcement personnel in response to an enforceable search warrant. For present purposes, what Google does with that information, including the standards it imposes upon itself before providing that information to investigators, is irrelevant. For Fourth Amendment purposes, what matters is that the user is informed that Google—a third party—will collect and store that information. When the user proceeds to conduct searches with that knowledge, he or she voluntarily provides information to a third party. This express warning, in tandem with the more indirect indicators noted above, necessarily precludes a person from claiming an expectation of privacy in his or her voluntary internet use. Any such claim is not one that society would find objectively reasonable.
Justice Mundy would have been the fourth vote for this view. She wrote a brief concurrence saying that she agreed with Justice Wecht, but that would not take a formal position on the question as she would instead say there was probable cause and resolve the case on those grounds:
I write separately to express that if this Court were required to resolve the constitutional query posed, I would agree with that "the average search engine user" does not have "an expectation of privacy in the records generated by" unprotected internet searches. Opinion Announcing the Judgment of the Court ("OAJC"), at 3. However, as this determination was, in my view, not needed to dispose of this matter, I am compelled to concur only in the result of the OAJC.
Seems a bit unusual to me to state a position but not take the position, but so it goes. That might explain why it took a year and half since the oral argument to decide the case. (Three Justices resolved the case on probable cause grounds, ruling that probable cause was sufficient; this was Justice Mundy's view, as noted, as well as Chief Justice Todd's view, expressed in a concurrence here.)
Justice Donohue wrote a dissent primarily on state constitutional grounds, although she did also express disagreement with Justice Wecht's conclusion about Carpenter:
I do not address the OAJC's conclusion that under the Fourth Amendment a Google user would have no expectation of privacy in information the user shares with Google. However, I am not convinced that this conclusion is correct given the High Court's decision in Carpenter, where it declined to extend the third-party doctrine to the collection of cell-site location data from an individual's cell phone company based, in part, on its determination that "cell phones and the services they provide are 'such a pervasive and insistent part of daily life' that carrying one is indispensable to participation in modern society." Carpenter v. United States, 585 U.S. 296, 315 (2018) (quoting Riley v. California, 573 U.S. 373, 385 (2014)). The OAJC and I agree that the internet is an indispensable tool in modern society. OAJC at 2. Without access, the internet is useless. Google is the dominant search engine in the United States, accounting for 85%-90% of the search engine market share at various points in the last year. Search Engine Market Share United States of America October 2024 – October 2025, STATCOUNTER [link omitted]. Given its overwhelming dominance, Google is equally "a pervasive and insistent part of daily life" such that using Google "is indispensable to participation in modern society." See Carpenter, 585 U.S. at 315. The contrary perspective of the OAJC is untethered to the realities of everyday life in households throughout this Commonwealth.
Two thoughts.
First, I think this is a hard Carpenter question. In my recent book, The Digital Fourth Amendment: Privacy and Policing in Our Online World, I argue that this is a close call that could go either way. It depends on your theory of what Carpenter is doing, and even then it depends on how far you interpret some of the vague language in Carpenter. Doctrinally, either answer is at least plausible; even under my own take of what Carpenter means, it's not an easy call. See pages 168-170.
Second, just two years ago, the Colorado Supreme Court handed down a very different ruling on essentially the same question, People v. Seymour. The Colorado court ruled that accessing search terms is a Fourth Amendment seizure (rather than a Fourth Amendment search), relying on Google's terms of service. It also ruled that accessing search terms is a search under the Colorado state constitution. I didn't think the seizure ruling was persuasive, as I blogged about here, but Wecht opinion here and the Colorady opinion are a fascinating contrast. One uses Google's TOS to say that a warrant is required; the other uses TOS to say that no warrant is required. I tend to see the reliance on TOS as a crutch both ways. As I have argued here, I don't think TOS alter Fourth Amendment rights—up or down. But it's interesting to see courts rely on them, especially to reach opposite results.
Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Comments may only be edited within 5 minutes of posting. Report abuses.
Please to post comments
I guess most bad actors haven't figured out how to use a VPN?
No one has any expectation of privacy on the web.
The People do not give up their rights as the cost of participating in modern conviences.
If you seek an example of a boot stamping on a human face forever, look at a world where the governnent runs a panopticon using the 3rd party doctrine.
"A person seeking a restaurant reservation can telephone or visit the establishment rather than using the internet to book it."
This seems out of touch. It's been a few years since anyone sent us a phone book. If someone, say, wrote me a letter saying 'you have to try the linguine at Mama Mia's', I can start randomly walking around town looking for it, or I can run a search to get the address or phone number.
