SCOTUS kills the geofence dragnet: your location data is now a search

What happened

On June 29, 2026, the US Supreme Court ruled that geofence warrants — the reverse-search warrants that ask a provider to identify every device present inside a geographic polygon during a time window — implicate the Fourth Amendment and require particularized probable cause, not the boilerplate "investigative interest" affidavits that have powered them since 2016. The decision resolves a split between the Fourth and Fifth Circuits, the latter of which had ruled in *United States v. Smith* (2024) that geofence warrants were categorically unconstitutional general searches.

The case reached SCOTUS after lower courts wrestled with what to do when law enforcement, instead of asking "where was this suspect?", asked "who was here?" — a query structure that inverts the entire premise of particularity. The Court's majority held that the act of compelling a provider to query its entire user base against a geographic constraint is itself a search, regardless of whether the resulting identifiers are later narrowed. That holding closes the third-party-doctrine workaround that had let prosecutors argue geofence data was just business records voluntarily shared with Google.

Google had already seen this coming. In December 2023 it announced it was moving Location History on-device and shutting down Sensorvault, the centralized store that had received an estimated 11,554 geofence warrants in 2020 alone — roughly a quarter of all US warrants served on the company that year. By late 2024 the legacy store was effectively gone. The ruling now binds every other custodian of fine-grained location data, which turns out to be a much larger set than most engineers realize.

Why it matters

The surface-level read is "good news for civil liberties." The deeper read, for anyone building software, is that a category of data your product probably collects has just been re-classified as constitutionally sensitive. Geofence warrants worked because providers could execute them: the data was centralized, indexed by location, and queryable in reverse. Any architecture that supports those three properties is now sitting on a compliance liability that did not exist 48 hours ago.

The ruling does not require deletion, encryption, or any specific technical mitigation — but it changes the calculus of *holding* this data at all. A warrant that arrives at your startup tomorrow demanding "all users within 200m of [address] between 14:00 and 16:00" can no longer be quietly fulfilled. You'll need counsel, you'll likely need to push back on the warrant's particularity, and you'll be doing this with a small legal budget against prosecutors who have done it hundreds of times. Google could afford the friction. Most companies cannot.

The EFF's Andrew Crocker, who filed an amicus brief, called the decision "the most important Fourth Amendment ruling of the decade for digital privacy." That's the kind of quote that gets framed in lobbies, but it's also defensible. *Carpenter v. United States* (2018) brought historical cell-site location under Fourth Amendment scrutiny; *Riley v. California* (2014) did the same for phone contents. Geofence warrants were the last major mass-surveillance technique still operating in a doctrinal vacuum, and that vacuum is now filled.

Community reaction on Hacker News (494 points, currently #1) split along predictable lines. The civil liberties contingent treated the ruling as overdue. A smaller faction pointed out that the Court left the door open for narrowly-scoped geofence warrants — the ruling requires particularity, not abolition — which means a warrant for a specific suspect's likely location at a specific time can probably still be served. The doctrinal change is from "who was in this polygon?" to "was this specific person in this polygon?", which is a much smaller set of queries and a much higher evidentiary bar.

There's also a less-discussed angle around ad-tech. The decision's logic — that compelling a query across an entire user base is itself a search — has obvious extensions to the data brokers who sell aggregated location feeds derived from SDK callbacks. The Court didn't reach that question, but the next case in the pipeline almost certainly will. Companies like X-Mode, Veraset, and the surviving fragments of the location-data industry are about to discover that their B2B sales motion has constitutional exposure.

What this means for your stack

If you ship a mobile app that requests location permission, audit what you actually retain. Coarse location collected for a legitimate product reason (delivery radius, weather, store locator) becomes a different liability when it's stored server-side, timestamped, and indexed. The ruling doesn't make that storage illegal, but it makes it discoverable in a way that now comes with legal cost. "Minimize retention" stops being a vague best practice and becomes a defensible litigation posture.

For backend teams, this is the moment to look at your location tables the way you looked at PII tables after GDPR. Three questions: (1) Can you answer reverse-geographic queries at all? If yes, can that capability be removed without breaking the product? (2) What's your retention window? Anything beyond 30 days is hard to justify for most use cases and now carries warrant exposure. (3) Do you have a written process for handling warrants, including a default of demanding particularity? "We forwarded the request to engineering" is not a process.

For anyone running a B2B SaaS that touches location — fleet management, field service, logistics, last-mile — your customers are now your liability vector. A warrant served on you can compel disclosure about *their* users. Your DPA needs language about warrant notification, and your architecture should make narrow responses possible. If the only query you support is "give me everyone within X meters of Y," you've built a Sensorvault for a market segment, and the same legal forces that dismantled Google's are now pointed at you.

Looking ahead

The immediate aftermath will be procedural: defense attorneys with pending cases involving geofence evidence will file motions to suppress, and we'll get a year of lower-court rulings on what "particularity" means in practice. The longer arc is architectural. The privacy-preserving design patterns that have been academic curiosities — on-device processing, differential privacy, encrypted-at-rest with provider-blind queries — just acquired a legal-defense value proposition that complements the existing privacy and PR ones. Apple's on-device Maps approach and Google's 2023 Location History migration look less like principled stances and more like correct reads of where the law was heading. Expect a wave of vendor pitches in the next 18 months selling "warrant-resistant by design" as a feature. Some of them will even mean it.