The front door
Start with the win, because it is real and a generation of privacy lawyers has waited for it.
On June 29, 2026, the Supreme Court decided Chatrie v. United States, and held — six to three, Justice Kagan writing for the majority — that Americans have a reasonable expectation of privacy in their detailed location-history records, and that when the government acquires those records to find a suspect, it has conducted a search within the meaning of the Fourth Amendment. The case came out of a May 2019 robbery of a credit union in Midlothian, Virginia, solved with a Google "geofence" warrant: a demand that the company comb its Location History database and identify every device it had placed inside a 150-meter radius around the building at the time of the crime. The radius swept in a neighboring church — and, in the trial record, a senior-living facility — so that anyone worshipping or sleeping nearby became, by the geometry of the warrant, a device the state could demand be named. Justice Kagan, for the majority, called a person's Location History "a personal journal of a user's movements" and warned that the technique hands the government "a virtual panopticon"; the Court brushed aside as "meritless" the government's argument that you surrender all privacy by opting in to the feature. It was careful about how much it decided: it held only that acquiring the data was a search, vacated the judgment, and sent the case back to weigh probable cause and particularity — and a footnote leaves open whether the evidence comes in anyway under the good-faith exception, so Chatrie himself may yet lose. But the threshold holding is the one that reshapes the doctrine: acquiring your location history is a search, and searches are the Fourth Amendment's business.
The ruling matters beyond its facts because of the doctrine it keeps dismantling. For half a century, American privacy law has labored under the third-party doctrine — the idea, born in the 1970s out of cases about bank records and dialed phone numbers, that information you voluntarily hand to a company carries no reasonable expectation of privacy, and therefore no Fourth Amendment protection at all. In an age when simply living means emitting a constant exhaust of data to third parties, that doctrine is a skeleton key to everyone's life, and the Court has spent the better part of a decade narrowing it: United States v. Jones in 2012 on GPS trackers, Carpenter v. United States in 2018 on cell-site location, and now Chatrie on the geofence. Each carves another category of digital location out of the third-party doctrine and back under the Constitution. And the alignment scrambles the usual map, which is part of why it matters: Justice Kagan wrote for Chief Justice Roberts, Justice Sotomayor, Justice Kavanaugh, and Justice Jackson, with Justice Gorsuch supplying a sixth vote on his own property-based theory — a cross-ideological majority, not the Court's conservative bloc. The three dissenters would have left the old rule where it stood; Justice Alito, writing for them, called the majority's reasoning "an irresponsible escapade" and warned that the Court is improvising a digital Fourth Amendment case by case with no limiting principle — not a frivolous objection. But the through-line of the majority's project is unmistakable, and it is the slow, genuine work of a Court catching up to the surveillance its citizens live inside. Celebrate it.
And then read the part of the holding about who it binds.
The side door
The Fourth Amendment is a restraint on government. That is its entire architecture: it tells the state what it may not do without a warrant. It is, by design and by two centuries of doctrine, silent about private actors — and the surveillance that defines 2026 is overwhelmingly private.
The location trail the Court just protected from a warrantless government grab was not collected by the government. It was collected by Google, by the weather app, by the game, by the dozen advertising SDKs embedded in the free software on the phone, all of it harvested with a tap of "Allow" most people do not remember giving. That data is then sold — into a commercial market of data brokers who aggregate, package, and resell location histories by the billion to advertisers, insurers, landlords, hedge funds, and anyone else with a purchase order. Chatrie does not touch a line of that. The app may still collect it. The broker may still sell it. The buyer may still buy it. The Constitution locked the front door — the one marked "government seizure" — and the entire commercial market is a side door standing open beside it.
And here is the part that turns an awkward gap into a real hole: the government walks through the side door too. For years, federal agencies — components of the Department of Homeland Security, the military, the FBI, tax enforcement — have purchased Americans' location data from commercial brokers precisely because buying it required no warrant, no court, no probable cause: just a contract. Reporting has documented agency after agency licensing products built on brokered location feeds — Venntel, Babel Street's Locate X, Fog Data Science and their peers — to do exactly what a geofence warrant does, without the warrant. They bought what the Fourth Amendment would otherwise have required them to obtain with a judge's signature. Chatrie says the front door now needs a warrant. It says nothing about the side door the agencies have been using all along. A constitutional rule the government can satisfy by becoming a customer is not a wall. It is a turnstile with an exit lane.
Buy what you can't seize
This is the precise mechanism worth naming, because it is the hinge of the whole edition: in the surveillance economy, the warrant requirement and the open market are not two separate problems. The market is the way around the warrant.
