Third-party doctrine
Based on Wikipedia: Third-party doctrine
In 1979, a man named Smith in Maryland called his house from a payphone to report a burglary. The police, without a warrant, asked the phone company for the numbers he had dialed. The Supreme Court later ruled that because Smith voluntarily handed those numbers over to the telephone company, he had no reasonable expectation of privacy in them. This ruling, Smith v. Maryland, crystallized a legal concept known as the third-party doctrine: the idea that when you share information with a bank, a phone carrier, or an internet provider, you surrender your constitutional shield against government search and seizure for that data. For decades, this precedent allowed law enforcement to bypass the Fourth Amendment's core requirement of probable cause, simply by asking the middleman for what the citizen had already given them.
The doctrine rests on a fragile assumption: that "voluntarily" sharing information means you have waived your right to keep it private from the state. But in an era where life is inextricably linked to digital platforms, this legal fiction has begun to crack under the weight of reality. The question is no longer whether we share data with third parties; it is whether we can function without them. The tension between the 18th-century text of the Fourth Amendment and the 21st-century architecture of human interaction has created a battleground where privacy is not just eroded, but legally redefined as non-existent for vast swathes of our daily lives.
The Architecture of Surrender
To understand the third-party doctrine, one must first understand what it was designed to replace, and why it survived so long. The Fourth Amendment, ratified in 1792, promised that the people would be secure against unreasonable searches and seizures. It demanded a warrant based on probable cause for any intrusion into "persons, houses, papers, and effects." For nearly two centuries, this was interpreted physically. If the police wanted to look inside your house or read your physical letters, they needed a judge's signature.
The landscape shifted dramatically in 1967 with Katz v. United States. In that case, Charles Katz used a public phone booth to transmit gambling information. The FBI placed an electronic listening device on the outside of the booth without a warrant. The Supreme Court ruled this was a violation of the Fourth Amendment, establishing the "reasonable expectation of privacy" test. Justice Potter Stewart famously wrote that the Fourth Amendment protects people, not places. If you seek to preserve something as private, even in a public area, the Constitution guards it.
This seemed like a victory for the digital age before the digital age truly arrived. Congress responded by passing the Omnibus Crime Control and Safe Streets Act of 1968, specifically Title III, known as the "Wiretap Act." This was an attempt to extend Fourth Amendment-like protections to telephonic communications, acknowledging that modern life required more than just physical trespass laws to protect privacy.
But the court pulled back from this expansion almost immediately in the following decade. The logic of Katz collided with a new judicial philosophy regarding commerce and disclosure. In 1976, in United States v. Miller, the Court ruled that a bank customer had no reasonable expectation of privacy in their financial records held by the bank. The reasoning was stark: checks, deposit slips, and loan applications were business records voluntarily conveyed to the bank for a specific purpose. By handing them over, Miller had assumed the risk that the bank might share them with the government.
Two years later, Smith v. Maryland applied this same logic to telephone calls. The Court argued that when Smith dialed his number, he voluntarily conveyed it to the phone company to complete the call. He knew the company used switches and recording equipment to route the call; therefore, he assumed the risk that the company would reveal those numbers to the police. This created a hard line: information shared with a third party is no longer "private" in the eyes of the law. The government could access it without a warrant, bypassing the probable cause requirement entirely.
"A person has no legitimate expectation of privacy in information he voluntarily turns over to third parties." — Smith v. Maryland, 1979
This precedent was not merely a legal technicality; it was a fundamental restructuring of civil liberty in exchange for convenience. It assumed that the relationship between an individual and their bank or phone company was transactional and limited. In the analog world, this held some water. You walked into a bank once a month to deposit a check. The paper trail was sparse. But as society migrated online, the "third party" became the infrastructure of daily existence.
The Digital Erosion
By 1986, Congress recognized that the Miller and Smith rulings were insufficient for the emerging digital age. They passed the Electronic Communications Privacy Act (ECPA), which updated the Wiretap Act and created a new statute known as the Stored Communications Act (Title II of the ECPA). This law attempted to create a tiered system of protection, acknowledging that emails stored on servers might need different rules than live wiretaps. However, it stopped short of fully overturning the third-party doctrine for stored data or metadata.
The gap between the law and technology widened into a chasm in the 2010s. The third-party doctrine was built on the idea that sharing information with a third party is a limited, voluntary act. In the digital age, however, sharing data is often mandatory to participate in society. You cannot use a map without giving your location to Google or Apple. You cannot pay for groceries without sending transaction data to a bank and a credit card processor. You cannot communicate without a phone carrier routing your signal.
