Days after the release of the mobile game Pokémon Go, a privacy flap ensued from press reports revealing that users on Apple phones who logged in through a Google account had unwittingly granted the developer, Niantic, access to their entire Google account. Moreover, the application’s (app’s) privacy policy allowed Niantic to disclose any information it possessed to third parties or the government for a range of purposes. 1Open this footnote Close this footnote 1 Pokémon GO Privacy Policy, Niantic (July 1, 2016), https://www.nianticlabs.com/privacy/pokemongo/en. …Open this footnote Close Niantic calmed the storm by stating that the permissions grant was not as sweeping as it appeared, that it had only accessed “basic Google profile information,” and that it would update the app to request more limited permissions. 2Open this footnote Close this footnote 2 See William Turton, Pokémon Go Was Never Able to Read Your Email [Updated],
Gizmodo (July 11, 2016, 7:28 PM), http://gizmodo.com/
can-pokemon-go-really-read-all-your-emails-1783479136. …Open this footnote Close The privacy policy, however, remains unchanged. 3Open this footnote Close this footnote 3 Niantic, supra note 1. …Open this footnote Close

While this imbroglio highlighted that real-world societal expectations of privacy are significant, this Essay addresses something crucial that was not as widely discussed. The lack of clarity in three key areas of the legal regime covering electronic surveillance raises serious questions about the legal implications of everyday activities. Both Congress and the Supreme Court must act to ensure that the legal regime advances apace with new technology by updating the Stored Communications Act and recognizing a greater expectation of privacy with regard to information disclosed to third parties.

I. Legal Background

A. The Third-Party Doctrine

Per Katz v. United States, the seminal Supreme Court decision establishing the reasonable expectation of privacy doctrine, “the Fourth Amendment protects people, not places,” but those things that “a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection.” 4Open this footnote Close this footnote 4 389 U.S. 347, 351 (1967). …Open this footnote Close

Thus, per Smith v. Maryland, information “voluntarily conveyed” to a phone company, and thereby exposed to the public, is not protected. 5Open this footnote Close this footnote 5 442 U.S. 735, 744 (1979). …Open this footnote Close Specifically, the Court held in Smith that using a pen register to trace phone numbers dialed is not a search, even though recording “the contents of [a] conversation” would be. 6Open this footnote Close this footnote 6 Id. at 742-43; see also id. at 744 (reasoning that electronic switching equipment “is merely the modern counterpart of the operator” who formerly heard the numbers while connecting calls). …Open this footnote Close Smith was grounded on two cases establishing that financial records voluntarily disclosed to a bank or an accountant were effectively exposed to the public if they were exposed to employees “in the ordinary course of business.” 7Open this footnote Close this footnote 7 United States v. Miller, 425 U.S. 435, 442 (1976) (banks); Couch v. United States, 409 U.S. 322, 335-36 (1973) (accountants). …Open this footnote Close

In each of these cases, information was disclosed to a third party with the intention that that party would put it to use. A third party asked to complete a task must have access to the information required to do so, but not more: We expect the third party to carry a letter, not open it; to connect a call, not listen to it; to cash a check or file a tax return, not collect other unrelated content; and so on.

B. The Stored Communications Act

The Stored Communications Act (SCA), which governs disclosure of information to the government, similarly distinguishes content (“communications”), which enjoys the most protection, and other material (“records”). 8Open this footnote Close this footnote 8 See 18 U.S.C. § 2702 (2015) (voluntary disclosure); id. § 2703 (compelled disclosure). This Essay focuses on compelled disclosure. …Open this footnote Close The SCA was enacted in 1986 as Title II of the Electronic Communications Privacy Act (ECPA) to update the 1968 Wiretap Act in order to resolve uncertainties created by then-new computer technology—in particular, “electronic mail.” 9Open this footnote Close this footnote 9 S. Rep. No. 99-541, at 3-5 (1986) (“[T]he law must advance with the technology to ensure the continued vitality of the fourth amendment.”); H.R. Rep. No. 99-647, at 18-19 (1986) (“Privacy cannot be left to depend solely on physical protection, or it will gradually erode as technology advances.”). …Open this footnote Close