The Court's own opinion is the proof of the gap: across all its pages about location privacy, the phrase "data broker" does not appear once. It decided what the government may seize, and said nothing about what the government may buy. Senator Ron Wyden has spent years trying to close that distance with a bill whose title is the entire argument — the Fourth Amendment Is Not For Sale Act — and reintroduced a broader Government Surveillance Reform Act this spring; Montana, in 2025, became the first state to bar its police from purchasing what they would otherwise need a warrant to obtain. That such fixes are necessary, and so far mostly unpassed at the federal level, tells you the gap is real, known, and open. The logic of the loophole is airtight and grim: the Constitution forbids the government from taking your data without process, but says nothing about the government buying it, and a thriving market exists to sell it. So the agency that would need a warrant to compel your location from your carrier simply licenses the same location, scraped from your apps, from a broker who faced no such constraint in collecting it. The government has not even been coy about the theory: a 2021 Defense Intelligence Agency memo stated flatly that the agency "does not construe the Carpenter decision to require a judicial warrant" for location data it buys rather than seizes — and a federal watchdog later found that several Homeland Security components had used purchased location data in ways that broke the law. Every protection Chatrie just announced at the front door can be sidestepped at the side door for the price of a subscription. The decision is a genuine advance in the law of government seizure, and it leaves government acquisition-by-purchase almost exactly where it found it.
That is why the celebration has to be precise about what was won. A reasonable expectation of privacy in your location is a powerful thing to establish in constitutional law; it reshapes every future warrant application and every suppression motion beneath it. But a reasonable expectation of privacy that evaporates the moment the same data is routed through a commercial intermediary is a protection with a commercial-sized hole in it, and the hole is not hypothetical. It is the business model of an entire industry, and a procurement line in an entire government.
Twenty states, thirty without
If the Constitution does not reach the commercial market, what does? In the United States, the answer is: a patchwork, and the patchwork is the problem.
There is no federal consumer-privacy law. The most serious attempt, the American Privacy Rights Act, collapsed in Congress, and in its absence the states have legislated one by one. By mid-2026 two dozen states have enacted comprehensive consumer-privacy statutes — about twenty of them already in effect — from California, Colorado, and Virginia to newer entrants like Indiana, Kentucky, and Rhode Island, live since January, with Oklahoma's freshly signed law set to take effect in 2027. That is real, and in the strongest states it is real protection. But read across them and the patchwork reveals itself: some require you to opt out of data sales, others demand opt-in consent; coverage thresholds swing from thirty-five thousand residents to a hundred thousand; definitions of "sensitive data" diverge; and — the detail that hollows out nearly all of them — only one state, California, gives you even a limited private right of action, and only for data breaches. In the other twenty-three, enforcement falls entirely to a state attorney general's office with finite staff and a fifty-front war, against an industry that monetizes a trillion records a day. (Vermont enacted its 2026 law only after stripping out the private-enforcement clause that had drawn a veto the year before — a tidy illustration of how the teeth get pulled before passage.) A right you cannot personally enforce, against a defendant a regulator lacks the resources to chase, is a right mostly on paper. And that is the situation in the states that have a law. Thirty states have none, which means for a plurality of Americans the commercial location market is bounded by nothing but the sector-specific federal scraps — health, finance, children — and the brokers' own terms of service.
So the map that emerges from June 29 is lopsided in a specific way. Against the government, in all fifty states, your location now enjoys a constitutional floor. Against the market that actually holds your location, you have, depending on your ZIP code, a moderately strong state law you cannot personally enforce, a weak one riddled with exemptions, or nothing.
The Court giveth and taketh
It is worth holding two June terms side by side, because the same Court drew both, and the pairing is the honest measure of where constitutional privacy stands.
In June 2025, in Free Speech Coalition v. Paxton, the Court upheld a state law requiring adults to verify their age — to prove their identity — before accessing lawful online content, six to three, over a dissent written by Justice Kagan. That decision imposed a privacy cost: it blessed the identity checkpoint, and a wave of states have built on it. In June 2026, in Chatrie, a different six-Justice coalition handed down a privacy win — and the author of it was Kagan, the dissenter of the year before. The map is not drawn by a fixed bloc: Chief Justice Roberts and Justice Kavanaugh joined the conservatives to uphold the age checkpoint and the liberals to protect location, the two swing votes deciding digital privacy case by case, on different doctrinal axes — the First Amendment one year, the Fourth the next. One term the Court tells you that being made to show your papers to read is constitutionally fine; the next it tells you that your movements are protected from the police. These are not strictly contradictory — different rights, different doctrines — but together they are a map drawn freehand, with no unifying theory of digital privacy underneath — which means the protection you have is the protection five justices happened to recognize in the last case that reached them, and the protection you lack is whatever they have not yet been asked, or have declined, to extend. Constitutional privacy in 2026 is granted, not guaranteed. Chatrie is a grant. It is not a guarantee, and it is certainly not a system.
