A 1791 Rule Against a 21st-Century Problem
The Fourth Amendment was written to stop British officers from ransacking colonial homes with open-ended warrants. It restrains the government, not private companies, and for its first 140 years courts read it to cover only physical intrusion on physical property. Every case below is a court or a Congress deciding whether a new way of watching people counts as a search that needs a warrant, or something the government may do freely.
The Fourth Amendment, ratified December 15, 1791 as part of the Bill of Rights, declares that the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures shall not be violated, and that warrants must be supported by probable cause and describe the place to be searched and the things to be seized. It was a direct response to the writs of assistance used by British customs officers in colonial America, open-ended search warrants that let officials enter any home or shop looking for smuggled goods. James Otis argued against the writs in a Boston courtroom in 1761, and John Adams, who watched, later wrote that American independence was born in that room.
For most of the next 140 years, courts read the amendment literally: it protected physical places and tangible property from physical intrusion. A search meant an officer walking into a house or opening a trunk. Nothing in the 1791 text anticipated the telephone, the automobile, the computer, or a private company holding a detailed record of where a person goes and whom they talk to.
That gap between an 18th-century text and 21st-century technology is the central problem of modern privacy law. Every case in this timeline is a court or a Congress trying to decide whether a new way of watching people counts as a search that needs a warrant, or something the government can do freely.
The amendment restrains government, not private companies. A store, an app maker, or a data broker collecting information about a person is generally governed by consumer-protection and contract law, not the Fourth Amendment, which is why so much modern surveillance runs through private intermediaries.
Roy Olmstead ran a large bootlegging operation in Seattle during Prohibition. Federal agents tapped the phone lines running from his house and office without ever setting foot on his property, and used the recorded calls to convict him. The Supreme Court, in a 5-4 decision written by Chief Justice William Howard Taft, held that this was not a search or seizure at all. The Fourth Amendment, the majority reasoned, protected material things, and the agents had not physically entered Olmstead's property or seized any tangible object, only overheard conversations traveling along wires outside.
Justice Louis Brandeis dissented in what became one of the most quoted opinions in American law. He argued that the framers had conferred, as against the government, the right to be let alone, the most comprehensive of rights and the right most valued by civilized men, and that the amendment's principles had to adapt to new technology or become meaningless. Justice Oliver Wendell Holmes, also dissenting, called warrantless wiretapping dirty business.
Olmstead set the rule for nearly four decades: government eavesdropping that involved no physical trespass raised no constitutional problem. Congress partially filled the gap in 1934 by making it a federal crime to intercept and disclose wire communications, but that statute was widely evaded and rarely enforced against the government.
The decision is now studied mainly as a mistake that took 39 years to correct. It stands as the classic example of a court reading the Fourth Amendment so narrowly that a powerful new surveillance method fell entirely outside it.
The FBI suspected Charles Katz of transmitting illegal gambling bets by telephone from a public phone booth in Los Angeles. Agents taped a microphone to the outside of the booth and recorded his end of the calls, again without physically entering the booth. The Supreme Court, 7-1, threw out the evidence and overruled Olmstead's trespass rule. Justice Potter Stewart wrote that the Fourth Amendment protects people, not places, and that what a person seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.
The lasting test came from Justice John Marshall Harlan's concurrence. A search occurs, he wrote, when the government intrudes on an expectation of privacy that a person actually holds and that society is prepared to recognize as reasonable. That two-part reasonable expectation of privacy standard has governed Fourth Amendment law ever since, and every dispute about new surveillance technology is now argued in its terms.
Katz was a major expansion of privacy protection, but it carried a built-in weakness. If the question is whether an expectation of privacy is one society accepts as reasonable, then as surveillance becomes more common and more expected, the zone of protection can shrink. Courts have wrestled with that circularity for decades.
The year after Katz, Congress passed the Wiretap Act, Title III of the Omnibus Crime Control and Safe Streets Act of 1968, which required police to obtain a special court order, based on probable cause and a showing that other investigative methods had failed, before intercepting phone calls. It remains the framework for lawful wiretaps today.
In United States v. Miller (1976), the Supreme Court held that a bank customer had no Fourth Amendment interest in his own deposit slips and checks once the bank held them, because he had voluntarily conveyed that information to the bank in the ordinary course of business. Three years later, Smith v. Maryland (1979) extended the idea to the telephone. Police asked the phone company to install a pen register, a device recording every number dialed from Michael Smith's home line. The Court, 5-3, held this was not a search: Smith had voluntarily turned those numbers over to the phone company to complete his calls, and so had no reasonable expectation of privacy in them.
Together these two cases created the third-party doctrine: information a person shares with a business generally loses constitutional protection, and the government can obtain it with a subpoena or court order far weaker than a warrant, or sometimes with no court process at all. The doctrine made sense in a world where the relevant records were a stack of canceled checks and a list of phone numbers.
In the decades since, almost every detail of modern life has been routed through a third party: emails sit on Google's servers, location is logged by a wireless carrier, purchases are recorded by a payment processor, web browsing is tracked by advertising networks, and daily movement is captured by app developers. Read broadly, the third-party doctrine would place nearly all of it outside the Fourth Amendment.
Justice Sonia Sotomayor questioned the doctrine directly in a 2012 concurrence, writing that it is ill suited to the digital age and that it may be necessary to reconsider the premise that a person has no privacy interest in information voluntarily disclosed to third parties. That reconsideration began in earnest with Carpenter in 2018.
By the mid-1980s, email, pagers, and computer networks existed but fell into a legal gray zone, protected by neither the Wiretap Act nor any clear rule. The Electronic Communications Privacy Act of 1986 extended interception protections to electronic communications and added the Stored Communications Act, which set rules for government access to messages and records held by service providers.
The Stored Communications Act drew a distinction that has aged badly. Email stored on a server for 180 days or less generally required a warrant, but email older than 180 days, or email that had already been opened, could be obtained with only a subpoena or a court order issued on a showing well below probable cause. In 1986, when storage was expensive and people downloaded mail to their own computers, the assumption was that anything left on a server for months was effectively abandoned.
Today people keep decades of correspondence in cloud accounts by default. In United States v. Warshak (2010), the Sixth Circuit held that email content is protected by the Fourth Amendment and requires a warrant regardless of age, and the Justice Department has said it follows that rule nationally, but the outdated statutory text has never been amended by Congress despite repeated bipartisan bills.
The same law governs access to many other records held by providers, including subscriber identity, billing records, and the addresses a person communicates with, most of which remain available to investigators without a warrant under the third-party framework.
