A Roadmap To Warrantless Surveillance: Carpenter v United States’ Failing Doctrine In The Age Of AI-Data-Brokers

1. Introduction

The Fourth Amendment has a price — $7500 to be exact, what it costs a law enforcement agency to purchase a year’s worth of complete behavioral profiles, detailing everything from a person’s social media scrolling to their doctor’s appointments [1]. No judge, no warrant, and all sourced from private AI data brokers.

In 2022, the American Civil Liberties Union (ACLU) revealed that federal agencies, including the FBI and the Department of Homeland Security, purchased information from Fog Data Science, Babel Street, and other brokers without judicial authorization, essentially exploiting a legal vacuum that enables commercial transactions to perform law enforcement’s surveillance work [2]. In Carpenter v. United States (2018), a case that examined whether the government’s chronicling of cell phone location data constitutes a Fourth Amendment search, the Supreme Court drew a constitutional line at seven days of data [3]. Collect less, and law enforcement can surveil freely. Collect more, and a warrant is required. The Court never adequately justified its reasoning for this temporal benchmark; and neither, it seems, did it anticipate that AI would render the benchmark irrelevant.

Although Carpenter rightfully identified aggregation as the operative constitutional harm under the Fourth Amendment, its temporal framework proves doctrinally inadequate in addressing AI-backed surveillance [4]. In the rapidly growing age of AI, the Court must address this inadequacy — resulting in warrantless government searches — and adopt a revelatory power standard that substantively evaluates what a data-set discloses about a person’s private life, rather than the duration over which it was collected. As AI-powered data brokers assemble comprehensive behavioral profiles in mere hours — easily evading Carpenter’s 7-day rule — the standard shifts from a constitutional protection to a roadmap for circumventing one [5]. Without revision of the standard, law enforcement retains a constitutional license to continue this warrantless surveillance — an outcome that renders the Fourth Amendment’s warrant requirement a useless formality rather than a meaningful protection.

2. A Doctrinal Gap — The Third Party Doctrine, The Mosaic Theory, & Carpenter v. United States

In Carpenter v. United States (2018), Chief Justice Roberts recognized that the act of aggregating data constitutes a Fourth Amendment breach [6]; and yet, his reliance on a temporal threshold left his landmark departure from the third-party doctrine deficient from the outset. Grounded in United States v. Miller (1967) and Smith v. Maryland (1979), the third-party doctrine holds that information voluntarily shared with third parties loses Fourth Amendment protections and effectively ceases to carry a reasonable expectation of privacy [7]. But, in the Carpenter decision, Chief Justice Roberts deviated from the standard set in Miller and Smith, asserting that seven or more days of CSLI data constitutes a Fourth Amendment search necessitating a judicial warrant [8]. In doing so, he drew on the mosaic theory articulated in Justices Alito and Sotomayor’s concurring opinions in United States v. Jones (2012). The opinions asserted that the aggregation of seemingly innocuous data points has the potential to assemble a mosaic of a person’s life that is constitutionally significant, even if any single data point would not be [9]. And while Chief Justice Roberts’ intuition was sound — trying to create a protection for the harm that the mosaic theory identified — his execution was not, limiting the rule to duration rather than disclosure.

Roberts explicitly characterized Carpenter as limited, writing, “Our decision today is a narrow one. We do not express a view on matters not before us: real-time CSLI or ‘tower dumps’... As Justice Frankfurter noted when considering new innovations…the Court must tread carefully in such cases, to ensure that we do not ‘embarrass the future.’” Roberts’ invocation of Justice Frankfurter’s message of caution is telling, unveiling his intention to insulate the Carpenter doctrine from overreach. However, his temporal threshold may have inadvertently done exactly that, and left courts without a limiting principle capable of holding in the face of technological development. Simultaneously, Roberts deliberately declined to substantively dismantle the third-party doctrine and articulate a clear standard for evaluating aggregation [10]. This ambiguity left the rule defined entirely by duration, measuring the harm of surveillance in calendar days rather than what the surveillance actually discloses; and scholars were quick to identify the issue.

Writing in the University of Michigan Law Review, Orin Kerr observed that the Court failed to articulate a doctrinal rule for determining when aggregated data constitutes a mosaic of a person’s life that is constitutionally significant, leaving lower courts without meaningful guidance [11]. The ambiguity has played out exactly in the doctrinal gaps that Kerr highlighted, with courts reaching differing verdicts on GPS tracking, cell-tower data dumps, and other tech-driven surveillance [12]. Courts have struggled to apply Carpenter’s temporal metric to circumstances for which time was never the right measure of surveillance or constitutional harm [13]. The doctrine thus forged a landmark holding based upon a foundation that — in the age of AI — proved particularly brittle.