The SCA’s definitions relate back to the Wiretap Act. 10Open this footnote Close this footnote 10 See 18 U.S.C. § 2711(1). …Open this footnote Close It defines the “contents” of a communication to include “any information concerning the substance, purport, or meaning of that communication.” 11Open this footnote Close this footnote 11 Id. § 2510(8). …Open this footnote Close In general, content is that which a user intends to communicate (for instance, the body and subject of an e-mail), and noncontent is information about the means by which it is communicated (for instance, usage logs and header information other than the subject). 12Open this footnote Close this footnote 12 Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1228 (2004); see also Orin S. Kerr, Applying the Fourth Amendment to the Internet: A General Approach, 62 Stan. L. Rev. 1005, 1019-20 (2010). …Open this footnote Close Basic subscriber information is also a noncontent record. 13Open this footnote Close this footnote 13 See 18 U.S.C. § 2703(c)(2). …Open this footnote Close

This line-drawing exercise is important because there are different privacy standards for content and noncontent. Content enjoys greater protection, with content in storage for 180 days or less requiring a search warrant for compelled disclosure and older content requiring a subpoena or court order and user notice. 14Open this footnote Close this footnote 14 Id. § 2703. The law allows voluntary disclosure only in particular cases, such as a dangerous emergency or if the provider inadvertently discovers child pornography or certain other evidence—or by consent of the user. Id. § 2702(b). …Open this footnote Close Noncontent, by contrast, may be accessed through a subpoena or court order without notice. 15Open this footnote Close this footnote 15 Id. § 2703(c). …Open this footnote Close The SCA applies to “the contents of any wire or electronic communication,” as long as the communication is “held or maintained” by the provider “solely for the purpose of providing storage or computer processing services.” 16Open this footnote Close this footnote 16 Id. § 2703(b). …Open this footnote Close That means that e-mail and cloud data are protected, but content held by social networking sites or game developers may not be. 17Open this footnote Close this footnote 17 See id. § 2703(a)-(b); see also, e.g., Declan McCullagh, DOJ: We Don’t Need Warrants for E-Mail, Facebook Chats, CNET (May 8, 2013, 7:00 AM PDT), http://cnet.co/2fGOIC7. …Open this footnote Close

The Supreme Court has not ruled on the constitutionality of the SCA, 18Open this footnote Close this footnote 18 Its only case even mentioning the SCA was City of Ontario v. Quon, 560 U.S. 746 (2010), which dealt with a government employee’s expectation of privacy in a pager device supplied by an employer. …Open this footnote Close but federal circuit courts have found warrantless collection of noncontent constitutional. 19Open this footnote Close this footnote 19 United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008); United States v. Perrine, 518 F.3d 1196, 1204 (10th Cir. 2008); Guest v. Leis, 255 F.3d 325, 336 (6th Cir. 2001). …Open this footnote Close Only one circuit, the Sixth, has considered e-mail content, holding in United States v. Warshak that e-mails (like letters or phone calls) require a warrant to search, even if they are more than 180 days old. 20Open this footnote Close this footnote 20 631 F.3d 266, 286-88 (6th Cir. 2010). …Open this footnote Close The Sixth Circuit distinguished “the mere ability of a third-party intermediary to access the contents of a communication” and “the right of access” from voluntary user disclosure. 21Open this footnote Close this footnote 21 Id. at 286-87. …Open this footnote Close It further distinguished e-mail providers (mere intermediaries) from the banks in United States v. Miller (third-party intended recipients directly involved in financial transactions). 22Open this footnote Close this footnote 22 Id. at 287-88 (distinguishing United States v. Miller, 425 U.S. 435, 442-43 (1976)). …Open this footnote Close

II. The Pokémon Go Kerfuffle

Pokémon Go is an “augmented reality” mobile game that uses smartphone features like cameras and location tracking to allow users to find and “catch” digital cartoons called Pokémon in the real world. 23Open this footnote Close this footnote 23 Nick Wingfield & Mike Isaac, Pokémon Go Brings Augmented Reality to a Mass Audience, N.Y. Times (July 11, 2016), http://nyti.ms/29CGXJr. …Open this footnote Close The game was a smash hit: within two days, it was installed on 5% of Android devices in the United States, and it rivaled Twitter for daily users. 24Open this footnote Close this footnote 24 Clara Ferreira-Marques, Pokemon Game Adds $7.5 Billion to Nintendo Market Value in Two Days, Reuters (July 11, 2016, 10:44 PM EDT), http://reut.rs/29wIhiJ. …Open this footnote Close