Passed six weeks after the September 11 attacks, the USA PATRIOT Act broadened the government's surveillance authorities across the board. It expanded the reach of National Security Letters, administrative demands the FBI can issue on its own authority for customer records, and it broadened Section 215 of the Foreign Intelligence Surveillance Act, the so-called business records provision, to let the government seek any tangible things relevant to an intelligence investigation through the secret Foreign Intelligence Surveillance Court.
It also authorized roving wiretaps that follow a person across devices, lowered barriers between intelligence and criminal investigators, and expanded the use of pen registers and trap-and-trace devices for internet communications. Supporters described these as modernizations; civil-liberties groups warned that the standards were too low and the oversight too weak.
Much of the Act was written with sunset dates, forcing Congress to revisit and re-authorize the authorities periodically. Those debates, in 2005, 2006, 2011, 2015, and 2020, became the recurring venue for fighting over the balance between security and privacy.
The full significance of the Section 215 expansion did not become public until 2013, when it was revealed that the government had secretly interpreted relevant to all to mean it could collect essentially every American's domestic phone records in bulk.
Police suspected Antoine Jones of drug trafficking and, without a valid warrant, attached a GPS device to the undercarriage of his wife's Jeep, tracking its every movement for 28 days. The Supreme Court unanimously held that this was a search. Justice Antonin Scalia's majority opinion rested on the oldest idea in Fourth Amendment law: the government had physically trespassed on Jones's property, the vehicle, to gather information, and that alone made it a search.
Two concurrences reached further. Justice Samuel Alito, joined by three others, argued that the trespass was beside the point and that the real intrusion was the long-term monitoring itself. Society, he wrote, does not expect that anyone will secretly track every trip a person makes over a month. Justice Sotomayor agreed and added her warning about the third-party doctrine.
Counting the concurrences, five justices signaled that prolonged, comprehensive location tracking implicates the Fourth Amendment even without any physical trespass. That idea, sometimes called the mosaic theory, holds that aggregating many individually unrevealing data points can produce a detailed and constitutionally significant picture of a life.
Jones did not resolve how that principle applies to tracking done through phones and records rather than a physical device, but it set up the question the Court answered six years later in Carpenter.
For decades, police could search the contents of items found on a person during a lawful arrest, a wallet, a cigarette pack, an address book, without a separate warrant. When that rule was applied to smartphones, two cases reached the Supreme Court. In a unanimous 2014 decision written by Chief Justice John Roberts, the Court held that officers generally must get a warrant before searching data on a cell phone seized incident to an arrest.
The reasoning was that phones are different in kind, not just degree. A modern phone, Roberts wrote, holds the privacies of life: years of messages, photos, location history, browsing records, health data, and financial information, far more than any physical container could. Calling a phone search comparable to emptying someone's pockets, he said, is like saying a ride on horseback is materially indistinguishable from a flight to the moon.
Riley was a strong signal that the Court was willing to treat digital data categorically differently from physical objects, and that the sheer quantity and sensitivity of information now carried on a personal device changes the constitutional analysis.
It directly shaped Carpenter four years later and is regularly cited in disputes over border device searches, phone unlocking, and access to cloud backups.
In June 2013, documents provided by former National Security Agency contractor Edward Snowden revealed that the agency was collecting the telephone metadata of essentially every American, the numbers, times, and durations of calls, in bulk, under the secret Section 215 interpretation. Other disclosures described PRISM, a program collecting internet communications from major US technology companies under Section 702 of the Foreign Intelligence Surveillance Act.
The revelations set off the most significant surveillance debate since the 1970s. In 2015, the Second Circuit Court of Appeals ruled in ACLU v. Clapper that the bulk phone-records program had never been authorized by the text of Section 215. A panel appointed by President Obama concluded the program had not been essential to preventing any attack.
Congress responded with the USA FREEDOM Act of 2015, which ended bulk collection of phone records by the government. Instead, the NSA would have to submit specific selection terms to the phone companies, which retain the records, and get targeted results. The law also created a panel of outside experts who can be appointed to argue the privacy side before the otherwise one-sided Foreign Intelligence Surveillance Court, and required more declassification of that court's significant opinions.
The Section 215 call-records authority was allowed to lapse entirely in 2020 after the NSA acknowledged persistent overcollection problems and said the program was no longer worth the trouble. Section 702, which targets foreigners abroad but incidentally sweeps in Americans' communications, remained and was reauthorized in April 2024; that reauthorization lapsed on June 12, 2026, though collection continues under court-approved certifications that run to March 2027.
Timothy Carpenter was convicted of a series of armed robberies in Michigan and Ohio partly on the basis of 127 days of cell-site location information that his wireless carriers turned over on a court order weaker than a warrant. Those records placed his phone near the robbery locations. The Supreme Court, 5-4, in an opinion by Chief Justice Roberts, held that the government generally must get a warrant to obtain that kind of historical location data.
The Court held that a person retains a legitimate expectation of privacy in the record of their physical movements as captured through cell-site records, even though a third party, the carrier, creates and holds them. Tracking a phone, Roberts wrote, achieves near-perfect surveillance, as if the government had attached an ankle monitor to the user, and the records are not truly shared voluntarily because carrying a phone is indispensable to modern life.
Carpenter was the first real limit the Court placed on the third-party doctrine, and it explicitly drew on both Jones, for the idea that comprehensive location tracking is different, and Riley, for the idea that digital data is different. The majority stressed that the decision was narrow and did not disturb conventional subpoenas for business records, real-time tower data in emergencies, or security-camera footage.
Lower courts have since spent years arguing over how far Carpenter reaches: whether it covers a few hours rather than a week of location data, tower dumps, real-time pings, license plate reader databases, and location data bought from brokers. Those fights are still unresolved.
Two lines of dispute now define the frontier. The first is the geofence warrant, a demand that a company, almost always Google, identify every device present in a drawn geographic area during a time window, so investigators can work backward to a suspect. In August 2024 the Fifth Circuit Court of Appeals held in United States v. Smith that geofence warrants are unconstitutional general warrants because they search everyone in an area with no individual suspicion, while the Fourth Circuit, ruling en banc in United States v. Chatrie in April 2025, held that a defendant had no Fourth Amendment interest in a short window of Google location data. The Supreme Court resolved the split in Chatrie v. United States on June 29, 2026, holding 6-3 that obtaining location data through a geofence warrant is a Fourth Amendment search, while leaving open how narrowly such warrants must be drawn. In late 2024 Google finished moving its Location History feature so the data is stored on each user's own device, which the company said would largely end its ability to answer geofence demands at all.
The second dispute is bought data. Agencies including Immigration and Customs Enforcement, Customs and Border Protection, the Internal Revenue Service, the Defense Intelligence Agency, and the FBI have purchased Americans' location trails and other records from commercial data brokers, obtaining through a credit card what the Fourth Amendment would otherwise require a warrant to collect. In June 2023 the Office of the Director of National Intelligence declassified a report acknowledging that this commercially available information can be as revealing as traditional intelligence techniques and raises significant issues that current policy does not fully address.
