The Fourth Amendment protects people’s privacy. This constitutional protection is intended to shield people’s private lives against government intrusion.
Generally, the government cannot enter someone’s home unless a judge issues a warrant. However, in the digital age this shield is no longer holding up. As people share their personal data for access to news, social media and other content, the government can simply purchase the data it wants; no warrant needed.
This erosion of privacy is not happening in the shadows; it is a core characteristic of the digital economy. We, as consumers, have grown accustomed to the relentless data collection that fuels the Internet. We “consent” to having our clicks, locations, messages and preferences tracked, packaged, and sold over and over again. The primary actors in this data marketplace are private companies, driven by large profits from targeted advertising. The problem is that their most eager customer is increasingly the U.S. government.
The legal distinction between government surveillance and corporate data collection has collapsed into a de facto public-private surveillance partnership. Why go through all the hassle of getting a warrant when you can just buy what you need on the open market?
A declassified report recently confirmed that our own intelligence agencies have been acquiring vast troves of Americans’ personal information from commercial data brokers. In one reported case, Customs and Border Protection bought access to travelers’ domestic flight records, short-circuiting oversight required for direct government data collection.
This practice represents a profound threat that transcends consumer rights. It is a structural threat to the very foundation of democracy. The cooperation between commercial data collection companies and state power creates a chilling effect on free speech, association and dissent — bedrock principles of a functioning democracy.
Think about it: would you still search for information on a protest against a government policy, donate to a controversial political cause, or even text a friend your straight opinion if you knew that a three-letter agency could purchase a record of your activities? When the line between private spaces and governmental surveillance blurs, self-censorship becomes a rational response. The public square, where ideas are meant to be debated freely, shrinks. The fear of being targeted by the government can ultimately deter any civic engagement.
This problem is even more urgent as data brokers, ad networks and other companies in the online ad ecosystem are not exactly known for their stellar track record of following privacy laws. For example, in a recent study we found that the majority of websites fail to honor users opt outs of tracking and the sale of their data that they expressed via Global Privacy Control, a new opt out browser signal that is legally binding in California, Colorado, Connecticut and New Jersey. As many companies are not even honoring legally mandated requests for privacy, the data should not end up in the government’s hand at all.
Now, what can we do? The best path forward seems to me a single privacy standard that applies equally to both private companies and the government. To be sure, the Fourth Amendment only applies vis-a-vis the government. There is no way around it. However, at what point is the “government” involved in a data collection activity? No doubt, there will be thorny doctrinal questions that we need to address in order to adapt the Fourth Amendment for the current reality. However, the law is far from set, and we have ample opportunity to improve it.
Most notably, as the Fourth Amendment prohibits “unreasonable searches and seizures,” courts have a wide leeway to determine what constitutes “unreasonable” activities. Current practices of buying data from private companies could be deemed “unreasonable.” Maybe that is not the case for all purchases under all conditions, but courts and legal scholars have already begun refining the ideas about just what requires judicial control.
As a guiding principle, the Fourth Amendment was not created simply to deal with ordinary policing and criminal enforcement but was forged to serve as a bulwark against an authoritarian government. It should be interpreted accordingly.
In the end, protecting our personal data from being sold by profit-driven companies to an ever-watchful government is not just a matter of consumer protection. It is an urgent prerequisite for preserving the integrity of democracy. We should not allow the constitutional promise of privacy to be rendered meaningless by a commercial transaction. Our personal autonomy is not a commodity. It is time the Fourth Amendment reflect that.
Sebastian Zimmeck is associate professor of computer science at Wesleyan University and a renowned expert on information privacy and security.