But a blog post two days after the game’s release catalyzed privacy concerns: an engineer at a security analytics firm warned that the app was “a huge security risk,” capable of accessing Gmail and Google Drive, Maps, and Photos. 25Open this footnote Close this footnote 25 Adam Reeve, Pokemon Go Is a Huge Security Risk,
Tumblr (July 8, 2016), http://adamreeve.tumblr.com/post/147120922009/
pokemon-go-is-a-huge-security-risk. …Open this footnote Close Social media filled with posts warning about privacy problems, and tech blogs filled with alarmist headlines—updated to reflect a lower state of alarm 26Open this footnote Close this footnote 26 See, e.g., Andrew Cunningham, iOS Version of Pokémon Go Is a Possible Privacy Trainwreck [Updated], Ars Technica (July 11, 2016, 7:00 PM), http://arstechnica.com/?post_type=post&p=921383 (revealing the original headline in the full URL: “Pokémon Go on iOS gets full access to your Google account”). …Open this footnote Close after more skeptical reporters dug into the technical details. 27Open this footnote Close this footnote 27 See, e.g., Turton, supra note 2 (reporting on Reeve’s blog post, supra note 25, with information from other tech experts and Google itself). …Open this footnote Close Niantic issued a statement saying that the permissions request was in error and only basic Google profile information had actually been accessed. 28Open this footnote Close this footnote 28 Id. …Open this footnote Close Soon thereafter, it released an updated version of the app. 29Open this footnote Close this footnote 29 See Brian Barrett, Update Your Pokémon Go App Now to Fix That Privacy Mess,
Wired (July 12, 2016, 3:08 PM), https://www.wired.com/2016/07/
update-pokemon-go-app-now-fix-privacy-mess. …Open this footnote Close

But serious privacy concerns remain. As the Wall Street Journal and even BuzzFeed noted, the app still tracks phone locations and IP addresses, and Niantic’s privacy policy still allows extensive collection and sharing of data. 30Open this footnote Close this footnote 30 Nathan Olivarez-Giles, ‘Pokémon Go’ Creator Closes Privacy Hole but Still Collects User Data, Wall St. J. (July 13, 2016, 9:11 AM ET), http://on.wsj.com/2acJv2t; Joseph Bernstein, You Should Probably Check Your Pokémon Go Privacy Settings, BuzzFeed, https://www.buzzfeed.com/josephbernstein/
heres-all-the-data-pokemon-go-is-collecting-from-your-phone (last updated July 12, 2016) (noting the potential that law enforcement will access the data). …Open this footnote Close The policy allows disclosure of “any information” in Niantic’s possession or control to the government, law enforcement, or private parties as it, in its “sole discretion,” believes appropriate to respond to legal claims, protect property and people, and “stop any activity that [it] consider[s] illegal, unethical, or legally actionable activity.” 31Open this footnote Close this footnote 31 Niantic, supra note 1. …Open this footnote Close These broader concerns led Senator Al Franken to write a letter to Niantic crediting it for fixing the Google account issue while expressing broader concern about the amount of data collected and the terms of the privacy policy. 32Open this footnote Close this footnote 32 Letter from Sen. Al Franken to John Hanke, CEO, Niantic, Inc. (July 12, 2016), http://www.franken.senate.gov/files/letter/160712_PokemonGO.pdf. …Open this footnote Close

This outcry shows that the old saying “if you’re not paying for the product, you are the product” 33Open this footnote Close this footnote 33 See Derek Powazek, I’m Not the Product, but I Play One on the Internet, Powazek (Dec. 18, 2012), http://powazek.com/posts/3229 (criticizing the phrase). …Open this footnote Close has resonated with the public. That people tolerate a loss of privacy to play Pokémon Go does not mean they like doing so.

III. The Gaps Revealed

In addition to the degree of general public unease about information privacy, this imbroglio highlights the shortcomings of current surveillance law in three key areas: the fuzziness of the content/noncontent divide, the overbroad nature of the third-party doctrine, and the potential for consumer privacy policies to incidentally authorize surveillance.