One can of course search with duckduckgo or one of the other engines that doesn't log IP addrs.
That still tends toward the same conclusion: the record you leave with Google is voluntarily created, since you could have used a different search engine, and therefore not subject to a reasonable expectation of privacy.
By that logic if you use a phone vendor other than Phreeli, the location records you leave with Verizon/TMobile/etc are voluntarily created, and therefore not subject to a reasonable expectation of privacy.
Who besides those in power and their lawyers thinks your stuff is not private? Everyone else thinks so.
Power mongers should not being making stuff up. This very case demonstrates government-as-panopticon-master. As The People create conviences and new cool things, governmrnt does not get some default honor to sit there monitoring all you do.
Right !
Expansion of privacy is paramount to insure public safety.
Correct, when you realize collapse to dictatorship isn't public safety at all.
Ya know, like how you push the 2nd Amendment as prophylactic against tyranny? Yeahhhh...
Wrong place
Not only this, but some restaurants actually only take reservations over the Internet. Why pay a reservationist when a computer can do the job? And restaurants are an example of a business that at least demands some sort of physical storefront. There are MANY business now that exist only on the Internet from a customer's perspective.
As always, Prof Kerr does an outstanding job describing what the law is. Normatively, however, the law should be that Kurtz was wrongly decided and the third-party doctrine has become the exception that swallows the rule (that is, the 4A). Police should have no greater rights or powers than any other citizen until and unless they get a valid warrant. Carpenter was a step in the direction of fixing it but didn't go nearly far enough.
At time of the Founding, police had no special powers until they had a warrant or personally witnessed the crime. Returning to that standard would bring the Terms of Service into play. If the ToS says any random person can get X, then the police can also have X without a warrant but if the ToS makes a promise of privacy, the police should need a warrant to force the information holder to violate their contractual promise.
Government realized they couldn't just listen to phone calls without a warrant, and so they created the sophistry the timing and who you called was fair game, to allow them to flesh out networks.
Well, if such tech was available at the time of the Founding Fathers, the Tyrant King Geo. III would have badly abused that to round them up, and so the FF would have included it as banned without a warrant. Should they have managed to succeed anyway, of course.
I suppose it's the thought that counts. Our government does not shine here, when given the choice between the spirit of the Constitution and the spirit of tyrant kings, "panopticon enjoyers", as the kids might say nowadays.
The third party doctrine is not an "exception" to the 4A, though. It's simply an application of the standard: when you voluntarily convey information to others, they can tell it to the police.
The point your missing is that 'they can tell it to the police' has been converted to 'they must tell it to the police. And they must do so regardless of the contractual promises they made to me when I "voluntarily" conveyed the information to them. The sharing is not truly voluntary at either step so the legal fiction used to justify the 'third party doctrine is exactly that - a complete and utter fiction.
If Google wants to, I think they can demand a warrant - I assume Google has a Fourth Amendment right, if users don't, and that Google is simply waiving that right.
AIUI, Google generally does require a warrant, and the government obtained one in this case. The government was arguing, however, that they could still compel Google to release the search data even if the warrant were invalid.
My reaction when I read that also. "I need not decide that, so I won't" is normal. "I need not decide that, but I will — while crossing my fingers so it doesn't count" is kind of weird.
I don't see how a third party doctrine can even apply if there's no third party. I am the first party. I am asking questions of Google; they are the second party, not a third party.
So does the government need a warrant to get the records from the restaurant directly? If so, why are they different from Google? If not, how is that any protection?
The complexity of the question counsels not addressing it if it isn't necessary. And, yes, this includes "I don't have to, but I will say anyway."
Would the result have been different if the defendant made a point of opening his browser, then opening a "Private Window" (or whatever non-Firefox browsers call it), and doing his search there? He obviously would have an expectation of privacy, but I'm not sure it would be seen as a reasonable expectation of privacy.
I'm guessing that 95% of people who surf the web assume that "Private Window" means that the searches are indeed private. If my 95% guess is in the ballpark, does that mean that something that is universally believed is, ipso facto, "reasonable?" Or can courts say/rule, in effect, "I don't care if 60% of Americans believe X; as a matter of law, X belief is not reasonable. I don't care if 70% believe it. I don't care if 95% believe it."
Or, is this sort of issue always a jury question, so that a jury of "reasonable people" will make the determination as to whether or not a particular defendant's belief was reasonable in that particular case?