SCOTUS finally drags geofence warrants under the Fourth Amendment

What happened

On June 29, the Supreme Court ruled that geofence warrants — the now-standard law-enforcement tool that asks Google (and a shrinking number of other location custodians) to return every device that pinged inside a defined polygon during a defined time window — are searches under the Fourth Amendment and require particularized constitutional scrutiny. The opinion, authored by Justice Kagan, draws a straight line from *Carpenter v. United States* (2018), which extended Fourth Amendment protection to cell-site location records, to the much finer-grained, much more sweeping pulls that geofences enable.

The mechanics matter, and the Court got them right. Google's historical geofence process ran in three tranches: first, an anonymized list of device IDs inside the box; second, a narrowed list with expanded location context to let investigators rule devices in or out; third, the de-anonymized account information for the survivors. The government has long argued that the first tranche is anonymous and therefore not a search, that the second is voluntary cooperation, and that only the third implicates the Fourth Amendment. The Court rejected the whole pipeline as a single search, and a particularly invasive one, because the initial dragnet by definition includes everyone present — protesters, churchgoers, people walking their dog past a crime scene — not just suspects.

Google, notably, had already started winding the program down. In late 2023 it moved Location History on-device by default, meaning the company increasingly cannot answer a geofence warrant even if served one. The ruling is partly a legal blessing of an architectural decision the largest custodian had already made for itself.

Why it matters

The doctrinal piece is that *Carpenter* is no longer a one-off. For seven years, lower courts have been split on whether *Carpenter* was a narrow holding about a specific 1986 statute or a general principle that the third-party doctrine breaks down once data becomes sufficiently revealing. Kagan's opinion treats it as the principle, and that quietly reshapes the constitutional surface area for every product that touches continuous location, biometric, or behavioral telemetry. Justice Kagan cites the *Riley* line on phones being "such a pervasive and insistent part of daily life," and the citations — actual citations, with URLs, which the HN thread noticed approvingly — give lower courts something concrete to build on instead of vibes.

The split is interesting and worth reading carefully. Alito and Thomas dissented, which is the expected map. Barrett joining the minority is the surprise, and her concurrence-in-part suggests her objection is methodological (she'd prefer to resolve this on narrower grounds about the specific warrant rather than the entire technique) rather than a vote for unlimited dragnet authority. Treat the 6-3 headline accordingly; the practical floor here is probably higher than the vote count implies.

The harder question, and the one the opinion deliberately doesn't answer, is what happens to everyone who isn't Google. Geofence warrants were always a sideshow next to the location-data commercial market, where Fog Reveal, Babel Street, Venntel and a dozen ad-tech resellers sell device-level location histories to police departments with no warrant, no judge, and no notice. One HN commenter put it cleanly: "If it is reasonable to have your privacy in a public place, does this mean that products like Flock which indiscriminately violate your privacy would now require a warrant?" The opinion doesn't say. It also doesn't have to — but the reasoning, especially the Carpenter-style framing that aggregated location is qualitatively different from any single data point, is going to be cited in every motion to suppress filed against purchased-data evidence for the next decade.

The community's other useful reference point was the Petraeus affair: the FBI identified Paula Broadwell without a phone at all, by correlating three IPs to three hotels and then pulling guest lists. That's the steady-state reality. Narrowing one technique doesn't narrow the surveillance surface; it just routes investigators to the next-cheapest substitute. If geofence becomes warrant-required and Google is largely out of the business anyway, expect a hard pivot to ad SDK exhaust, license-plate-reader networks, and Ring-style doorbell footage requests — none of which this opinion touches.

What this means for your stack

If you ship anything that retains user location at meaningful precision — fitness, mapping, dating, delivery, on-call paging, fleet, any "nearby" feature — the legal calculus on your retention policy just changed. "We respond to lawful process" used to be a defensible neutral stance. Post-ruling, the floor is rising: warrants for stored location data will require particularity that reverse-location-by-design fundamentally cannot supply, which means the cleanest engineering answer is the one Google already chose: don't be the custodian. Move location history client-side, encrypt server-side aggregates so you literally cannot produce a per-user trail, and document the architecture publicly so it's defensible in court and in a transparency report.

If you're an ad-tech or location-SDK vendor, the warrant rule doesn't reach you yet, but the discovery posture in civil and criminal cases is about to get ugly. Plaintiffs and defendants both now have a Supreme Court opinion describing aggregated location as constitutionally sensitive; expect that language in every motion to compel against your data-broker customers, and expect at least one state AG to test whether selling the same data police would now need a warrant for is a UDAP violation. Pricing in legal risk on the data side, not just the inference side, is overdue.

For security and platform engineers more broadly, the practical hygiene is the boring stuff that's been right all along: minimize retention windows, prefer on-device computation, log access to sensitive stores, and treat any "reverse lookup by attribute" API (location, face, gait, IMEI, MAC) as a liability surface rather than a feature. The Court has effectively said that systems designed to answer "who was here" are different in kind from systems designed to answer "where was this person" — and the former is the one that now needs probable cause.

Looking ahead

The interesting case isn't the next geofence appeal, which will mostly be about good-faith exceptions for warrants already served. The interesting case is the first motion to suppress evidence that police bought from a commercial location broker, citing this opinion's reasoning about aggregated location. That motion is going to be filed within a year, probably in a federal district that already leans skeptical on third-party doctrine, and how it lands will determine whether *Carpenter*'s second decade is the one where the constitutional protections finally catch up to the actual surveillance economy — or whether "we just bought it" remains the loophole that swallows the rule.