The government is a customer now
Underneath the legal mechanics is a structural shift the warrant framework was never designed for, and it is the reason a Fourth Amendment win cannot, by itself, be enough.
The Fourth Amendment imagines a particular adversary: the state, breaking down a door, seizing papers, conducting the search itself. Its entire remedy — the warrant, probable cause, the neutral magistrate — is built around the government as operator of surveillance. But the defining move of the last decade is that the government increasingly does not operate the surveillance. It buys it. The collection is done by the private market, at a scale and granularity no police department could ever staff, and the state arrives at the end of the supply chain as a customer with a credit card, acquiring finished intelligence the Constitution's seizure rules never contemplated. A doctrine that disciplines the government-as-burglar has little to say about the government-as-shopper. This is why Chatrie, real as it is, cannot hold the line alone: it perfects the rule for a kind of government search that is becoming the exception, while the rule that matters — what the state may buy, and what the market may sell it — is written, if at all, in twenty different statehouses and one stalled federal bill.
What location costs now
Make it concrete, because abstraction is how this gets shrugged off. Location is not just where you are; it is what you are doing, who you are with, and what you are afraid of. A location feed shows the route to the clinic, the visits to the lawyer, the nights not spent at home, the meeting at the union hall, the mosque on Friday.
The Federal Trade Commission has spent the last two years bringing exactly this category of case — actions against location-data firms for selling trails that could be traced to reproductive-health clinics, places of worship, and shelters, naming brokers like Kochava, X-Mode and its successor Outlogic, Gravy Analytics and its Venntel arm, and Mobilewalla. After Dobbs, the stakes stopped being theoretical: in a country where the same movement is criminalized in one state and constitutional in the next, a commercially available record of who drove across a state line is a prosecutor's exhibit waiting for a subpoena, and it sits in a broker's database that Chatrie does not reach. Some states have moved on precisely this — Washington's My Health My Data Act treats location near health facilities as protected health data, a model others are copying — but it is, again, a handful of states legislating around a hole the Constitution left and Congress has not filled.
Architecture before law
Here is the throughline this series keeps returning to, and Chatrie sharpens rather than softens it. The law arrives after the data exists. The Fourth Amendment governs what the government may do with a location trail that has already been generated, collected, and stored. It does not stop the trail from being generated. Only the architecture of the device and the discipline of the user can do that.
The two work on different clocks, and each is the other's blind spot. Law disciplines the government after the fact, by the slow accretion of cases like Chatrie — necessary, because the state is the actor that can imprison you, and because rights once recognized constrain every official beneath them. Architecture works before the fact, at the moment of emission: location services off by default, the smallest possible number of apps granted the smallest possible permissions, a hardened mobile OS that lets you deny the SDKs their telemetry, network-layer tools that keep your movements from being the product in the first place. The cleanest way to keep your location out of a broker's database — and therefore out of the government's purchase order — is to never generate the trail. A right not to be tracked by the state is worth having. A life that emits less to track is worth building. Chatrie is the first; only you can do the second, and the surveillance economy is engineered to make sure you don't.
Half a regime
So weigh it honestly, which means refusing both the victory lap and the cynic's shrug.
The victory is real. The Supreme Court extended the Constitution to the most intimate data stream a person emits, dismantled another load-bearing wall of the third-party doctrine, and did it with a clear six-vote majority. Anyone who tells you that does not matter has never had their location turned into evidence. Build on it.
And it is half a regime. It binds the one actor that can jail you and leaves untouched the market that actually holds your data and the government's own habit of shopping in it. Closing the other half is not mysterious — it is a federal privacy law with a private right of action, a ban on the government buying what it would need a warrant to seize, and data-broker rules with enough teeth that a regulator's threat is credible. The blueprint exists; what is missing is the will, and a Court drawing the map freehand cannot supply it, because the Constitution restrains the government and the surveillance economy is mostly not the government — until the moment the government becomes its best customer.
The front door is locked now. That is worth saying plainly and worth defending. But walk around the building. The side door is open, the agencies know where it is, and the only thing standing in it is a patchwork most Americans cannot personally enforce and a third of them do not have at all.
A win against the government is necessary. It was never going to be sufficient. The next fight is the side door.
URnetwork is a peer-to-peer overlay for censorship-resistant transport, designed to resist network-layer Deep Packet Inspection; its February 19, 2026 MCP server release lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer. URnetwork's code is open and auditable. It is an architecture-before-law tool, honest about its scope: it cannot strike down a statute or win a Supreme Court case, but it can keep the movements it carries from becoming a product on the open market — which is the half of the problem the courts, by design, cannot reach.
https://ur.io