On June 29, 2026, the Supreme Court decided Chatrie v. United States in a 6-3 ruling that surprised many legal observers. The holding was narrow: police need a valid warrant before demanding location history data from app providers through a geofence. But the logic the Court used to reach that conclusion was not narrow at all, and in the weeks since the decision, privacy lawyers and technology companies have been quietly working through what it means for personal data stored in the cloud far beyond location history.
If you store personal files, photos, or memories in a cloud service, you now have more legal protection than you probably realized — and the nature of that protection just changed.
What Geofence Warrants Are
A geofence warrant is a type of government demand directed not at a specific person but at a specific location and time. Law enforcement identifies a geographic area — a city block, a park, a crime scene — and requests from a technology company the identity of every device whose location history shows it in that area during a particular window.
Google has processed more geofence warrants than any other company, because Google’s Sensorvault database — the backend behind Google Maps Timeline — retains precise, continuous location histories for hundreds of millions of users. A single geofence warrant can produce hundreds of names, none of whom are individually suspected of anything when the warrant is issued.
The Chatrie case arose from a 2019 armed bank robbery in Virginia. Investigators served Google with a geofence warrant covering the bank’s area and used the resulting data to identify Okello Chatrie as a suspect. Chatrie challenged the constitutionality of the warrant at trial and lost. He appealed through the federal courts and eventually to the Supreme Court.
What the Court Decided — and Why the Reasoning Matters
The Court’s majority opinion, written by Justice Barrett, held that when a person stores sensitive location history in a cloud service — particularly a history that maps their movements over an extended period — they retain a reasonable expectation of privacy in that data, even though it’s technically held by a third party.
This is a significant departure from an older legal doctrine known as the “third-party doctrine.” Under that rule, established in Smith v. Maryland (1979) and Miller (1976), any information you voluntarily share with a third party — your bank, your phone company — loses Fourth Amendment protection. You chose to give it to someone else, so the government can get it from that someone else without a warrant.
The Chatrie majority explicitly refused to apply the third-party doctrine to comprehensive location history. The reasoning: when Google tracks your location continuously as a byproduct of you using a phone, you’re not knowingly “sharing” that data with a third party in any meaningful sense. The data accumulates passively. You didn’t hand it over voluntarily.
The Court’s phrasing is what privacy lawyers are now studying closely. The majority said individuals retain Fourth Amendment protection in “data a person reasonably views as their own.” They pointed to location history as a clear example. But they pointedly did not say only location history qualifies.
The Reach Beyond Location Data
The “reasonably views as their own” standard is broader than it sounds, and intentionally so.
WilmerHale, a law firm that filed an amicus brief in the case, observed in a post-decision analysis that the Court’s logic “stretches more broadly to other private data in which a person retains an expectation of privacy” — and that cloud-stored information people regard as personal, including photos, journals, documents, and messages, likely qualifies under this framing.
This matters for three concrete scenarios:
Government demands to cloud services
Under the old third-party doctrine reading, government agencies could argue that any data you upload to a cloud service is voluntarily shared with that service, and therefore fair game without a warrant. Courts applying the doctrine strictly have used this reasoning to approve broad data demands.
Post-Chatrie, that argument becomes harder to make. If a court applies the majority’s “reasonably views as their own” standard, personal files stored in the cloud — photos, private documents, personal notes — are much more likely to require a valid, individualized warrant before a cloud provider can be compelled to turn them over.
Geofence-style broad sweeps of cloud data
The Chatrie decision doesn’t only affect requests for specific individuals’ data. It limits the kind of broad, location-based sweeps the government had been using to generate suspect lists. If similar logic applies to other cloud data, it limits the government’s ability to demand records on all users who uploaded a file from a particular location, or who used a particular app during a particular time window.
The third-party doctrine under pressure
The ruling extends a trajectory that the Court has been on since Carpenter v. United States (2018), when it held that cell-site location information also required a warrant, breaking from the third-party doctrine for a different category of location data. Chatrie applies that reasoning to cloud-stored data more broadly. The direction across multiple decisions over the past decade has been a gradual recognition that the third-party doctrine — written for a world of phone company records and paper bank statements — does not map cleanly onto a world where virtually every piece of personal information passes through some cloud service.
What Didn’t Change
The ruling is not a blanket warrant requirement for everything, and the Court left significant questions open for future cases.
It did not specify exactly how narrowly drawn a geofence warrant must be to satisfy Fourth Amendment requirements of probable cause and particularity. Geofence warrants will continue — they’ll just face additional scrutiny, and courts will work through what “valid” means in practice case by case.
It did not hold that cloud storage is categorically private. The “reasonably views as their own” standard is intentionally flexible. Data shared publicly, or data shared with other users, is less likely to qualify. The protection is strongest for data a person keeps private and does not share beyond the storage provider.