Congress has repeatedly tried and failed to close the gap. The Fourth Amendment Is Not For Sale Act, which would bar the government from buying data it would need a warrant to seize, passed the House 219-199 in April 2024 with support from 123 Republicans and 96 Democrats, but the Senate did not take it up.
Meanwhile the technology keeps spreading. Automated license plate readers, doorbell-camera networks, face recognition, and pole-mounted cameras feeding police real-time crime centers have moved into thousands of ordinary towns, most of them adopted without a public vote and operating with no specific statute governing how long the data is kept or who may search it.
The Supreme Court has redrawn the line between lawful surveillance and an unconstitutional search at least four times since 1928, usually years after the technology in question was already in widespread use.
The Tools That Watch Ordinary People
Most modern tracking is not a wiretap on a suspect. It is a standing system that records nearly everyone: cameras that log every passing license plate, devices that impersonate cell towers, warrants that ask a company for everyone in an area, face-recognition databases built by scraping social media, and a data-broker industry that sells the location trails of people suspected of nothing. Each entry explains how the tool works, who runs it, and where the law stands.
An automated license plate reader, or ALPR, is a camera system that photographs every passing vehicle, reads the plate with optical character recognition, and records the plate number along with the date, time, GPS coordinates, and a photo. Many systems also log a vehicle fingerprint: make, color, body type, roof racks, bumper stickers, and other distinguishing features, so a car can be searched for even when the plate is not visible. The cameras are mounted on poles, traffic signals, and highway gantries, or on patrol cars that scan parked and moving traffic as they drive.
Flock Safety, founded in 2017, is the fastest-growing vendor. The company says its cameras operate in more than 5,000 US communities across dozens of states, with a nationwide fleet approaching 90,000 cameras. Older vendors including Motorola Solutions, through its Vigilant Solutions unit, and Rekor operate large commercial databases as well. Retention periods are set by contract and commonly run about 30 days, though some agencies keep data far longer, and Vigilant's commercial database has historically retained billions of scans for years.
The privacy concern is not any single scan but the aggregate. A dense network records the movements of everyone who drives through it, overwhelmingly people suspected of nothing, and many systems let agencies in one town search data collected by agencies in other towns and states through shared networks and hot lists. Reporting by the Associated Press and the outlet 404 Media has documented officers running searches for personal reasons and out-of-state agencies querying local cameras.
Courts are beginning to respond. In 2024 the Institute for Justice sued Norfolk, Virginia, arguing that its network of more than 170 Flock cameras amounts to a warrantless dragnet that violates the Fourth Amendment, and appellate and state supreme courts in Massachusetts, Virginia, and elsewhere have started to question prolonged ALPR tracking under Carpenter. During 2025 and 2026, dozens of cities and agencies paused, canceled, or rejected Flock contracts amid public pushback, and the company announced new audit and access controls.
A cell-site simulator is a device that impersonates a cell tower. Phones are built to connect to the strongest nearby tower signal, so when the simulator broadcasts, every compatible phone within range, hundreds of feet to over a mile depending on the model and setting, connects to it and transmits its unique identifiers, including the IMSI and IMEI numbers, along with signal data that reveals location. Some models can also capture metadata about calls and texts, and in certain configurations can degrade or block service in an area.
The best-known models, StingRay and Hailstorm, are made by Harris Corporation, now L3Harris, of Melbourne, Florida; the airborne version carried on aircraft is nicknamed a dirtbox after its manufacturer, Digital Receiver Technology. The devices were originally developed for military and intelligence use and migrated to federal, state, and local law enforcement over the 2000s and 2010s.
The American Civil Liberties Union has identified use by at least 75 agencies in 27 states and the District of Columbia, and notes the real number is certainly higher because the FBI has required agencies to sign non-disclosure agreements so restrictive that prosecutors have dropped cases rather than reveal the technology in court. Judges in several jurisdictions were asked to approve surveillance without being told a simulator would be used.
Since 2015, Justice Department and Department of Homeland Security policy has required federal agents to obtain a search warrant based on probable cause before using a cell-site simulator in most circumstances, and a handful of states, including California, Washington, and Utah, have passed warrant laws. Many local departments still operate under general surveillance authorities with little specific oversight.
A conventional warrant names a suspect and asks for their records. A geofence warrant, also called a reverse location warrant, inverts that: it asks a company to identify every device that was inside a drawn geographic area during a specified time, then lets investigators narrow the list and demand identifying details for the devices that look interesting. Nearly all such demands go to Google, which historically stored precise location data for hundreds of millions of accounts in a database it called Sensorvault.
Figures Google disclosed show the volume grew quickly, from roughly 980 geofence requests in 2018 to about 8,400 in 2019 and more than 11,500 in 2020, at which point they made up more than one quarter of all US legal process the company received. Keyword warrants are the search-history version: a demand for the identifiers of every user who searched a particular term or address within a time window.
Critics, including many judges who have reviewed the requests, argue that these warrants lack the individualized probable cause the Fourth Amendment requires and function as the general warrants the amendment was written to forbid, exposing bystanders who happened to be nearby. Innocent people have been investigated because their phones logged them near a crime scene, most prominently a Florida man identified by a geofence warrant for a burglary he had nothing to do with.
In December 2024, Google completed a redesign so that Location History, renamed Timeline, is stored on the user's own device and encrypted backups rather than in a central, searchable database. The company has said this means it can no longer respond to most geofence warrants, though other companies still hold location data and the legal question of whether such warrants are constitutional remains open in the courts.
Face recognition converts a face in a photo into a mathematical template and searches for matches in a gallery of known faces. Its power depends entirely on the size and source of that gallery. Clearview AI built the largest one by scraping images from Facebook, Instagram, LinkedIn, employment sites, news articles, and the open web without the consent of the people pictured or the sites hosting them, assembling a database the company now says exceeds 50 billion images, roughly six for every person on Earth, and selling searches to hundreds of police departments.
In 2022, Clearview settled a lawsuit brought under Illinois's Biometric Information Privacy Act by agreeing to a nationwide ban on selling its faceprint database to most private businesses, and a five-year bar on selling to Illinois state and local police. Other vendors and government systems operate separately: the FBI maintains a face-matching system that searches driver's license and passport photos in many states, and a 2021 Government Accountability Office review found 20 federal agencies that employ law enforcement officers used face recognition, many unable to say which outside systems their staff had used.
The technology's error rate is not uniform. Federal testing by the National Institute of Standards and Technology has repeatedly found that many algorithms misidentify Black and Asian faces, and women, at higher rates than white men, though the best algorithms have narrowed the gap. In real investigations, a match is supposed to be treated as an investigative lead, not proof, but that discipline has failed in practice.