3. AI Data Brokers Render Carpenter’s Temporal Framework Irrelevant

Setting aside its internal doctrinal failures, Carpenter’s 7-day threshold is rendered constitutionally obsolete by AI-powered data brokers who can easily assemble “a mosaic” from data generated by just a few hours of a user’s ordinary activity — well within Carpenter’s seven day standard. This technological development dismantles the temporal floor that Roberts intended to install as a meaningful protection. In 2024, the Federal Trade Commission reported on massive social media and video streaming services using algorithms and AI models to track, digest, and analyze seemingly innocuous data that actually contained extremely sensitive attributes, from app usage patterns to user location pins [14]. These sweeping technological advances in the world of surveillance lead to a vital shift in the landscape of creating and ascertaining a “mosaic” of personal information that would constitute a search necessitating a warrant. Prior to AI-backed brokers, obtaining mass data dumps and successfully extracting behavioral profiles from them demanded a significant allocation of time and resources for law enforcement, the benchmark that Carpenter intended to pick up on.

Now, agencies are more than aware of the shift in the surveillance space and their newfound ability to excavate commercial location and behavioral data, and are already using it to their advantage. CBS, PBS, and the Brennan Center For Justice among others have already documented both federal and local law enforcement purchasing this data from Fog Data Science and Babel Street, calling the practice “mass surveillance on a budget” [15]. Juxtaposing these technological developments with the Chief Justice’s 7-day benchmark exposes the gaping legal vacuum Carpenter created, not only allowing but enabling government agencies making data purchases to pursue warrantless surveillance.

4. Counter Argument — Statutory Power Over a Judicial Extension

Critics of Carpenter contend that the decision produced doctrinal instability in lower courts, and that extending an already strained constitutional framework to AI surveillance would only compound the problem. Those critics make the case that Congress, rather than the judiciary, is better suited to regulate the rapidly growing AI industry, including AI data-broker purchases [16]. Supporting this claim, they flag the reception of Carpenter in lower courts, decisions which have remained inconsistent in their application of the precedent, with divergent rulings on GPS tracking and cell tower dumps [17]. Critics further assert that these inconsistencies underscore the ways in which the mosaic theory resists doctrinal stability, and as such maintain that the Court should have left the regulation of privacy data entirely to state legislatures [18].

While criticism on the conflicting applications of the precedent holds merit, statutory protection remains a weak remedy. In 2022, Representative Warren for Ohio’s 8th District introduced the Fourth Amendment Is Not For Sale Act, legislation directly prohibiting law enforcement from circumventing the Fourth Amendment by purchases from data brokers [19]. The bill successfully passed the House with a bipartisan vote of 219-199 in mid-April of 2024 [20]. However, the bill — like many pieces of legislation addressing smaller ticket issues not generating polarizing headlines — after being received in the Senate, never went to a vote and ultimately died in early 2025 [21]. This instance so clearly highlights the fragility of statutory protections, being subject to repeal and executive nonenforcement, and most importantly, not substituting for constitutional floors.

5. A Revelatory Power Standard

A revelatory power standard, prioritizing the substance that a dataset produces, rather than how long it takes to collect it, resolves both Carpenter’s doctrinal failure and its technological obsolescence, while maintaining Roberts’ underlying rationale. Under this standard a dataset triggers Fourth Amendment warrant protection when crossing a quantitative threshold of disclosure, rather than a temporal one. Courts applying this standard would substantively evaluate: 1) the sensitivity of the categories of information revealed, such as medical, political, religious or other intimate activity; 2) the degree to which that set of data enables behavioral inferences about a person; and 3) the breadth of the person’s life that can be reconstructed from the aggregate data.

In doing so, the new standard creates a constitutionally viable benchmark in the growing age of AI and restores the warrant requirement for obtaining exactly the kind of mosaic-level surveillance Carpenter’s exception was designed to protect from [22]. Rather than unpredictably expanding the Carpenter doctrine, a revelatory power standard constrains it. Replacing an inadequate temporal benchmark with a case-by-case analysis of substantive disclosure — as established by Justice Harlan’s Katz v. United States (1967) opinion — is precisely the standard courts routinely apply to cases in other Fourth Amendment contexts [23].

Moreover, a revelatory power standard is consistent with and grounded in Roberts’ own language in Carpenter, writing that CSLI “...provides an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations’” [24]. The breach of the Fourth Amendment that Roberts highlights here is inherently revelatory — it’s qualitative, not quantitative. Purchasing a behavioral profile that discloses someone’s religious, medical, political, and other associations — regardless of an AI data broker’s ability to accumulate that data in mere hours — satisfies the substantive threshold of a mosaic requiring a warrant. As such, the proposed standard simply effectuates what the Court sought to address in Carpenter.

6. Conclusion

Chief Justice Roberts’ sentiment that the Fourth Amendment needs to evolve with developing technology was right; but his temporal framework left a gaping hole in the doctrine that law enforcement and AI data brokers are now exploiting. The potential harm resulting from inaction is exceptionally significant. Without doctrinal revision, government agencies will continue to retain a de facto license to pursue mosaic level surveillance of any person simply by purchasing a commercially assembled behavioral profile that — only on a technicality — falls short of the seven day Carpenter standard. Paramount, under the existing standard, the Fourth Amendment’s warrant requirement becomes a procedural formality over a meaningful protection, that a $7,500 data purchase renders completely obsolete. A revelatory power standard closes that gap, without departing from Roberts’ intention to anchor Fourth Amendment protections, and finally builds a constitutional floor durable enough to hold in the era of rapidly developing AI.

