The Lawfare Podcast · The Lawfare Institute

Lawfare Daily: The Privacy Law That's Supposed To Be Protecting Us Online Turns 40

April 3, 2026·38 min·3 clips

How the Supreme Court is remodeling the Fourth Amendment to protect privacy in a digital age.

Michael Dreeben, a veteran Supreme Court advocate, delivers opening remarks at Lawfare's event on updating the Electronic Communications Privacy Act (ECPA), which turned 40 years old. He frames the central problem: the Fourth Amendment was written for a physical world of persons, houses, papers, and effects, and its text struggles to encompass electronic and digital information. Dreeben begins with the 1928 Olmstead case, where the Supreme Court ruled that wiretapping did not implicate the Fourth Amendment because it did not involve searching physical objects. Justice Brandeis dissented, predicting that advancing technology would erode privacy unless the Amendment was given room to grow. Nearly four decades later, Katz v. United States in 1967 established the reasonable expectation of privacy test, shifting analysis from physical trespass to privacy expectations. Congress responded with legislation at several points. The Communications Act of 1934 addressed wiretapping after Olmstead. Title III of the 1968 Omnibus Safe Streets Act regulated wiretapping and oral communications. Then in 1986, ECPA and the Stored Communications Act tackled the new problem of email stored on remote servers, drawing distinctions based on a 180-day threshold and the type of communications provider. Dreeben then walks through four landmark cases he personally argued. Kyllo v. United States (2001) addressed thermal imaging of homes. United States v. Jones (2012) involved GPS tracking attached to a car for 28 days, where Dreeben lost on both privacy and property theories. Riley v. California (2014) unanimously rejected extending the search-incident-to-arrest doctrine to smartphones. Carpenter v. United States (2018) held that accessing cell site location information requires a warrant, limiting the third-party doctrine. He recounts each case with candor about the government's losses, noting that in Jones he lost five votes on two separate theories, and in Riley the Chief Justice compared the government's argument to equating a horseback ride with a trip to the moon. Despite these rulings expanding privacy protections, Dreeben identifies structural reasons the Court cannot fill the gap alone: cases arrive seven to eight years after the underlying technology, holdings are deliberately narrow, and the Fourth Amendment only constrains government action, not private companies. Dreeben highlights several unresolved problems. The Katz test has been criticized as circular. The property-based approach revived in Jones lacks clear sources of law. Email privacy remains poorly defined under current statutes. The government can purchase data from brokers without constitutional constraint. And ECPA's territorial limitations create gaps when data is stored overseas, as illustrated by the Microsoft Ireland case. He closes by noting the Supreme Court will hear the Chhatri geofencing case, but maintains that only comprehensive legislative action can address the detailed, granular privacy questions that constitutional adjudication cannot reach.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from The Lawfare Podcast