At least seven people in the United States are known to have been wrongfully arrested after a face-recognition misidentification, and nearly all of them are Black. The first publicly documented case was Robert Williams, arrested at his home in front of his family in Detroit in 2020 for a shoplifting he did not commit, after the software matched a store surveillance image to his expired driver's license photo.
A data broker is a company that collects personal information from many sources, app software development kits, loyalty programs, public records, website trackers, and other brokers, then packages and sells it. The industry is worth billions of dollars a year and operates almost entirely out of public view; most people have never heard of the companies holding detailed files on them, such as Acxiom, LiveRamp, Venntel, Babel Street, SafeGraph, or Outlogic, the firm formerly known as X-Mode.
Government agencies have become major customers. Reporting and Freedom of Information Act litigation have documented purchases of bulk location data and other records by Immigration and Customs Enforcement, Customs and Border Protection, the Internal Revenue Service, the Defense Intelligence Agency, the Secret Service, and the FBI. The appeal is legal as much as practical: buying a dataset on the commercial market is not treated as a search, so no warrant, subpoena, or court oversight is involved.
In June 2023 the Office of the Director of National Intelligence declassified a report it had commissioned acknowledging that this commercially available information is more revealing than it has ever been, can be misused, and in some cases provides insight the government would previously have needed a warrant or subpoena to obtain. A 2023 Department of Homeland Security Inspector General report found that DHS components used commercial location data without completing the privacy assessments their own rules required.
Regulators have started to act under consumer-protection law rather than the Constitution. In January 2024 the Federal Trade Commission issued its first orders barring data brokers, Outlogic and InMarket Media, from selling precise location data, and it has since pursued similar cases. Bills in Congress to bar government purchases of such data have passed the House but not become law.
Internet-connected doorbell and security cameras, sold by Amazon's Ring, Google Nest, Wyze, and others, put tens of millions of private cameras on porches and driveways pointed at streets and sidewalks. On their own each is a consumer product, but vendors have built features that turn them into an informal surveillance network. Ring's Neighbors app lets users post clips publicly, and Ring signed partnerships with more than 2,000 US police and fire departments that let officers request footage from residents in a defined area through a portal.
After years of criticism that the request tool pressured residents and lacked oversight, Ring ended in-app police footage requests in January 2024, then reintroduced a way for police to request footage in 2025 through partnerships with Axon and Flock Safety. Police can still obtain video with a warrant served on the homeowner or on Amazon, and Amazon has acknowledged providing footage without a warrant or the owner's consent under an emergency exception, telling Senator Edward Markey it had done so 11 times in the first half of 2022.
The larger trend is integration. Vendors such as Fusus, now owned by Axon, sell platforms that combine private camera feeds, license plate readers, gunshot-detection sensors, and public cameras into a single real-time dashboard for a police department, sometimes with residents encouraged to register or livestream their home cameras to the department. Homeowners associations and business districts increasingly adopt shared camera and plate-reader systems that make a surveillance decision for an entire neighborhood.
Because the cameras are privately owned, they sit outside the Fourth Amendment until the government asks for the footage, and the constitutional rules for when police can demand or accept that footage, and how long they can keep it, are still being worked out case by case.
Many apps that have an obvious reason to know your location, maps, weather, ride-hailing, and many that do not, games, prayer apps, dating apps, coupon apps, embed third-party code that collects precise GPS coordinates and transmits them to advertising and analytics companies. That data is aggregated, tied to a device advertising identifier, and sold or licensed, often described as anonymized even though movement patterns are highly identifying: a device that sits at one house every night and one office every weekday is not anonymous.
Specific cases have surfaced through journalism. In 2020, Vice's Motherboard reported that the popular app Muslim Pro, which provides prayer times and a Quran, had passed location data to a broker, X-Mode, that counted US military contractors among its customers. In 2021, The Markup reported that the family-location app Life360 was one of the largest single sources of raw location data for the broker industry. Both companies said they stopped or restricted the practice after the reporting.
The data has been bought by the government, as described in the data broker section, and also by private parties. In one widely covered episode, a newsletter for Catholic clergy used commercially available app data to identify a senior official as a user of a dating app, demonstrating that de-anonymization is not hypothetical.
Platform changes have reduced but not ended the flow. Apple's App Tracking Transparency, introduced in 2021, requires apps to ask before tracking users across other companies' apps and sites, and most users decline. Both Apple and Google now offer approximate rather than precise location as an option. Apps can still collect location for their own stated purpose, and enforcement of what they then do with it is limited.
The advertising industry follows individuals across the web and across apps to build interest profiles and target ads. The classic tool is the third-party cookie, a small file set by an advertising network that is readable on every site carrying that network's code. As browsers began blocking third-party cookies, the industry shifted to mobile advertising identifiers and to device fingerprinting, which combines dozens of technical signals, screen size, installed fonts, time zone, graphics hardware, battery level, into an identifier distinctive enough to recognize a device even after cookies are cleared and across different browsers.
The engine behind much of this is real-time bidding. In the fraction of a second while a web page loads, information describing the user, an identifier, approximate location, age and interest categories, and the page's content, is broadcast to hundreds or thousands of companies that bid to show an ad. Copies of that bid-request data can be retained by any recipient. European data-protection regulators have ruled that the consent framework underpinning real-time bidding in the European Union is unlawful, and enforcement there is ongoing.
This tracking is what usually explains an ad that feels uncanny. A person searches for a product, reads an article about it, or visits a store whose location data is sold, and the interest profile updates within minutes. Retargeting then shows that product across unrelated sites and apps for days. People who spend time together share websites, locations, and social connections, so an interest one person generates can surface for the whole group.
In the United States there is no comprehensive federal law governing this. State consumer-privacy laws, led by California, now give residents a right to opt out of the sale or sharing of their data and to send a global privacy signal that participating sites must honor, but coverage is uneven and many sites do not comply.
The Short Answer Is No, and the Long Answer Is More Unsettling
The belief that phones secretly record conversations for advertising is not supported by the research that has looked for it. The reason ads still feel like eavesdropping is that the tracking which is real and documented does not need a microphone: the data trail from searches, location, purchases, apps, and social connections is already detailed enough. This tab covers what the studies found, why the feeling is so convincing, and the cases where devices really were watching.
The widespread belief that phones covertly switch on the microphone, record ambient conversation, and use it to target advertising is not supported by the technical research that has looked for exactly that. The most cited study, published by researchers at Northeastern University in 2018 and often called Panoptispy, instrumented and automatically exercised more than 17,000 Android apps while monitoring everything they sent off the device. It found no case of an app secretly activating the microphone to record audio and transmit it. The researchers did find something else: a number of apps were capturing screenshots and screen recordings of user activity and sending them to third parties, generally for analytics.
