The Pennsylvania Supreme Court handed down its long-awaited ruling in Commonwealth v. Kurtz today, on whether there are Fourth Amendment rights in Google search terms. Among the seven Justices, three took on that question and said no, the Fourth Amendment and the state constitution do not apply. (One Justice said that she would say no if she had to reach it, but she didn’t have to reach it, so she would not take a position.)
In the case, the police were trying to find out who committed a sexual assault of a person known in the opinion by her initials, “K.M.” Police figured that whoever committed this crime may have googled K.M.’s name or address before committing the crime. Investigators obtained what is known as a “reverse keyword search warrant,” asking for Google to hand over the I.P. address of whoever may have googled the name or address of the victim shortly before the crime. Google responded that someone at a particular I.P. address had conducted two searches for K.M.’s address a few hours before the attack. The I.P. address was in use at the home of the defendant, Kurtz. The police had not suspected Kurtz in the crime, but they started to watch Kurtz closely, obtained a DNA sample, and found a DNA match from the crime.
Kurtz challenged the warrant, arguing that it was not based on probable cause. The government responded that whether the warrant was valid or not was irrelevant, as there are no Fourth Amendment rights in search terms. The first issue in Kurtz was whether the traditional third-party doctrine applies, under which you don’t have Fourth Amendment rights in information you share with others, or whether search terms are protected by the Fourth Amendment under the exception to the third party doctrine carved out in Carpenter v. United States(2018) applied instead.
Writing for a total of three of the seven Justices, Justice Wecht agreed with the government that the third-party doctrine applies and that search terms are not covered by the exception to that doctrine carved out by Carpenter:
Resolution of the central question in this case—whether a person has an expectation of privacy in his or her unprotected internet searches—rests upon whether such actions are governed by Carpenter’s “narrow” rejection of the third-party doctrine, or fall instead under the traditional third-party doctrine. The Court’s deviation from the traditional doctrine in Carpenter in large part was predicated upon the inextricable relationship between the contemporary person and his or her device. Because the Court considered mobile devices to be “indispensable to participation in modern society,” the Carpenter Court held that their use in public is an unavoidable part of modern life. As such, the Court held, a person does not make a voluntary choice to place CSLI generated by cell phone use into the hands of third parties. Rather, such transmission happens automatically.
A reasonable comparison can be made between the prevalence of the internet in modern society and the prevalence of cell phone usage. Such similarity, however, does not mean that they are one and the same for purposes of the third-party doctrine. Rather: “Carpenter’s expectation of privacy ruling was based upon more than just the fact that a contemporary American and his or her phone rarely, if ever, detach from one another. Nor was the decision premised exclusively upon the widespread coverage provided by cellular towers, or upon the fact that the records generated from connections to those towers can create an allencompassing roadmap of the person’s movements. The ruling resulted from the amalgamation of these factors. Indeed, the linchpin of Carpenter was that, because of the inseparable relationship between a person and his cell phone, it is not objectively reasonable to expect that a cell phone user can avoid the creation of the records as he or she travels through the public sphere. Because the user has no reasonable way to limit the creation of the records, and because of the extensive information compiled by those records, the Court found that a reasonable expectation of privacy existed. The inverse must also be true: if a person can limit the creation of the records, or if the device or instrumentality at issue is not so inextricably and unavoidably attached to modern life, no such expectation of privacy would prevail.”
It is beyond cavil that the internet is extensively intertwined with nearly every aspect of contemporary life. We use it to schedule appointments, to communicate with friends and former schoolmates, to play games, to hold meetings, and to conduct research on any number of topics. The list goes on and on. However, unlike smart phones, the internet is not a “feature of human anatomy.” The use of the internet is not involuntary, as cell phones have become. To the contrary, every time a person logs on to the internet, that person makes a choice. She chooses to input data into a network owned and operated by an internet service provider. While users (reasonably) may believe that their searches are private, they nonetheless willingly transmit data to a third party whenever they type terms into a search engine and hit the “Enter” key. Unlike the cell phone user who cannot avoid creation of a data trail, the internet user can avoid or minimize the creation of such records by using other methods of research. A person seeking a restaurant reservation can telephone or visit the establishment rather than using the internet to book it. Someone hoping to learn more about dinosaurs or galaxies can conduct research in print materials at the library.80 Persons seeking privacy can shield their browsing history.81 The point is that the data trail created by using the internet is not involuntary in the same way that the trail created by carrying a cell phone is.