The human cost of this legal framework became starkly apparent when the doctrine was applied to cell site location information (CSLI). In 2012, in United States v. Graham, a Maryland district court held that historical CSLI—data showing where a phone tower a device connected to over time—was not protected by the Fourth Amendment. The court reasoned that because this data was voluntarily shared with the cell carrier, it fell squarely under the third-party doctrine.
This ruling meant that law enforcement could reconstruct a person's movements for months or years without a warrant. They could see where you slept, where you worked, which churches you attended, and who you visited. The court viewed this as just another set of business records, akin to bank statements. But the reality was far more invasive. It was a continuous, automated surveillance log generated not by the user's intent to share, but by the mere act of turning on a device.
The judicial system began to sense the disconnect. In 2012, Associate Justice Sonia Sotomayor wrote a concurring opinion in United States v. Jones, a case involving police placing a GPS tracker on a suspect's car without a warrant. While she agreed with the majority that the physical attachment of the tracker was a search (a trespass), she took the opportunity to question the third-party doctrine itself.
"More fundamentally, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks." — Justice Sonia Sotomayor
Sotomayor's warning was prophetic. She recognized that the concept of "voluntary" disclosure had become meaningless when the alternative to disclosure was social isolation or economic exclusion. To say a person "voluntarily" gives up their location data is like saying a fish voluntarily gives up its water; it is simply the medium in which they exist.
The Carpenter Shift and Its Limits
The breaking point came in 2018 with Carpenter v. United States. Timothy Carpenter had been convicted of armed robbery based largely on cell phone location data obtained by the FBI without a warrant. The government had used the Stored Communications Act to compel T-Mobile to hand over months of CSLI, arguing that under Smith and Miller, they needed no judicial approval.
The Supreme Court, in a narrow 5-4 decision, rejected this argument. Chief Justice John Roberts, writing for the majority, declared that cell phones are "almost a feature of human anatomy." The court ruled that obtaining historical cell site location data required a warrant based on probable cause. This was a seismic shift. For the first time, the Court explicitly carved out an exception to the third-party doctrine, acknowledging the unique nature of digital surveillance.
"When the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone's user." — Carpenter v. United States, 2018
The Court recognized that CSLI provided an "all-encompassing record" of a person's life. It revealed not just movement, but intimate associations: familial, political, professional, religious, and sexual. The majority opinion understood that the sheer volume and sensitivity of this data meant it could not be treated the same as a single bank check or a dialed phone number from 1979.
However, the Carpenter decision was also a compromise. It did not overturn the third-party doctrine; it limited it. The ruling was specific to cell site location information. It left open whether other types of digital data—emails, search histories, cloud storage files—were similarly protected. The legal landscape remained fractured. In some jurisdictions, the third-party doctrine still applied with full force to any data stored in the cloud or processed by a third party.
The limitations of Carpenter were tested almost immediately. In 2019, Utah passed the Electronic Information or Data Privacy Act, becoming one of the few states to explicitly require a warrant for accessing private information held by third parties, effectively rejecting the federal doctrine at the state level. This patchwork of laws meant that privacy rights depended heavily on geography and the specific type of data in question.
New Frontiers: Cryptocurrency and Geofence Warrants
As law enforcement adapted to Carpenter, they sought new avenues for warrantless surveillance, often targeting emerging technologies where the legal precedents were even less clear. In 2020, the Fifth Circuit Court of Appeals ruled in United States v. Gratkowski that transaction data involving virtual currencies like Bitcoin was akin to bank records and not subject to Fourth Amendment protections. The court held that because users voluntarily shared this information with cryptocurrency exchanges, the third-party doctrine applied fully. This decision effectively left the financial privacy of cryptocurrency users vulnerable to government access without a warrant, treating digital ledgers no differently than paper checks from the 1970s.
The tension between old doctrine and new technology reached a fever pitch in 2024 with United States v. Smith in the Fifth Circuit. This case involved "geofence warrants," a controversial tool where law enforcement asks tech companies like Google to provide location data for all devices within a specific geographic area during a specific time window, effectively creating a digital dragnet.
The court in Smith recognized that the location history shared with Google was functionally identical to the CSLI protected in Carpenter. They ruled that a warrant based on probable cause and particularized suspicion was required to obtain this data from Google. This was a significant victory for privacy advocates, acknowledging that the "voluntary" nature of using Google Maps or Android devices did not strip users of their Fourth Amendment rights against broad surveillance.
