After Carpenter v. United States — How Can We Help?

In 2018, governments around the world stepped in to force companies to do more to protect users’ privacy. California, Brazil, India, and the EU all proposed, passed, or began enforcing major data protection laws. And the US Supreme Court decided Carpenter v. United States, a landmark case for protecting privacy of data we store with tech companies. Mozilla has been dedicated to privacy and security for more than 20 years, so we’re excited to see this trend toward strong data protection around the world. However, we continue to believe that companies should go above and beyond the minimum the law requires, both in their products and in their internal practices. This month, we took a big step forward to give people more control over their online lives by Joining Firefox. We’re also exploring ways we can help ensure people stay in control of their data after the Supreme Court’s decision in Carpenter v. United States.

In Carpenter, the Court decided that tech companies shouldn’t turn over their customers’ cell phone location information without a warrant because users have a “reasonable expectation of privacy” in that data. Courts have often said that giving data to a company takes away any reasonable expectation of privacy and the government doesn’t need a warrant to get it. In Carpenter, the Supreme Court said people still expect cell location data to stay private because it is so sensitive and users are so unaware that companies even have it. We at Mozilla think this may be an opportunity for privacy-conscious companies like us to do more to ensure people can have a reasonable expectation of privacy in more of their online data.

The question is: what do courts consider a “reasonable expectation of privacy”? The courts that have wrestled with this question so far ask basically two questions: (1) does the person know they gave the information to someone else, and (2) how private is the information? But they rarely rely on data showing what people actually expect, and there are certainly other questions that affect a reasonable expectation of privacy:

• What kinds of data do people actually expect to be private?
• What kinds of data reveal more information than we expect?
• Are people more likely to expect that their data will stay private if they give it to a company with a strong reputation for privacy?

In 2019, we’re thinking a lot about Carpenter v. United States and exploring ways we can help affect people’s expectations of privacy.