UPDATE: The Court reversed itself a year later.

Millions of Americans now have an expanded right to privacy in their cell phone location information, thanks to the 11th Circuit Court of Appeals.

In US v. Davis, the court today ruled that police must obtain a warrant in order to access even one point of historical cell phone location information, called “cell site location” data, from our providers. Unfortunately for the person who challenged the warrantless location tracking, Quartavious Davis, the court also ruled that the cell site location information police obtained without a warrant could be used against him. The “good faith” exception to the exclusionary rule applies in his case, the court found.

But while the decision isn’t great news for Mr. Davis, it’s fabulous news for everyone else in the 11th Circuit, and for the nation at large. The ruling does three very exciting things to expand privacy protections in the US.

First, according to the 11th Circuit, the government mustn’t physically invade our property in order for the Fourth Amendment to be triggered. That’s huge.

In US v. Jones, the Supreme Court found that the police must obtain a warrant to attach a GPS tracker to our cars. The decision in Jones, written by Justice Scalia, rested largely on the physical trespass theory of the Fourth Amendment. Since there was no physical intrusion in the Davis case, the government argued that Jones didn’t apply. After all, there was no physical trespass when police asked Davis’ cell phone company for his location history. The 11th Circuit disagreed, finding that, while the “trespass theory” of the Fourth Amendment might not apply, the “privacy theory”—developed in various other Supreme Court cases over the years, not least of which is Katz—does, and is sufficient to trigger a warrant protection.

Second, today’s ruling rejects the application of the third-party doctrine to information we don’t purposefully give away, which includes cell-site location information. The horrible third-party doctrine states that we lose our right to privacy in any information we give to a third party, like a cell phone company or email provider. This obsolete legal framework is the basis for the NSA’s bulk records surveillance program, and also for lots of terrible surveillance law at the local level.

From the ruling:

…the government argues that Davis did not have a reasonable expectation of privacy because he had theretofore surrendered that expectation by exposing his cell site location to his service provider when he placed the call. The government correctly notes that “the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to government authorities . . . .” United States v. Miller, 425 U.S. 435, 443 (1976). In Smith v. Maryland, 442 U.S. 735 (1979), at the request of law enforcement authorities, a telephone company installed a pen register to record numbers dialed from the defendant’s telephone. The Smith Court held that telephone users had no subjective expectation of privacy in dialed telephone numbers contained in telephone companies’ records. While the government’s position is not without persuasive force, it does not ultimately prevail.

Just like the Massachusetts Supreme Judicial Court found in the ACLU’s case on cell tracking, Augustine, the court here ruled that the third-party doctrine doesn’t apply in the Davis case because Davis did not willingly convey his cell phone location information to anyone. Hilariously, in order to demonstrate that the third-party doctrine doesn’t apply in Davis, the appeals court even trolls the government’s attorneys by using their words against them.

“Supportive of [the] proposition [not to apply the third-party doctrine in Davis] is the argument made by the United States to the jury,” the appeals court writes.

The prosecutor stated to the jury “that obviously…[while Davis] probably had no idea that by bringing their cell phones with them to these robberies, they were allowing [their cell service provider] and now all of you to follow their movements on the days and at the times of the robberies…” Just so. Davis has not voluntarily disclosed his cell site location information to the provider in such a fashion as to lose his reasonable expectation of privacy.

In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy.

Boom. Another location tracking sized hole is cut out of the third-party doctrine.

Third, today’s ruling in Davis broadens privacy doctrine by finding that even one point of cell-site location data is deserving of a warrant protection. Previously, various courts held that while one point of data didn’t require a warrant, many points of data accumulated over time triggered the Fourth Amendment. The many points doctrine is sometimes called the “mosaic theory”—and today’s ruling says we don’t have to rely on the mosaic theory when it comes to cell site location privacy. That’s a huge win.

Here’s how the 11th Circuit explains its ruling about the significance of one single data point:

[Other courts have ruled] reasonable expectation of privacy had been established by the aggregation of the points of data, not by the obtaining of individual points. Such a mosaic theory is not necessary to establish the invasion of privacy in the case of cell site location data.

One’s car, when it is not garaged in a private place, is visible to the public, and it is only the aggregation of many instances of the public seeing it that make it particularly invasive of privacy to secure GPS evidence of its location. As the circuit and some justices [in US v. Jones] reasoned, the car owner can reasonably expect that although his individual movements may be observed, there will not be a “tiny constable” hiding in his vehicle to maintain a log of his movements. In contrast, even on a person’s first visit to a gynecologist, a psychiatrist, a bookie, or a priest, one may assume that the visit is private if it was not conducted in a public way. One’s cell phone, unlike an 20 automobile, can accompany its owner anywhere. Thus, the exposure of the cell site location information can convert what would otherwise be a private event into a public one. When one’s whereabouts are not public, then one may have a reasonable expectation of privacy in those whereabouts. Therefore, while it may be the case that even in light of the Jones opinion, GPS location information on an automobile would be protected only in the case of aggregated data, even one point of cell site location data can be within a reasonable expectation of privacy. In that sense, cell site data is more like communications data than it is like GPS information. That is, it is private in nature rather than being public data that warrants privacy protection only when its collection creates a sufficient mosaic to expose that which would otherwise be private.

Finally, the court found that, while cell site location information doesn’t tell the government exactly where you were standing last week, the precision of the location information in this case was sufficient to trigger Fourth Amendment protection. Even nearness to something reveals sensitive information about us, the court held:

The United States further argues that cell site location information is less protected than GPS data because it is less precise. We are not sure why this should be significant. We do not doubt that there may be a difference in precision, but that is not to say that the difference in precision has constitutional significance. While it is perhaps possible that information could be sufficiently vague as to escape the zone of reasonable expectation of privacy, that does not appear to be the case here. The prosecutor at trial stressed how the cell phone use of the defendant established that he was near each of six crime scenes. While committing a crime is certainly not within a legitimate expectation of privacy, if the cell site location data could place him near those scenes, it could place him near any other scene. There is a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship, or a house of ill repute. Again, we do not see the factual distinction as taking Davis’s location outside his expectation of privacy. That information obtained by an invasion of privacy may not be entirely precise does not change the calculus as to whether obtaining it was in fact an invasion of privacy.

In short, the 11th Circuit finds that a physical trespass isn’t necessary to trigger the Fourth Amendment; the third-party doctrine doesn’t apply to cell phone location information; even one point of data about our historical location can be so sensitive as to require warrant protection; and location information doesn’t have to be as precise as GPS data in order to deserve privacy.

Today is a great day for electronic privacy in the 11th Circuit and throughout the United States.