Footnotes:
[1] Garance Burke and Jason Dearen, “Tech Tool Offers Police ‘Mass Surveillance on a Budget,’” Associated Press News, September 2, 2022, https://apnews.com/article/technology-police-government-surveillance-d395409ef5a8c6c3f6cdab5b1d0e27ef
[2] Shreya Tewari and Fikayo Walter-Johnson, “New Records Detail DHS Purchase and Use of Vast Quantities of Cell Phone Location Data,” American Civil Liberties Union, July 18, 2022,
https://www.aclu.org/news/privacy-technology/new-records-detail-dhs-purchase-and-use-of-vast-quantities-of-cell-phone-location-data
[3] Carpenter v. United States, 585 U.S. 296 (2018).
[4] Ibid.
[5] Associated Press, “Police Can Track Your Phone With ‘Fog’ Tech Tool,” Associated Press News, September 9, 2022, https://www.ap.org/news-highlights/best-of-the-week/2022/tech-tool-police-track-movement/
[6] Carpenter v. United States, 585 U.S. 296 (2018).
[7] United States v. Miller, 425 U.S. 435 (1976); Smith v. Maryland, 442 U.S. 735 (1979).
[8] Carpenter v. United States, 585 U.S. 296 (2018).
[9] United States v. Jones, 565 U.S. 400 (2012).
[10] Carpenter v. United States, 585 U.S. 296 (2018).
[11] Orin Kerr, “The Mosaic Theory of the Fourth Amendment,” Michigan Law Review 111, no. 3 (2012): 311, https://repository.law.umich.edu/mlr/vol111/iss3/1/
[12] Ibid.
[13] Matthew Tokson, “The Aftermath of Carpenter: An Empirical Study of Fourth Amendment Law, 2018-2021,” Harvard Law Review 135, no. 6 (2022): 1790,
https://harvardlawreview.org/print/vol-135/the-aftermath-of-carpenter/
[14] Federal Trade Commission, “FTC Staff Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users with Lax Privacy Controls and Inadequate Safeguards for Kids and Teens,” Federal Trade Commission, September 19, 2024,
https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-staff-report-finds-large-social-media-video-streaming-companies-have-engaged-vast-surveillance
[15] National Law Review, “FTC Staff Report Warns of Privacy Risks in Social Media Companies’ AI Practices — AI: The Washington Report,” National Law Review, September 26, 2024, https://natlawreview.com/article/ftc-staff-report-warns-privacy-risks-social-media-companies-ai-practices-ai; CBS News and Associated Press, “Thanks to Tech, Police Practice ‘Mass Surveillance on a Budget’ — No Warrant Required,” CBS News, September 1, 2022,
https://www.cbsnews.com/news/police-mass-surveillance-fog-reveal-tech-tool/
[16] PBS NewsHour, “How an Obscure Cellphone Tracking Tool Provides Police ‘Mass Surveillance on a Budget,’” PBS NewsHour, September 1, 2022, https://www.pbs.org/newshour/politics/how-an-obscure-cellphone-tracking-tool-provides-police-mass-surveillance-on-a-budget; Ivey Dyson, Yeshi Milner, and Helen Griffiths, “Documents Reveal How DC Police Surveil Social Media Profiles and Protest Activity,” Brennan Center for Justice, April 20, 2024, https://www.brennancenter.org/our-work/analysis-opinion/documents-reveal-how-dc-police-surveil-social-media-profiles-and-protest; Charlie Brownstein, “Confronting Carpenter: Rethinking the Third-Party Doctrine and Location Information,” Fordham Law Review 92, no. 1 (2023): 183, https://ir.lawnet.fordham.edu/flr/vol92/iss1/5
[17] Ibid.
[18] Paul Ohm, “The Many Revolutions of Carpenter,” Harvard Journal of Law & Technology 32, no. 2 (Spring 2019): 357, https://jolt.law.harvard.edu/assets/articlePDFs/v32/32HarvJLTech357.pdf
[19] U.S. Congress, Senate, Fourth Amendment Is Not For Sale Act, S. 1265, 117th Cong., 1st sess., introduced April 21, 2021, https://www.congress.gov/bill/117th-congress/senate-bill/1265
[20] Warren Davidson, “Rep. Warren Davidson Statement on the House of Representatives Passing the Fourth Amendment Is Not For Sale Act,” press release, April 17, 2024, https://davidson.house.gov/2024/4/rep-warren-davidson-statement-on-the-house-of-representatives-passing-the-fourth-amendment-is-not-for-sale-act
[21] U.S. Congress, House, Fourth Amendment Is Not For Sale Act, H.R. 4639, 118th Cong., 1st sess., introduced July 14, 2023, https://www.govtrack.us/congress/bills/118/hr4639
[22] Carpenter v. United States, 585 U.S. 296 (2018).
[23] Katz v. United States, 389 U.S. 347 (1967).
[24] Carpenter v. United States, 585 U.S. 296 (2018).