The words were written for a world of muskets and sealed letters. The Fourth Amendment to the US Constitution, ratified in 1791, says: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." For two centuries American courts have struggled to apply those words to telephones, cars, computers and phones that hold more about a person than any house ever did. Europe took a different path, building a broad law of data protection. Comparing the two shows the main choices any society faces.
From trespass to expectations
In Olmstead v. United States (1928), federal agents tapped a bootlegger's phone lines from outside his property. The Supreme Court held that this was not a search, because the agents had not physically entered his home. Louis Brandeis, now a justice, dissented. The framers, he wrote, had conferred "the right to be let alone, the most comprehensive of rights and the most valued by civilized men." He warned that new technology would give government ways to invade privacy far beyond wiretaps.
Brandeis's view won in Katz v. United States (1967). Agents had placed a recording device on the outside of a public phone booth where Charles Katz placed illegal bets. The Court held that the Fourth Amendment guards people wherever they reasonably expect privacy, not just certain physical places. Justice John Marshall Harlan's concurring opinion offered the test courts still use: a search occurs when the government intrudes on a reasonable expectation of privacy, meaning one the person actually holds and that society is prepared to accept as reasonable.
The third-party doctrine
The Katz test soon ran into a problem. In United States v. Miller (1976) and Smith v. Maryland (1979), the Court held that people have no reasonable expectation of privacy in bank records or in the numbers they dial, because they have voluntarily given that information to a bank or a phone company. This rule, the third-party doctrine, says that information you share with a business loses Fourth Amendment protection. In a world where nearly everything passes through companies, it threatened to swallow the amendment.
The Court has since begun to adjust. In Riley v. California (2014), it ruled unanimously that police generally need a warrant to search the phone of a person they arrest, noting that a phone holds the record of a whole life. In Carpenter v. United States (2018), a 5 to 4 decision, it held that police generally need a warrant to obtain seven days or more of historical cell phone location records, even though a phone company holds them. Chief Justice John Roberts wrote that such records reveal intimate details of a person's life. The Court called its ruling narrow, and how far it reaches is still being argued.
America's patchwork of statutes
The United States has no single, comprehensive federal privacy law. Instead it has a patchwork of laws for particular sectors: FERPA (1974) for student records, HIPAA (1996) for health information held by doctors, hospitals and insurers, and COPPA (1998) for children under 13 online. One of the oddest is the Video Privacy Protection Act of 1988, passed after a newspaper published the video rental history of Supreme Court nominee Robert Bork. States have filled some gaps: California's Consumer Privacy Act of 2018 gave residents rights to know and delete data that businesses hold about them, and many states have followed.
Europe's GDPR
Europe treats data protection as a fundamental right, written into the EU's Charter of Fundamental Rights. Its main law, the General Data Protection Regulation, or GDPR, has applied since May 2018. Its core principles include data minimization: collecting only the data needed for a stated purpose, and purpose limitation, which bars reusing data for unrelated ends. Every use of personal data needs a lawful basis; consent is only one of six.
The GDPR gives people rights to see their data, correct it, move it to another service, object to some uses, and in some cases have it erased, often called the right to be forgotten. Organizations must normally answer a request to see one's data within one month. Fines can reach 20 million euros or 4 percent of a company's worldwide annual turnover, whichever is higher. In 2023 Ireland's regulator fined Meta 1.2 billion euros for transferring Europeans' data to the United States without adequate protection. The law also applies to companies outside Europe that serve people in Europe, so its rules spread worldwide.
The GDPR has critics. Cookie banners that nobody reads have become a symbol of consent fatigue. Compliance costs fall hardest on small firms, and enforcement against large companies has often been slow. Defenders reply that it has made privacy a board level concern and given ordinary people tools they never had. The Universal Declaration of Human Rights also protects against arbitrary interference with privacy.
Worked example: asking what they know
Lena, who lives in Germany, has used a fitness app for three years. She sends the company a request under the GDPR asking for all the data it holds about her. Within a month she receives her workouts, her heart rate history, her location traces and a list of the companies her data was shared with. She asks for her location history to be deleted and objects to her data being used for marketing.
Her cousin in a US state without a privacy law uses the same app. He has no general legal right to see that list. If police wanted his location records, though, Carpenter suggests they would usually need a warrant. The two systems protect different things: Europe focuses on what companies may do with data, while American law has focused mainly on limiting the government.