TPRC 2024: The 52nd Research Conference on Communications, Information and Inter

Link to paper

Abstract:

The landmark 2018 US Supreme Court case Carpenter v. United States determined that a certain type of data—historical cell site location information—is protected by the Fourth Amendment and thus cannot be accessed by the government without a search warrant. At the same time, the Court asserted that this ruling was a narrow one that did not undermine the third party doctrine, which holds that a person has no reasonable expectation of privacy for information voluntarily shared with third-party actors, such as telecommunications companies.

This paper explores how the narrow yet significant Carpenter ruling can be applied to an alternative category of data: metadata, and specifically browser fingerprints. In other words, given the risks of potentially individual-level tracking using browser metadata, should browser fingerprints be protected under the Fourth Amendment, similar to cell site location information? If the government were able to access individual users’ browser fingerprints and retrieve their browsing history and other web activity, should that be considered a protected search that requires a warrant justified by probable cause?

I explore this question by tracing the evolution in case law of the Fourth Amendment from its property-based conceptualization to its more recent applications in the form of a test to determine when and where individuals can claim a reasonable expectation of privacy. In particular, I focus on how Carpenter has potentially created a new framework by which the third party doctrine can be limited in the case of exceptional categories of information—including, so far, only cell site location information but, as I argue, potentially digital metadata as well. I explore this specifically using the case of browser fingerprints, which are a category of data collected about a user’s device, such as the operating system, browser, time zone, extensions, and other properties and settings, which could be used together to uniquely identify an individual. I conclude by reflecting on the need for the Supreme Court to respond both to technological developments and to average expectations and behaviors of individuals on the internet by building on Carpenter to expand privacy rights online through Fourth Amendment protections.