The practical objections are also strong. Continuously capturing audio, converting speech to text on the device or streaming it to a server, and analyzing it would consume noticeable battery, data, and processing, and security researchers, journalists, and platform engineers who scrutinize network traffic and operating system behavior would have found it. Apple and Google also require an on-screen indicator whenever the microphone is active, and apps must request microphone permission that a user can inspect and revoke.
Regulators have not found it either. The Federal Trade Commission and state attorneys general have brought numerous cases over deceptive data practices, and none has involved covert microphone advertising. When surveillance by a consumer device has been proven, it has been screen or viewing data, not secret audio.
None of this means phones are private. It means the tracking that is real and documented, described in the previous tab, does not require listening, because the data trail people generate through searches, location, purchases, apps, and social connections is already detailed enough to produce ads that feel like eavesdropping.
Several ordinary mechanisms combine to produce ads that seem to follow a spoken conversation. The first is the breadth of non-audio data: an advertising profile can draw on search and browsing history, precise location, app usage, purchase records, email receipts, loyalty cards, and the profiles of people a person is connected to or physically near. A topic can enter that profile through any of those channels without a word being spoken aloud.
The second is retargeting. Looking at a product once, even briefly, can cause ads for it to appear across unrelated sites and apps for days, so a person who researched something and then mentioned it in conversation experiences the ad as a response to the conversation rather than to the earlier search.
The third is shared context. People who talk to each other in person tend to have overlapping interests, visit the same places, use the same networks, and follow each other online. An ad triggered by one person's activity can appear for everyone in that social or household cluster, which feels like the group conversation was overheard.
The fourth is a cognitive bias. The mind does not register the thousands of ads that do not match a recent conversation, but it strongly notices the one that does, an instance of what psychologists call the frequency illusion or the Baader-Meinhof phenomenon. Confirmation then makes the pattern feel certain.
There is one important qualification to the reassurance above. Voice assistants, Apple's Siri, Amazon's Alexa, and Google Assistant, are designed to listen continuously for their trigger phrase. That detection normally happens on the device, and only after the wake word is detected is audio sent to company servers to be interpreted. But the wake-word detector is imperfect, and devices activate accidentally on similar-sounding speech and background noise, capturing snippets of conversation the user never meant to send.
In 2019, reporting by Bloomberg, The Guardian, and other outlets revealed that Apple, Amazon, and Google all employed contractors to listen to and transcribe samples of assistant recordings for quality improvement, including clips from accidental activations that captured private conversations and other sensitive audio. Following the disclosures, all three companies paused human review, apologized, made it opt-in or added clear opt-out settings, and gave users tools to review and delete their voice history.
Enforcement has followed. In 2023 Amazon agreed to pay 25 million dollars to settle Federal Trade Commission allegations that it had kept some children's Alexa voice recordings indefinitely and had not honored deletion requests, in violation of children's privacy law.
The lesson is narrower than the myth. Assistants do capture more audio than users expect, mostly through mistaken activations, and that audio has been reviewed by humans and retained longer than disclosed, but that is a quality-control and data-retention failure, not a hidden advertising microphone.
A real and proven form of consumer-device surveillance involves the screen rather than the microphone. Most smart televisions use automatic content recognition, which samples the pixels or audio fingerprint of whatever is on screen, broadcast, streaming, or a connected game console, and matches it against a reference library to identify the program second by second. That viewing record is tied to the household and sold to advertisers and data brokers, and the feature is typically enabled by default.
The landmark enforcement case is Vizio, which agreed in 2017 to pay 2.2 million dollars to the Federal Trade Commission and the State of New Jersey over allegations that it collected second-by-second viewing data from about 11 million televisions without adequately informing owners and sold it, including data that could be combined with demographic information about the household.
Automatic content recognition can generally be turned off in a television's privacy settings, though the option is often buried and worded vaguely, and turning it off may disable some recommendation features. Streaming devices and services run their own separate viewing analytics.
This matters to the listening question because it is a concrete example of the pattern: when a device really is watching, it has been discovered, documented, and litigated. The absence of any comparable case for secret audio advertising is meaningful.
In late 2024, journalists obtained a pitch deck from Cox Media Group, a broadcasting and marketing company, advertising a product it called Active Listening. The deck claimed the service could target ads to consumers based on what their smartphones and other smart devices overheard in casual conversation, and it named large technology platforms as partners.
The reaction from those platforms was to distance themselves. Google removed Cox Media Group from its Partners Program, and Meta and Amazon said they were reviewing the matter and that their policies prohibit using device microphones in that way. No evidence ever emerged that the described capability actually existed or functioned, and outside experts widely characterized the deck as sales exaggeration built on the public's existing suspicion rather than a working system.
The episode is instructive precisely because it collapsed under scrutiny. A marketing team claimed the capability people fear is real; when reporters and platforms examined it, there was no product behind the claim.
It also shows why the myth is durable. A vague claim of audio ad targeting aligns with what many people already believe, spreads quickly, and is rarely followed by the correction. The documented reality remains that pervasive ad targeting is built from data, not from listening.
Why So Much Surveillance Skips the Warrant Requirement
The Fourth Amendment's warrant rule has a long list of exceptions and gaps that matter more every year: the reasonable-expectation-of-privacy test written for phone booths, the third-party doctrine that strips protection from anything a company holds, the practice of simply buying data instead of seizing it, foreign-intelligence collection that sweeps in Americans, self-issued records demands, and the border-search exception. State legislatures, not Congress, are now the main source of new limits.
The Fourth Amendment bars unreasonable searches and seizures and generally requires a warrant issued by a judge on probable cause. Since Katz v. United States in 1967, the threshold question in most disputes is whether a search happened at all, and that turns on Justice Harlan's two-part test: did the person have an actual expectation of privacy, and is it one society is prepared to accept as reasonable. If there is no reasonable expectation of privacy, the Fourth Amendment does not apply and the government needs no warrant.
That test was designed for physical spaces and paper records. Courts have spent decades deciding how it maps onto data that did not exist in 1967, and the results are uneven: the contents of a phone call and a personal phone are protected, but the numbers dialed and the phone's location history were long treated as unprotected because a company held them.
The test also has a feedback problem. If protection depends on what society expects, then the more surveillance becomes routine and known, the weaker the expectation, and the less the amendment restrains. Several justices have noted that this cannot be the whole analysis, or constitutional protection would erode automatically as technology spreads.
Carpenter v. United States in 2018 signaled that the Court will sometimes look past the formal question of who holds a record and ask instead how much the surveillance reveals about a person's life, but it did so narrowly and left most of the older framework standing.