A. Content

Pokémon Go is a case study in how the content/noncontent distinction outlined in the SCA—and inherent in Smith—struggles in the face of twenty-first-century technology. The location information Niantic collects is almost surely noncontent, since it is the means by which the game digitally “places” Pokémon into the real world. 34Open this footnote Close this footnote 34 Circuit courts have repeatedly held that information that can be used to triangulate a user’s location, such as IP addresses or cell-site records, is noncontent unprotected by the Fourth Amendment. See, e.g., United States v. Carpenter, 819 F.3d 880, 887 (6th Cir. 2016) (cell-site records); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (IP addresses). …Open this footnote Close Similarly, the app requests permission to use a phone’s camera to “see” Pokémon atop real world surroundings. 35Open this footnote Close this footnote 35 Jen McGuire, How to Allow Camera Access on ‘Pokemon Go’ so You Feel
Like You’re in the Pokemon World, Romper (July 20, 2016), https://www.romper.com/p/zhow-to-allow-camera-access-on-pokemon-go-so-you-feel-like-youre-in-the-pokemon-world-14708. …Open this footnote Close These images are not sent to Niantic, but if they were, even they could be noncontent, part of the way Pokémon are “delivered.” While Pokémon Go does not have in-game messaging, Niantic’s first augmented reality game, Ingress, does. Those messages would definitely seem to be content—but, despite Warshak, it is still not clear that dynamic content like messaging is protected by the Fourth Amendment. 36Open this footnote Close this footnote 36 See McCullagh, supra note 17 (noting the Department of Justice’s position that messaging is not content). …Open this footnote Close

B. Third-Party Doctrine

The Sixth Circuit in Warshak distinguished Miller in two ways: first, the bank documents at issue there were “simple business records,” unlike “the potentially unlimited variety of ‘confidential communications’” at issue in an e-mail account, 37Open this footnote Close this footnote 37 United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010) (quoting United States v. Miller, 425 U.S. 435, 442 (1976)). …Open this footnote Close and second, the Miller bank documents were used “in the ordinary course of business,” while the Warshak third party was an “intermediary, not the intended recipient of the emails.” 38Open this footnote Close this footnote 38 Id. (quoting Miller, 425 U.S. at 442). …Open this footnote Close
How would the data Niantic collects on Pokémon Go players fall into this scheme? It may depend. Suppose Niantic had accessed the e-mail accounts of certain users: it would not be an intermediary, let alone the e-mails’ intended recipient. But the material was nonetheless disclosed. What if Niantic had accessed a user’s tax return on Google Drive? The answer to each of these questions may depend on whether Niantic used the data “in the ordinary course of business,” per Smith. But that may beg the question: if consumers are the product, all data collected are par for the course.

C. Privacy Policies

The third issue—perhaps the most important over the long term—is how privacy policies and other user consent agreements impact surveillance law. The court in Warshak noted that “the ability of a rogue mail handler to rip open a letter does not make it unreasonable to assume that sealed mail will remain private on its journey across the country.” 39Open this footnote Close this footnote 39 Id. at 287. …Open this footnote Close Yet that property-based understanding does not translate precisely into the digital world. The SCA allows voluntary disclosure of content with user permission. 40Open this footnote Close this footnote 40 See supra note 14. …Open this footnote Close Accepting a privacy policy gives just this sort of permission. The Department of Justice itself pointed out that the privacy policies of many communications providers grant them far more access to user communications than rogue mail handlers. 41Open this footnote Close this footnote 41 Cf. Comput. Crime & Intellectual Prop. Section, Dep’t of Justice Criminal Div., Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations 146 (3d ed. 2009) (“Terms of service used by network service providers often establish that the provider has authority to access and disclose subscriber email.”). …Open this footnote Close So too the policies of developers like Niantic.

* * *

Summing up, the legal regime governing electronic surveillance lacks clarity in three key areas. First, the SCA’s distinction between content and noncontent is too simplistic to handle hybrid data like messenger texts or aggregated metadata. Second, the Smith “course of business” standard is outdated when it comes to companies like Niantic, which require a significant amount of information just to provide their service, or Google, which is both an intermediary facilitating e-mail and an advertising company that scans e-mails to determine which ads to serve. And third, both the Katz reasonable expectation standard and the SCA’s voluntary consent provision may be implicated by the overbroad contract-of-adhesion-style privacy policies that have become the norm.

IV. Once More into the Breach

What, then, is to be done?

The easy answer is that Congress should update the SCA to create additional privacy protections beyond those required by the Fourth Amendment. 42Open this footnote Close this footnote 42 See generally Orin S. Kerr, The Fourth Amendment and New Technologies: Constitutional Myths and the Case for Caution, 102 Mich. L. Rev. 801 (2004) (arguing that Congress has traditionally acted to fill gaps between the privacy protections a reasonable person might want and those recognized under the Fourth Amendment). …Open this footnote Close In fact, it considered doing so earlier this year. In April, the House of Representatives passed the Email Privacy Act by a vote of 419 to 0. 43Open this footnote Close this footnote 43 Final Vote Results for Roll Call 167, U.S. House Representatives, <a href=”http://clerk.house.gov/evs/2016/roll167.xml”>http://clerk.house.gov/evs/2016/roll167.xml (last visited Dec. 15, 2016). …Open this footnote Close That bill would codify Warshak, which the Department of Justice has voluntarily followed as a matter of national policy since 2013. 44Open this footnote Close this footnote 44 H.R. Rep. No. 114-528, at 9 (2016). …Open this footnote Close It would not refine the distinction between content and noncontent to resolve concerns about disclosure of messaging or other data, nor would it address aggregated metadata or other noncontent. And it would still allow disclosure of content “with the lawful consent of the subscriber or customer,” 45Open this footnote Close this footnote 45 Email Privacy Act, H.R. 699, 114th Cong. § 3 (2016). …Open this footnote Close raising the question whether Niantic’s privacy policy authorizing disclosure in its sole discretion amounts to such consent.

