The Fourth Circuit Approves Warrantless Location Tracking Via Google Apps, Misunderstands How Location Tracking Works
On May 20, 2019, a man wearing a fisherman’s hat and a traffic vest robbed a bank in Midlothian, Virginia. Unable to identify the robber, police served Google with a geofence warrant—a warrant targeting all cellphone users in a certain area at a certain time. They obtained information on several cellphones in the area of the bank at the time of the robbery, including the phone of Okello Chatrie, who was eventually identified as the culprit. Chatrie challenged the validity of the geofence warrant, arguing that it was unconstitutionally overbroad.
Last week, the Fourth Circuit held that the government didn't need to obtain a warrant at all, let alone a narrow one. Government agents could obtain anyone's historical location data from Google, as long as they did not obtain too much data—in Chatrie's case, around two hours' worth. The Fourth Circuit's opinion made two central points. The first involved the importance of surveillance duration and the very plausible idea that two hours of location surveillance are less invasive than two years of it. The second involves the claim that Chatrie voluntarily opted in to disclosing his location data to Google and thereby waived or diminished his Fourth Amendment rights, an idea that turns out to be premised on serious factual errors regarding how Google's Location History program works. I examine both of these points below, mildly disagreeing with the court's first argument and rebutting its second argument.
On the first point, the court concluded that the Google location information at issue was not especially sensitive. The government obtained only two hours' worth of data about Chatrie's location, in contrast to the more comprehensive, multi-day location information at issue in the Supreme Court's landmark 2018 decision Carpenter v. United States. Because the duration of surveillance was so short, it was incapable of providing an all-encompassing record of the target's movements and less likely to expose the details of his life.
The point is well taken, but there is more to the story. The police didn't just follow a person around for two hours. They used a technology that could trace people's movements years back into the past, and selected a two-hour window out of that vast potential store of location data. Accordingly, it is not just two hours, but entire years' worth of movements that are subject to warrantless government monitoring. The police can't monitor your whole life, but they can potentially monitor any slice of it, without a warrant.
This is still substantially less problematic than a week- or month-long session of historical location tracking. But the retrospective nature of historical location surveillance means that the police can select especially sensitive blocks of activity to monitor. As the dissent notes, nothing in the Fourth Circuit's decision would restrict police monitoring of a campus protest, or an abortion clinic, gun range, AA meeting, medical building, LGBTQ+ pride celebration, or similar gatherings via warrantless location tracking. Visits to any of these places, even those taking place several years ago, could be monitored and recorded by the police without having to bother with a warrant. Even visits to private homes could easily be monitored, as only the homeowner would have standing to challenge the search, according to the Fourth Circuit.
For these reasons, the better approach in cases involving retrospective location tracking would be to hold that such tracking is a Fourth Amendment search, presumptively requiring a warrant. That's true even in a case like Chatrie, where police sought to identify cellphone users in the area of a bank robbery and only incidentally captured a few nearby residences. The ease of obtaining a geofence warrant for legitimate investigations involving distinct crimes suggests that a warrant requirement would pose little burden on crime solving. And a warrant requirement would curtail potential government abuses of an unfettered surveillance power—like these abuses, for example.
On to the second point of the court's opinion. The Fourth Circuit concluded that Chatrie had voluntarily exposed his information to Google, and thereby lost or at least diminished his constitutional rights in it. There is an interesting debate as to whether voluntary disclosure should have any place in modern Fourth Amendment law, given that the disclosure of one’s information to other parties is inevitable in the digital age. Many scholars and judges contend that people retain Fourth Amendment rights against sensitive data surveillance by government officials notwithstanding the inevitable disclosure of their data to service providers. I have written about this debate in the context of the Chatrie case elsewhere. But the Fourth Circuit's Chatrie opinion adds little to this debate, because it is premised on several factual errors regarding how Google's Location History program works.
Essentially, the court's opinion suggests that Chatrie and users like him read Google's user agreement, decide to send Google their data so as to enjoy "extra features" like "traffic updates" and "targeted advertisements," and then opt in to location disclosure through a complex, four-step process of box checking. That is, emphatically, not how it works. In reality, users are forced to complete a permission screen during the setup of apps like Google Maps that collect location data, and the highlighted default option is to grant Google permission. Users are not informed about Google's collection practices, its potential disclosure of location data to third parties or for marketing purposes, its involvement with law enforcement, how long it stores data, etc. Users' location data is collected automatically, hundreds of times per day, even when they are asleep and even if they delete Google Maps or other location-oriented programs. And some users—including Chatrie!—were pushed into giving permission during the setup of their Android phones. That is, Google told Chatrie to turn on Location History during setup, and it warned (falsely) that his phone wouldn't work correctly if he refused. His assenting to Google's demands in this context is hardly the same as voluntarily opting in to a location history program. A rational cell phone user, told during setup that their phone won’t work properly unless they give various permissions, and then told directly by their phone to turn on those permissions for their account, will turn on the permissions. The fact that Google’s description was apparently inaccurate—according to testimony at the Chatrie trial, the setup program at issue worked fine without Location History—only makes its coercive qualities more obvious.
In this context, the court's assertion that “Chatrie voluntarily exposed his location information to Google” doesn't hold water. Some other inaccurate statements from the opinion include:
- “Location History data is obtained by a user’s affirmative act.” No it isn’t. Google collects users’ location data constantly even if the person is not using their phone, and even if they delete the app to which they gave permission.
- “Two-thirds of active Google users have not enabled Location History.” This is extremely misleading. Google disclosed to the trial court that “two-thirds” includes users who never use a location app, users who live in countries where Location History is banned, etc.
- “Location history is off by default.” No it isn’t. Users of Google apps that collect location history are forced to complete a permission screen during set up, and the highlighted default option is to grant permission.
- “Google explains that [it] regularly obtains location data from your devices.” Not in any meaningful way. This information is hidden away in a separate drop-down item that most users won’t know exists, let alone take the time to read.
This portion of the opinion is of little value because it proceeds from demonstrably inaccurate factual premises. Which is a shame, because elsewhere the opinion commendably identifies the revealing nature of data, amount of data, and voluntariness of disclosure as the most relevant parts of the Carpenter inquiry. And, as discussed above, it raises a solid if ultimately unconvincing argument about surveillance duration and retrospective location tracking.