Under United States v. Miller (1976) and Smith v. Maryland (1979), information a person voluntarily hands to a business generally loses Fourth Amendment protection. The theory is that by sharing data with a bank, a phone company, or an internet provider to get a service, the person assumes the risk that the business will hand it to the government. That makes such records available with a subpoena or a court order on a standard well below probable cause, and sometimes with no judicial process.
The doctrine is the single most important reason so much modern surveillance avoids the warrant requirement. Email stored with a provider, subscriber and billing records, the addresses a person communicates with, transaction records, and until recently cell-phone location data have all been obtained this way.
Carpenter carved out an exception for historical cell-site location information, holding that its depth and the involuntariness of carrying a phone make it different. But the Court called the ruling narrow and did not overrule Miller or Smith. It expressly left in place conventional subpoenas for business records and did not decide how the doctrine applies to many other categories of digital data.
The result is a patchwork. Lower courts now argue case by case over whether a given record, a few hours of location data, a tower dump, financial data, utility records, is more like the protected location history in Carpenter or the unprotected phone numbers in Smith.
Buying a record on the open commercial market is not treated as a search under current law, so when the government purchases location trails, utility data, or other personal information from a data broker, it involves no warrant, no subpoena, and no court oversight of any kind. Agencies have used this to acquire datasets they could not lawfully compel directly, and internal legal memos, some later released, have treated the purchase as a way around the Fourth Amendment rather than a question under it.
The Office of the Director of National Intelligence's declassified 2022 report, released in June 2023, acknowledged the problem in the government's own words: commercially available information now provides intelligence value comparable to what once required targeted collection, it is not well governed by existing policy, and its misuse could cause significant harm.
The proposed fix is the Fourth Amendment Is Not For Sale Act, which would require the government to get a court order it could have obtained to compel the data before it may instead buy the same data from a broker, and would bar purchases of illegitimately obtained data. It passed the House 219-199 in April 2024 with a bipartisan coalition, but the Senate did not bring it to a vote.
In the absence of legislation, the main checks have come from the Federal Trade Commission acting under its consumer-protection authority against the brokers themselves, and from a handful of internal agency policy changes, neither of which has the force of a constitutional rule.
Section 702, enacted in 2008, lets the National Security Agency collect the communications of non-US persons reasonably believed to be located outside the United States, without an individual warrant, by compelling assistance from US communications providers. The stated targets are foreign, but because Americans exchange calls, texts, and emails with people abroad, large volumes of Americans' communications are collected incidentally and retained in government databases.
The contested practice is the US-person query, sometimes called a backdoor search: an FBI or other analyst searching that database using an American's name, email, or phone number. The Foreign Intelligence Surveillance Court has documented large numbers of noncompliant queries, including searches run on members of Congress, protesters, and political donors, and has required corrective measures.
Section 702 operates on sunsets and must be periodically reauthorized. In April 2024, Congress reauthorized it for roughly two years through the Reforming Intelligence and Securing America Act, adding some new limits and oversight but rejecting, by one vote in the House, an amendment that would have required a warrant to query the database for Americans' communications. That authorization expired on June 12, 2026, after Congress failed to agree on an extension; because the FISA Court approved new yearlong certifications in March 2026, collection can continue until March 2027 while lawmakers debate competing reauthorization bills.
The program illustrates a recurring pattern in surveillance law: an authority aimed at foreign intelligence produces a domestic database of Americans' communications that is then searchable under rules far looser than the Fourth Amendment would require for a direct search.
A National Security Letter is a demand for records, typically subscriber information, toll billing, and electronic communication transaction records, that the FBI can issue on its own authority in national security investigations, with no prior approval from any judge. NSLs almost always come with a gag order barring the recipient, a phone company or internet provider, from telling anyone, including the affected customer, that the demand was made.
The Justice Department Inspector General has documented tens of thousands of NSLs issued in a single year at the program's peak, along with findings of inaccurate records and use beyond what the law allowed. Legal challenges narrowed the gag orders somewhat, requiring periodic review, but the core tool, a compelled records demand with no judge, remains.
Beyond national security, dozens of federal agencies hold administrative subpoena power, letting them compel records in ordinary regulatory and criminal matters without going to court first. Grand jury subpoenas, issued by prosecutors in the grand jury's name, similarly reach many categories of third-party records on a relevance standard.
These tools predate the digital era but now reach vast quantities of stored personal data held by providers, and they operate largely outside the warrant framework because of the third-party doctrine.
At the international border and its functional equivalents, including international arrivals areas of airports, the government may conduct routine searches without a warrant or probable cause, a long-standing exception justified by the sovereign interest in controlling what and who enters the country. Customs and Border Protection applies this to travelers' phones, laptops, and tablets.
CBP policy distinguishes a basic manual search, scrolling through a device by hand, which officers may do without any suspicion, from an advanced or forensic search using external equipment to copy and analyze data, which under CBP's own 2018 directive requires reasonable suspicion of a legal violation or a national security concern. The agency has reported roughly 41,000 electronic device searches in a recent fiscal year, a small fraction of all crossings but a large absolute number, and the searches apply to US citizens returning home as well as to foreign visitors.
Federal appeals courts are split on what the Constitution requires. Some have held that even a forensic search at the border needs no suspicion; others have required at least reasonable suspicion for forensic searches; and at least one has suggested a warrant may be needed for searches aimed at finding evidence of ordinary crime rather than contraband. The Supreme Court has not resolved the conflict.
Travelers concerned about device searches are generally advised to travel with minimal data, power devices fully off before arrival, and understand that refusing to unlock a device can lead to its seizure and, for non-citizens, denial of entry.
The pen register and trap-and-trace statute governs real-time collection of the non-content information about communications: the numbers a person dials, incoming numbers, and, as courts have applied it, email headers and IP addresses. To get such an order, an investigator need only certify to a court that the information is likely to be relevant to an ongoing criminal investigation. The judge does not weigh probable cause and must issue the order once the certification is made.
That relevance standard is far below what a warrant requires, and it exists because Smith v. Maryland held that dialed numbers are unprotected under the third-party doctrine. The category has expanded over time to cover far more revealing metadata than the phone numbers at issue in 1979.
A tower dump is a related demand: a request for the records of every phone that connected to a particular cell tower or towers during a set period, which can sweep in thousands of people who were merely nearby. Courts are divided over whether and when a tower dump requires a warrant after Carpenter, and some now impose warrant-like protections and require deletion of uninvolved people's data.
Because these tools collect metadata rather than content, they have historically drawn less legal protection, even though metadata, who contacted whom, when, from where, and how often, can reveal as much about a person as the contents of the messages.