Yet, even in this victory, the shadow of the third-party doctrine loomed large. The court held that the geofence warrant used by law enforcement was inadequate because it failed to meet the particularity requirement of the Fourth Amendment. However, the court then applied the "good faith exception" to the exclusionary rule. This legal principle allows evidence obtained in violation of the Constitution to be used if the police acted in good faith reliance on a statute or warrant that they believed to be valid at the time.
The result was a paradoxical outcome: the court admitted that the search was unconstitutional and that the fourth amendment required a warrant, yet still allowed the convictions to stand because the officers had followed the procedures available to them under existing law. This highlights the enduring power of the third-party doctrine's legacy; even when courts acknowledge the need for reform, the legal mechanisms for excluding evidence remain weakened by judicial deference to law enforcement practices that were once deemed constitutional.
The Human Reality of Data Surrender
The abstract legal battles over the third-party doctrine have profound implications for ordinary citizens. When the law assumes you have no privacy in data shared with third parties, it fundamentally alters the relationship between the individual and the state. It transforms the citizen from a rights-bearing subject into an open book, accessible to any agent of the government who knows which middleman to call.
Consider the intimacy of modern life. A person's location history reveals their medical visits (a specific doctor's office), their political leanings (attendance at a rally or a candidate's event), and their religious devotion (time spent in places of worship). Under the third-party doctrine, as it was applied for decades, this information could be accessed without a judge ever weighing in. The government could build a profile of a person's life without ever proving probable cause that they had committed a crime.
The "voluntary" nature of this disclosure is a legal fiction that ignores the coercive reality of modern infrastructure. One does not truly choose to share location data with a cell carrier if the alternative is losing access to emergency services, banking, employment, and social connection. The third-party doctrine relies on a definition of consent that is increasingly detached from human experience. It treats complex digital ecosystems as simple commercial transactions, ignoring the power imbalance between the individual and the massive corporations (and by extension, the government) that hold their data.
The evolution of this doctrine from Miller to Carpenter and beyond suggests a slow, painful realization within the judiciary. The courts are beginning to understand that the "reasonable expectation of privacy" must evolve alongside technology. When a tool becomes ubiquitous enough to be considered a "feature of human anatomy," the legal rules governing its data must change. Yet, the pace of this evolution is glacial compared to the speed at which surveillance capabilities advance.
Every day, new forms of data are generated—biometric information from smartwatches, browsing history from internet service providers, voice recordings from smart home assistants. The third-party doctrine remains a gaping hole in the constitutional shield for all of it. Unless and until the Supreme Court fully revisits or overturns the premise that shared data equals waived privacy, millions of Americans will remain vulnerable to warrantless searches disguised as routine business transactions.
A Doctrine in Crisis
The story of the third-party doctrine is a story of a legal framework struggling to keep up with the world it was meant to regulate. Born in an era where sharing information required physical effort and limited scope, it now governs an environment where data flows automatically and continuously. The Supreme Court's recent decisions in Carpenter and Smith offer glimmers of hope, suggesting that the judiciary is finally willing to acknowledge the depth of digital surveillance.
But these are exceptions, not the rule. In the vast majority of cases involving financial records, email metadata, or cloud storage, the old logic still holds sway. The government can still request this information without a warrant, relying on the argument that you gave it away when you opened an account or sent an email. The burden is on the individual to prove they had an expectation of privacy in data that was voluntarily turned over to a third party—a task made nearly impossible by the sheer ubiquity of digital life.
The path forward requires more than narrow rulings; it demands a fundamental reimagining of what privacy means in the 21st century. It requires acknowledging that in a world where we cannot live without our devices, "voluntary" disclosure is a myth. The Fourth Amendment was designed to protect the sanctity of the individual against the power of the state. If that protection is to survive the digital age, the third-party doctrine must be dismantled, not just tweaked.
Until then, the legacy of Smith and Miller persists, a quiet erosion of civil liberty occurring in server rooms and data centers, far removed from the public eye but intimately connected to every click, call, and transaction made by millions of people. The law lags behind reality, but as Justice Sotomayor warned, it is time to reconsider the premise that has allowed this gap to widen for nearly half a century. The digital age demands a new understanding of privacy—one that recognizes that sharing data with a third party should not mean surrendering one's constitutional rights forever.