That one should not expect absolute privacy in the routine use of the internet should not come as a surprise. It is common knowledge that websites, internet-based applications, and internet service providers collect, and then sell, user data. Nearly every time a person opens an internet-based application for the first time on a smart phone or home computer, he or she is notified of such expansive data collection and is given the option to opt out of it. It is not at all infrequent that a person searches online for a product today, only to receive electronic advertisements for that same product tomorrow. The point is that, even the ordinary, everyday use of the internet provides strong indicators that there is no privacy in the terms or information that the user voluntarily enters into a search engine.
In the case before us, Google went beyond subtle indicators. Google expressly informed its users that one should not expect any privacy when using its services. Under the “Privacy” tab situated on the bottom right-hand corner of Google’s home page, at the time of the searches at issue in the case sub judice, Google informed its users of the following: [long quote of Google’s terms of service omitted]. Thus, when a person performs a Google search, he or she is aware (at least constructively) that Google collects a significant amount of data and will provide that data to law enforcement personnel in response to an enforceable search warrant. For present purposes, what Google does with that information, including the standards it imposes upon itself before providing that information to investigators, is irrelevant. For Fourth Amendment purposes, what matters is that the user is informed that Google—a third party—will collect and store that information. When the user proceeds to conduct searches with that knowledge, he or she voluntarily provides information to a third party. This express warning, in tandem with the more indirect indicators noted above, necessarily precludes a person from claiming an expectation of privacy in his or her voluntary internet use. Any such claim is not one that society would find objectively reasonable.
Justice Mundy would have been the fourth vote for this view. She wrote a brief concurrence saying that she agreed with Justice Wecht, but that would not take a formal position on the question as she would instead say there was probable cause and resolve the case on those grounds:
I write separately to express that if this Court were required to resolve the constitutional query posed, I would agree with that “the average search engine user” does not have “an expectation of privacy in the records generated by” unprotected internet searches. Opinion Announcing the Judgment of the Court (“OAJC”), at 3. However, as this determination was, in my view, not needed to dispose of this matter, I am compelled to concur only in the result of the OAJC.
Seems a bit unusual to me to state a position but not take the position, but so it goes. That might explain why it took a year and half since the oral argument to decide the case. (Three Justices resolved the case on probable cause grounds, ruling that probable cause was sufficient; this was Justice Mundy’s view, as noted, as well as Chief Justice Todd’s view, expressed in a concurrence here.)
Justice Donohue wrote a dissent primarily on state constitutional grounds, although she did also express disagreement with Justice Wecht’s conclusion about Carpenter:
I do not address the OAJC’s conclusion that under the Fourth Amendment a Google user would have no expectation of privacy in information the user shares with Google. However, I am not convinced that this conclusion is correct given the High Court’s decision in Carpenter, where it declined to extend the third-party doctrine to the collection of cell-site location data from an individual’s cell phone company based, in part, on its determination that “cell phones and the services they provide are ‘such a pervasive and insistent part of daily life’ that carrying one is indispensable to participation in modern society.” Carpenter v. United States, 585 U.S. 296, 315 (2018) (quoting Riley v. California, 573 U.S. 373, 385 (2014)). The OAJC and I agree that the internet is an indispensable tool in modern society. OAJC at 2. Without access, the internet is useless. Google is the dominant search engine in the United States, accounting for 85%-90% of the search engine market share at various points in the last year. Search Engine Market Share United States of America October 2024 – October 2025, STATCOUNTER [link omitted]. Given its overwhelming dominance, Google is equally “a pervasive and insistent part of daily life” such that using Google “is indispensable to participation in modern society.” See Carpenter, 585 U.S. at 315. The contrary perspective of the OAJC is untethered to the realities of everyday life in households throughout this Commonwealth.
Two thoughts.
First, I think this is a hard Carpenter question. In my recent book, The Digital Fourth Amendment: Privacy and Policing in Our Online World, I argue that this is a close call that could go either way. It depends on your theory of what Carpenter is doing, and even then it depends on how far you interpret some of the vague language in Carpenter. Doctrinally, either answer is at least plausible; even under my own take of what Carpenter means, it’s not an easy call. See pages 168-170.
Second, just two years ago, the Colorado Supreme Court handed down a very different ruling on essentially the same question, People v. Seymour. The Colorado court ruled that accessing search terms is a Fourth Amendment seizure (rather than a Fourth Amendment search), relying on Google’s terms of service. It also ruled that accessing search terms is a search under the Colorado state constitution. I didn’t think the seizure ruling was persuasive, as I blogged about here, but Wecht opinion here and the Colorady opinion are a fascinating contrast. One uses Google’s TOS to say that a warrant is required; the other uses TOS to say that no warrant is required. I tend to see the reliance on TOS as a crutch both ways. As I have argued here, I don’t think TOS alter Fourth Amendment rights—up or down. But it’s interesting to see courts rely on them, especially to reach opposite results.