With Congress gridlocked, states have become the main source of new privacy rules. California's Electronic Communications Privacy Act, effective in 2016, requires California law enforcement to get a warrant for most digital information, including content, metadata, and location data, from both devices and service providers, closing many of the gaps the federal third-party doctrine leaves open.
Illinois's Biometric Information Privacy Act, passed in 2008, requires informed written consent before a private entity may collect a person's faceprint, fingerprint, or other biometric identifier, and lets individuals sue for violations. It is the strongest biometric-privacy law in the country and was the basis for Clearview AI's nationwide settlement and for a 650 million dollar settlement with Facebook over photo tagging.
Since 2018, roughly 20 states have enacted general consumer data-privacy laws giving residents rights to access, delete, and opt out of the sale or sharing of their personal information, though the laws vary widely in strength and most rely on enforcement by a state attorney general rather than private lawsuits.
At the local level, about 20 jurisdictions have adopted Community Control Over Police Surveillance ordinances, which require city council approval and a public process before a police department may acquire new surveillance technology such as face recognition, cell-site simulators, or automated license plate readers. Some cities, including San Francisco, have banned government use of face recognition outright.
The Fourth Amendment Is Not For Sale Act passed the House 219-199 in April 2024 with 123 Republicans and 96 Democrats in favor, then was never taken up by the Senate.
Practical Steps, and Their Limits
No setting change stops a government legal demand, and no single tool makes a person invisible. But specific, concrete steps do shrink the commercial data trail that ends up with brokers and, through them, with agencies: phone and TV settings, end-to-end encryption for what matters, data-broker opt-outs and new state deletion tools, deliberate choices about home cameras, public-records requests to see what a town has bought, and support for the groups that litigate and lobby.
On an iPhone, the highest-impact change is in Settings under Privacy and Security, then Tracking: turn off Allow Apps to Request to Track, which stops apps from using the cross-app advertising identifier. In Location Services, set apps to Ask Next Time or While Using rather than Always, and turn off Precise Location for any app that does not genuinely need your exact position. Under Privacy and Security, review which apps have microphone, camera, contacts, and photos access and revoke what is not needed.
On Android, open Settings, then Privacy or Security and Privacy, and delete the advertising ID entirely, an option Google added that causes apps to receive a string of zeros instead. Review per-app location permissions and switch them from Allow all the time to Allow only while using, and turn off precise location where approximate will do. In your Google account, under Data and Privacy, turn off or auto-delete Location History, now called Timeline, and Web and App Activity.
On any smart television, open the privacy settings and turn off automatic content recognition, sometimes labeled Viewing Information Services, Live Plus, or SmartCast Viewing Data. Do the same on streaming devices where the option exists. Expect it to be enabled by default and worded to sound harmless.
None of this stops a service from collecting data you give it directly for its own stated purpose, and it does not affect government legal demands, but it meaningfully shrinks the commercial data trail that ends up with brokers.
End-to-end encryption means only the sender and recipient can read a message; the service carrying it, and anyone who later subpoenas the service, gets only unreadable data and limited metadata. Signal is the standard recommendation because it is nonprofit, open source, and collects almost no metadata; iMessage between Apple devices and WhatsApp are also end-to-end encrypted by default, though they retain more information about who contacts whom. For messages you would not want read by a company, a broker, or a future litigant, use one of these rather than SMS.
Turn on full-disk encryption, which is standard and automatic on modern iPhones and most current Android phones as long as you set a passcode. Prefer a strong alphanumeric passcode over a short PIN, and understand that courts in many jurisdictions have treated compelling a fingerprint or face unlock differently from compelling a memorized passcode, so biometric unlock can be easier for the government to force.
Use HTTPS everywhere, which is now the default in major browsers, so that what you send and receive is encrypted in transit. A virtual private network hides your browsing from your internet provider and from the local network, but it moves that visibility to the VPN company, so choose a reputable paid provider with a clear no-logging policy rather than a free one.
Encryption does not hide that communication occurred, does not protect data after it reaches the other end, and does not help if your device itself is compromised or unlocked. It is a strong tool for a specific job, not a blanket shield.
Many data brokers are legally required, at least for residents of states with privacy laws, to honor requests to delete personal data and to stop selling it. Doing this by hand means submitting requests to dozens of companies individually. Nonprofit and journalistic guides, including those from the Electronic Frontier Foundation, Consumer Reports, and the New York Times's Wirecutter, publish current opt-out instructions and lists, and Consumer Reports offers a free tool called Permission Slip that files requests on your behalf.
California has gone further with the Delete Act, which directs the state to build a single deletion portal called DROP, which opened to residents on January 1, 2026: one request that every data broker registered with the state has had to process since August 1, 2026. Other states have data-broker registries that at least let you see which companies exist and where to send requests.
Under the California, Colorado, Connecticut, and similar laws, you can also send businesses a request not to sell or share your data, and browsers and extensions can broadcast a Global Privacy Control signal that participating sites are required to treat as an opt-out automatically. Turning this on in your browser settings applies the opt-out to every site you visit without filling out forms.
Opt-outs are not permanent. Brokers rebuild profiles from new data, so this is a maintenance task to repeat every several months, not a one-time fix, and coverage still depends on whether your state grants the underlying rights.
If you own an internet-connected camera or doorbell, review its settings. On Ring, you can decline to join the Neighbors app and its public-post and police-partnership features, and you can enable end-to-end video encryption, which prevents the company from handing over readable footage in response to a request, though it disables some features. Aim cameras so they cover your own doorway, porch, and driveway rather than a neighbor's windows or a wide stretch of public sidewalk, which is better for privacy and, in some states, for staying within the law.
Understand what registration and integration programs mean. Some police departments ask residents to register private cameras or to livestream them into a real-time crime center; joining means your footage becomes routinely available to the department. That is a choice worth making consciously rather than by default.
When a homeowners association, a neighborhood group, or a business improvement district proposes a shared camera or automated license plate reader system, it is deciding to record everyone who enters the area. Ask, before it is installed, who can access the data, how long it is retained, whether it is shared with police or a vendor network, and whether there is an audit log. These questions are much harder to raise after a contract is signed.
For your own devices, keep firmware updated, use a unique strong password and two-factor authentication, and delete stored cloud footage you do not need, since a breach or a broad legal demand can expose whatever is retained.
Every state has an open-records law that lets any member of the public request government documents, and these are the main way communities learn what surveillance technology their local agencies operate. A request to a city, county, police department, or sheriff's office can ask for contracts, purchase orders, and grant applications for named vendors such as Flock Safety, Motorola Vigilant, Fusus, Clearview AI, and cell-site simulator makers, along with the agency's policies on data retention, access, sharing, and auditing.
