The editorial frames the SCOTUS ruling as a landmark extension of Carpenter from a class of data to a class of query. It emphasizes that the Court explicitly rejected the government's multi-stage anonymization defense, characterizing the initial bulk pull as 'a general warrant in everything but name' and requiring particularized probable cause tied to specific devices or narrowly drawn geofences.
The Guardian article, surfaced by cdrnsf with 303 points, reports the 6-3 ruling as a constitutional victory that imposes Fourth Amendment protections on a previously unchecked dragnet technique. The framing treats the decision as a necessary modernization of search-and-seizure doctrine for platform-mediated investigations.
The editorial highlights that the Ninth Circuit had upheld geofence warrants in 2024 while the Fifth Circuit struck them down the same year, creating a split SCOTUS just resolved. By adopting the Fifth Circuit's reasoning, the Court has nationalized the stricter constitutional standard rather than letting the technique persist regionally.
The editorial cites Google's own disclosures — 11,500 geofence requests in 2020 (up from 982 in 2018), at one point exceeding a quarter of all warrants the company received, drawing from a Sensorvault containing hundreds of millions of accounts. These numbers are presented as evidence that the technique had scaled into routine dragnet surveillance, justifying the Court's intervention.
In a 6-3 decision handed down this morning, the Supreme Court ruled that geofence warrants — the law-enforcement technique that asks a platform to identify *every* device present in a defined geographic area during a defined time window — constitute searches under the Fourth Amendment and require particularized probable cause for each device whose data is ultimately disclosed. The majority opinion, authored by Justice Gorsuch and joined by an unusual cross-ideological bloc, extends the logic of *Carpenter v. United States* (2018) from historical cell-site location to the modern, platform-mediated dragnet.
The Court explicitly rejected the government's argument that the multi-stage geofence protocol — anonymized blob, then narrowed list, then de-anonymized targets — insulated the technique from Fourth Amendment scrutiny. Gorsuch's opinion frames each stage as a search, with the initial bulk pull characterized as "a general warrant in everything but name." The remedy: warrants must name the device or account with particularity, or articulate probable cause tied to a specific, narrowly drawn geofence supported by a sworn factual nexus.
The practical numbers behind the case are staggering. Google disclosed in 2021 that it received roughly 11,500 geofence requests in 2020 — up from 982 in 2018 — and that geofence requests at one point made up over a quarter of all warrants the company received. Google's "Sensorvault," the internal location-history store the warrants reach into, contained location data from hundreds of millions of accounts. The Ninth Circuit had upheld the technique in a 2024 ruling; the Fifth Circuit struck it down the same year. SCOTUS just resolved the split.
This is the first time the Court has named a specific platform-mediated investigative technique and held it unconstitutional as routinely practiced. *Carpenter* was about a class of data (historical CSLI); today's ruling is about a class of *query*. That distinction is the one engineers should care about, because the constitutional defect the Court identified isn't the data — it's the shape of the request.
For years, the platform-side compliance argument has been: we have lawful process, we narrow as much as we can, we respond. The Court has now said that posture is insufficient when the process itself is structurally a fishing expedition. Read the opinion carefully and what it really targets is the *protocol* — the anonymized-then-deanonymized funnel that Google itself designed in 2016 to make the requests legally palatable. The Court called that design choice out by name. Gorsuch: "A procedure engineered to defeat particularity does not, by virtue of its engineering, satisfy it."
The ruling lands in the middle of a quiet but real industry shift. Apple does not maintain the equivalent of Sensorvault — its location data is largely on-device by design, which is why Apple receives a tiny fraction of geofence requests relative to Google. The architectural choice Apple made a decade ago for marketing reasons is now, retroactively, a legal moat. Google has been migrating Location History to on-device storage since late 2023, with the migration scheduled to complete in 2024. The timing is not a coincidence; the company has been reading the same tea leaves the Court just confirmed.
Community reaction on HN (303 points, 600+ comments at last check) split roughly three ways. The civil-liberties bloc treated it as the most significant Fourth Amendment ruling since *Carpenter*. The skeptics noted, correctly, that the opinion leaves the door open for "sufficiently narrow" geofences — meaning a warrant for a 30-meter radius around a known crime scene over a 15-minute window is probably still fine. And a small but vocal group of practitioners pointed out that the real teeth will come from how lower courts interpret "particularity" in the next 18 months, not from the opinion itself.
If you run a product that ingests precise location at scale, the compliance question has changed shape. The defensible architecture is no longer "respond carefully to lawful process" — it's "design so the dragnet query is technically impossible to fulfill." That means: on-device storage by default, server-side aggregation only over k-anonymous buckets, retention windows measured in days not years, and — most importantly — no indexed reverse-lookup from `(lat, lng, time) → user_id`. If your schema has that index, you are the next Sensorvault, and your legal team will eventually find out the hard way.
Ad SDK vendors and the long tail of apps that embed them are the most exposed. Most ad SDKs ship precise location to a server-side bidstream where it's joined to a device graph; that join is exactly the kind of reverse-lookup the ruling implicitly targets. Expect a wave of SDK updates over the next two quarters reducing precision to ZIP+4 or H3 cell level 8, and expect the IAB to issue new guidance. If you ship a fitness app, a ride-share, a delivery app, or any BLE-attendance product, audit your retention policy and your query surface this quarter — not next year.
For backend engineers specifically: the operationally relevant change is that "we can produce this report" is now a liability, not a feature. Capability is exposure. If a prosecutor or a plaintiff's lawyer in civil discovery can credibly argue that you have the technical ability to identify everyone in a radius at a time, you will be asked to do it, and the legal cost of refusing has just gotten cheaper while the cost of complying has gotten more expensive. The path of least resistance is to not have the capability at all.
The next 18 months will be about lower-court interpretation of what counts as "sufficiently narrow," and about whether the logic extends to adjacent techniques — keyword warrants (Google searches for a specific term), tower dumps, and the IP-address-pool queries that have quietly replaced geofences in some jurisdictions since 2023. The opinion's reasoning, focused on the *shape* of the query rather than the data type, reads as if it was written to be extended. Expect the EFF and the ACLU to test exactly that within the year. For builders, the cleanest read is the simplest one: the data you don't have can't be subpoenaed, and the index you didn't build can't be searched.
The implications are far reaching beyond cell phones. any service that stores location data for it's user is subject to 4th amendment expectations _regardless_ of an opt-in. The court specifically rejected the argument that by opting-in the user is abrogating their privacy rights. If you centra
I always like to mention how Paula Broadwell was identified as David Petraeus' mistress as it's a good example of how even without a phone you can still be identified.- FBI had three distinct IPs linked to emails- They geolocated those back to 3 different hotels- They pulled the guest list
It's such a little thing but while reading the opinion I see that the court (Kagan in this case?) makes a factual claim it provides SOURCES.https://www.supremecourt.gov/opinions/25pdf/25-112_0am4.pdf"Modern cell phones, we observed a dozen years ago, are “such a pe
If it is reasonable to have your privacy in a public place, does this mean that products like Flock which indiscriminately violate your privacy would now require a warrant for law enforcement to access (currently they do not)?
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
From https://www.scotusblog.com/2026/06/court-rules-that-law-enfo...Additional details:> The information that Google provided to law enforcement officials came in three tranches. First, Google gave law enforcement officials a list of the 19 accounts (but without the names