It did not address encrypted storage specifically. Whether a cloud service provider can comply with a lawful warrant depends on whether the provider can actually decrypt the data. For services that hold decryption keys — which is the vast majority of cloud storage providers, including those using server-side AES-256 encryption — legal compliance with a valid warrant is technically possible. For services with genuine zero-knowledge encryption, where the provider holds no keys, technical compliance is impossible regardless of the legal standard.
It did not affect government demands from outside the US. The Chatrie ruling applies only to U.S. constitutional law and only to U.S. government demands. Users in jurisdictions with less robust privacy law face different situations, and US-based cloud services can still be compelled by foreign governments under their own legal frameworks.
What This Means Practically
If you store personal files in the cloud, the Chatrie decision makes a few things clearer.
The legal framework for government access just shifted. The third-party doctrine was a reason to be pessimistic about government access to cloud data. Chatrie is a partial correction — not a complete one, but a meaningful one. Personal files stored in a cloud service are now harder for government agencies to obtain without a valid, particularized warrant.
Technical and legal protections both matter. Chatrie creates legal friction against unauthorized government access to your cloud data. It does not create technical friction — that requires encryption architecture. A cloud service that encrypts data at rest with AES-256 provides protection against unauthorized external access at the storage layer, but the provider still holds the decryption keys and can comply with a lawfully issued warrant. Neither technical nor legal protection alone is the complete picture.
Transparency reports have become more useful. Cloud services that publish transparency reports listing how many government requests they received — and how many they challenged or complied with — provide meaningful information about how often their infrastructure faces demands of this kind. Post-Chatrie, providers who receive these demands should now be challenging ones that don’t meet the new warrant standard. Transparency reports will show whether they’re actually doing so.
Jurisdiction of the provider matters more. Where a cloud service is incorporated, what jurisdiction’s courts govern its data disclosure obligations, and how it has handled prior government requests all affect the practical privacy of your data. The Chatrie ruling applies to US courts interpreting the Fourth Amendment; other jurisdictions operate under different frameworks, some more protective and some less.
The Broader Trajectory
The Chatrie decision didn’t emerge from nowhere. It’s part of a sequence of cases in which the Supreme Court has incrementally constrained the third-party doctrine as it applies to modern technology:
- Kyllo v. United States (2001): Thermal imaging of a home counts as a search, even though the heat is radiated outside the structure.
- Riley v. California (2014): Police need a warrant to search a cell phone incident to arrest.
- Carpenter v. United States (2018): Warrant required for historical cell-site location information.
- Chatrie v. United States (2026): Warrant required for cloud-stored location history; “data a person reasonably views as their own” retains Fourth Amendment protection even in third-party hands.
The pattern is technology-by-technology, each decision creating precedent that the next case extends. The Court has not overruled the third-party doctrine. It has, across these decisions, carved out a growing category of personal data that the doctrine simply cannot reach without strain.
What comes inside and outside that category will be litigated case by case — whether health records synced to a cloud service qualify, whether search histories count, whether the contents of email in long-term cloud storage is covered. But the direction is clear: toward more, not fewer, legal protections for personal data held by cloud providers.
What to Look For
If the Chatrie ruling affects how you think about where you store personal files, a few concrete factors are worth evaluating:
Government request disclosures. Cloud services that publish transparency reports give you a record of how many legal demands they’ve received and how many they’ve challenged. A service that routinely challenges overly broad or legally deficient demands is providing something meaningfully different from one that complies without scrutiny.
Data minimization. A provider that doesn’t retain data indefinitely and that collects only what is needed to provide the service reduces the volume of data available to respond to any government demand. Retention limits are a practical privacy protection independent of legal doctrine.
Encryption architecture. A provider’s ability to technically comply with a lawful warrant — or to truthfully claim it cannot — depends on whether it holds the decryption keys to your files. Server-side encryption with provider-held keys means compliance is technically possible. Zero-knowledge encryption means it isn’t, regardless of what a court orders. That’s a meaningful difference in how much your privacy depends on the legal system working correctly.
The Chatrie decision is not a reason to restructure your entire digital life. It is a reason to understand that the legal protection for personal data in the cloud just got meaningfully stronger — and to ask whether the cloud services you use are prepared to defend that protection when they receive a demand.
The Right Question
Most people evaluating cloud storage ask “is this secure?” and treat the answer as a technical question about encryption. The Chatrie decision is a reminder that security is also a legal question: who can compel the provider to hand over your data, under what standard, and what does the provider do when they receive that demand?
Technical encryption, legal protections, and provider policies all operate in parallel. A cloud service with strong encryption and weak government-demand practices is different from one with both in place. The Chatrie ruling strengthens the legal layer. Whether any given provider takes that protection seriously is a separate question worth asking directly.