You do not have to draft these from scratch. The Electronic Frontier Foundation's Atlas of Surveillance maps technology already identified in thousands of jurisdictions, the nonprofit MuckRock hosts public-records request templates and publishes documents others have obtained, and local news outlets and ACLU affiliates frequently post the results of their own requests.
What comes back often reveals things that were never presented to the public: automatic renewal clauses, data shared into multistate search networks, retention periods longer than officials described, and the absence of any written policy limiting searches. That information is what feeds city council debates, ordinances, and, in a growing number of places, decisions to cancel contracts.
If a request is denied or ignored, most states have an appeal process, and many nonprofits will help. Persistence matters, because agencies sometimes treat vendor non-disclosure agreements as a reason to withhold records that the open-records law actually requires them to produce.
Most of the concrete limits on surveillance in the last two decades came from organized advocacy and litigation rather than from legislatures acting on their own. The American Civil Liberties Union brought the Illinois biometric case that produced the Clearview AI settlement and tracks cell-site simulator use nationally. The Electronic Frontier Foundation litigates surveillance cases, runs the Atlas of Surveillance and the Street Level Surveillance guides, and drafts model legislation. The Electronic Privacy Information Center files regulatory complaints and Freedom of Information Act suits.
Newer and more specialized groups include the Surveillance Technology Oversight Project, which focuses on local police technology in New York and beyond, and the Institute for Justice, which brought the 2024 constitutional challenge to Norfolk's license plate reader network. Investigative newsrooms such as The Markup, 404 Media, and the Associated Press have driven much of the public record these groups build on.
The Community Control Over Police Surveillance model, now law in about 20 jurisdictions, came out of a coalition of these organizations and gives residents a formal role, a public hearing and a city council vote, before new surveillance tools are acquired. Campaigns for those ordinances, and for state warrant laws and biometric statutes, advance mainly when constituents show up and press for them.
Federal bills follow the same pattern. The Fourth Amendment Is Not For Sale Act and repeated attempts to reform the Electronic Communications Privacy Act and Section 702 have moved only when public attention and constituent pressure made inaction costly.
Ten Facts Worth Knowing
A quick-reference set of facts drawn from the sourced material throughout this page, useful for a fast read or a classroom discussion starter.
Flock Safety says its automated license plate cameras operate in more than 5,000 US communities, with a nationwide fleet approaching 90,000 cameras. A single local network can log every vehicle that passes hundreds of intersections, regardless of whether anyone is suspected of a crime.
Carpenter v. United States, the 2018 decision that police generally need a warrant to obtain historical cell-phone location records, was decided 5 to 4.
Clearview AI says its face-recognition database holds more than 50 billion images scraped from the public internet, roughly six photos for every person on Earth.
At least seven people in the United States are known to have been wrongfully arrested after a face-recognition misidentification. Nearly all of them are Black, and the first documented case, Robert Williams, was arrested at his Detroit home in front of his children in 2020.
Figures Google disclosed show its geofence-warrant requests grew from about 980 in 2018 to more than 11,500 in 2020, when they made up over a quarter of all US legal demands the company received. Google has since moved location data onto users' devices.
Customs and Border Protection has reported roughly 41,000 warrantless searches of travelers' phones, laptops, and tablets in a single fiscal year. The border-search exception applies to returning US citizens, not only foreign visitors.
The Supreme Court's 1928 Olmstead decision, which held that wiretapping was not a search because no one physically trespassed, stood for 39 years until Katz v. United States overruled it in 1967.
In January 2024 the Federal Trade Commission issued its first orders barring data brokers, Outlogic (formerly X-Mode) and InMarket Media, from selling Americans' precise location data.
Amazon told Senator Edward Markey that it had provided Ring doorbell footage to police without a warrant or the owner's consent 11 times in the first half of 2022, under an emergency exception.
The Fourth Amendment Is Not For Sale Act, which would require a court order before the government could buy personal data from brokers, passed the House 219-199 in April 2024 with bipartisan support but was never taken up by the Senate.
Sources & Further Reading
- Supreme Court / Oyez, Olmstead v. United States (1928)
- Supreme Court / Oyez, Katz v. United States (1967)
- Supreme Court / Oyez, United States v. Miller (1976)
- Supreme Court / Oyez, Smith v. Maryland (1979)
- Supreme Court / Oyez, United States v. Jones (2012)
- Supreme Court / Oyez, Riley v. California (2014)
- Supreme Court / Oyez, Carpenter v. United States (2018)
- Electronic Frontier Foundation, Street Level Surveillance
- Electronic Frontier Foundation, Atlas of Surveillance
- ACLU, Stingray Tracking Devices
- U.S. Government Accountability Office, Facial Recognition Technology: Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks (GAO-21-518)
- Office of the Director of National Intelligence, Declassified Report on Commercially Available Information (June 2023)
- Federal Trade Commission, FTC Order Prohibits Data Broker X-Mode Social and Outlogic From Selling Sensitive Location Data (Jan. 2024)
- Federal Trade Commission, FTC Order Will Ban InMarket From Selling Precise Consumer Location Data (Jan. 2024)
- Federal Trade Commission, Vizio to Pay $2.2 Million to Settle Charges It Collected Viewing Histories on 11 Million Smart Televisions (2017)
- Federal Trade Commission, FTC and DOJ Charge Amazon With Violating Children's Privacy Law by Keeping Kids' Alexa Voice Recordings Forever (2023)
- Northeastern University, Panoptispy: Analyzing the Media Permissions of Mobile Apps (2018)
- ACLU, ACLU v. Clearview AI (Illinois Biometric Information Privacy Act settlement)
- Sen. Edward Markey, Senator Markey's Probe Into Amazon Ring Reveals New Privacy Problems (2022)
- Electronic Frontier Foundation, Federal Appeals Court Finds Geofence Warrants Are Categorically Unconstitutional (2024)
- Congress.gov, H.R. 4639, Fourth Amendment Is Not For Sale Act (118th Congress)
- U.S. Department of Homeland Security Office of Inspector General, CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies for Commercial Location Data (OIG-23-61, 2023)
This page draws on published Supreme Court opinions and Oyez case summaries, the Government Accountability Office's 2021 review of federal face-recognition use, the Office of the Director of National Intelligence's declassified report on commercially available information, Federal Trade Commission enforcement actions and orders, a 2023 Department of Homeland Security Inspector General report, the American Civil Liberties Union and the Electronic Frontier Foundation's surveillance-tracking projects, Northeastern University's Panoptispy study, congressional records for the Fourth Amendment Is Not For Sale Act and the reauthorization of Section 702, and contemporaneous reporting by the Associated Press, The Markup, and 404 Media. Company figures for Flock Safety, Clearview AI, and Google geofence-request volume are the companies' own disclosed numbers as reported at the time of writing.