Despite these limitations, the bill enjoyed wide support from the public and tech sector as it moved to the Senate. 46Open this footnote Close this footnote 46 See Coalition Letter in Support of Email Privacy Act (April 26), Ctr. for
Democracy & Tech. (Apr. 25, 2016), https://cdt.org/?p=78320; cf. Andrea Peterson, The Government Often Doesn’t Need a Warrant to Get Your E-mails. But Most Think It Should., Wash. Post: The Switch (Nov. 30, 2015), http://wapo.st/1NY0JaV (reporting that 77% of registered voters surveyed by Vox support a warrant requirement for compelled disclosure of online content). …Open this footnote Close But it got bogged down in the Judiciary Committee thanks to a debate over whether the FBI should have the authority to compel disclosure of metadata via national security letter. 47Open this footnote Close this footnote 47 See Alex Byers & Kate Tummarello, Inside Hillary Clinton’s Tech Policy Orbit,
Politico: Morning Tech (May 27, 2016, 10:00 AM EDT), http://politi.co/1WQtWNX. …Open this footnote Close With the bill removed from the committee’s markup calendar, it is dead for now. If Congress cannot even pass legislation that does little more than codify current policy, the odds of broader reform seem long. But the bill’s overwhelming victory in the House, wide cosponsorship in the Senate, and broad support from the public and tech sector do suggest that the issue will remain on the legislature’s radar. Nonetheless, the failure of the bill to resolve the broader issues raised above shows that even the action Congress is considering lags behind new technology.

Similarly, while the Supreme Court has yet to squarely address the issue of data privacy, there are signs that the Court, and particularly Justice Sotomayor, is thinking about it. In Riley v. California, the Court considered the “vast quantities of personal information” that cell phones contain in holding that police may not search a smartphone in a warrantless search incident to arrest. 48Open this footnote Close this footnote 48 134 S. Ct. 2473, 2485 (2014). …Open this footnote Close And, concurring in United States v. Jones, Justice Sotomayor directly addressed the broad scope of the third-party doctrine, suggesting that warrantless disclosure of aggregated noncontent might violate the Fourth Amendment. 49Open this footnote Close this footnote 49 132 S. Ct. 945, 957 (2012) (Sotomayor, J., concurring) (“I for one doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year. . . . I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.”). …Open this footnote Close Indeed, five Justices in that case embraced the D.C. Circuit’s mosaic theory, the idea that prolonged surveillance could, over time, constitute an unreasonable search. 50Open this footnote Close this footnote 50 Id.; id. at 964 (Alito, J., concurring); see also generally Gabriel R. Schlabach, Note, Privacy in the Cloud: The Mosiac Theory and the Stored Communications Act, 67 Stan. L. Rev. 677 (2015) (explaining the mosaic theory and proposing an amendment to the SCA to incorporate it into statute). …Open this footnote Close

A future Supreme Court decision could read mosaic theory into the Fourth Amendment, resolving some concerns about apps like Pokémon Go that require extensive metadata to run. It could build on Justice Scalia’s majority opinion in Jones, repurposing his trespass doctrine to hold that data are property, regardless of where they are stored. It could conclude, as Katz did for phone calls, that the physical location of data is not crucial to determining societal expectations of privacy. 51Open this footnote Close this footnote 51 Data may in fact be relatively tangible. See Andrew Keane Woods, Against Data Exceptionalism, 68 Stan. L. Rev. 729, 760-63 (2016). …Open this footnote Close Or it could bring Smith into the twenty-first century by offering guidance on whether and how tech companies use data and metadata in the “ordinary course of business.” While it is unclear what direction the Court will take, it is all but certain that creative new applications of technology like Pokémon Go—and the capacity of the government to exploit them—will require the Court to address the issue.

* J.D. Candidate, Stanford Law School, 2017.