Digital Privacy

Introduction

Digital privacy law governs the collection, use, and disclosure of personal information in electronic form. The United States provides privacy protection through a combination of statutory regulation and constitutional interpretation. The Electronic Communications Privacy Act (ECPA) and the Stored Communications Act (SCA) are the principal federal statutes governing electronic surveillance and access to stored communications. The Fourth Amendment protects against unreasonable searches of digital information.

The Electronic Communications Privacy Act

The Electronic Communications Privacy Act of 1986 (ECPA) amended the Wiretap Act to address advances in telecommunications technology. Title I of ECPA prohibits the intentional interception of electronic communications and the disclosure or use of intercepted communications. The statute provides exceptions for consent, provider protection, and law enforcement under specified conditions.

Title II of ECPA, the Stored Communications Act (SCA) , prohibits unauthorized access to stored electronic communications and requires service providers to protect the confidentiality of stored communications. The SCA distinguishes between communications in transit and communications in storage, with different rules applying to each category. The statute also prohibits providers from knowingly divulging the contents of communications to third parties.

The Stored Communications Act

The SCA establishes a tiered system of privacy protection for stored communications. Communications in electronic storage (temporary storage for the purpose of transmission) receive the highest protection. Communications stored after delivery receive less protection, and basic subscriber information receives the least protection.

The SCA prohibits voluntary disclosure of communications content by service providers except in limited circumstances, including consent, forwarding to the intended recipient, and disclosure to the government under specified legal process. The statute also requires government entities to obtain a warrant, court order, or subpoena before compelling a provider to disclose communications or subscriber information.

The Wiretap Act

The Wiretap Act (Title III of the Omnibus Crime Control and Safe Streets Act of 1968) prohibits the intentional interception of wire, oral, or electronic communications. The statute requires law enforcement to obtain a wiretap order based on probable cause that a specific crime has been or is being committed and that the interception will reveal communications concerning that crime.

Wiretap orders require particularity: they must specify the nature and location of the communications to be intercepted, the identity of the persons whose communications are to be intercepted, and the period of interception. The statute imposes strict minimization requirements and reporting obligations.

The Fourth Amendment and Digital Privacy

The Fourth Amendment protects against unreasonable searches and seizures of digital information. The Supreme Court’s decision in Carpenter v. United States (2018) is the most significant Fourth Amendment ruling in the digital age. The Court held that the government’s acquisition of historical cell-site location information (CSLI) constitutes a search under the Fourth Amendment because individuals have a reasonable expectation of privacy in their location records.

Carpenter applied the third-party doctrine —which holds that information voluntarily disclosed to a third party loses Fourth Amendment protection—narrowly. The Court reasoned that the depth, breadth, and comprehensive reach of CSLI implicates the “privacies of life” in ways that distinguish it from traditional business records.

Geolocation Privacy

Geolocation information receives heightened protection after Carpenter. The decision requires the government to obtain a warrant supported by probable cause before acquiring cell-site location information covering a period of seven days or more. Lower courts have extended Carpenter’s reasoning to other forms of location tracking, including GPS monitoring and real-time cell-site location information.

The Geolocation Privacy and Surveillance Act (GPS Act) , proposed but not enacted, would codify warrant requirements for accessing geolocation information. Several states have enacted laws requiring warrants for access to location information.

The Pen Register and Trap and Trace Statute

The Pen Register and Trap and Trace Statute (18 USC §§ 3121-3127) regulates the collection of non-content call information, including numbers dialed and numbers from which calls originate. Law enforcement may obtain pen register/trap and trace orders based on certification that the information is relevant to an ongoing investigation, without a showing of probable cause.

Conclusion

Digital privacy law in the United States is a complex framework of statutes and constitutional doctrines. The ECPA and SCA govern electronic surveillance and stored communications, while the Fourth Amendment, as interpreted in Carpenter, provides constitutional protection for digital information. The law continues to evolve in response to technological change, with ongoing debates about the scope of privacy protection in the digital age.