By John Ellis[1]
Editor’s Note: This article is a companion to our earlier primer on Chatrie v. United States, which explained the Supreme Court’s June 29, 2026, holding that obtaining a person’s Google Location History through a geofence warrant is a Fourth Amendment search. See The Fourth Amendment Catches Up to Digital Dragnets.
Here we turn from Google to the wireless carriers. Our thesis is simple: because Chatrie forecloses the government’s no-search and third-party defenses to carrier location data, the real fight over cellular area searches now moves to the warrant itself—its probable cause, particularity, and execution, and whether good faith can save a defective one. Google has started storing Location History on users’ phones instead of its own servers, which makes the classic Google geofence warrant harder to run. The technique law enforcement is turning to instead is the cellular area search, in which a search warrant requires a wireless carrier to determine which devices were within a specific geographic area during a certain time-period. This piece explains what those searches are, how their Timing Advance and proprietary location-estimate data compare to the records in Carpenter and Chatrie, and why Chatrie‘s reasoning reaches them with at least equal force. Because these searches already proceed by warrant, Chatrie‘s significance is not that it requires one; it is that it puts the warrant’s probable cause, particularity, and execution squarely in play. Defenders and CJA practitioners handling carrier location evidence should read this alongside the Chatrie primer and assess the implications now.
When the Supreme Court decided Chatrie v. United States on June 29, 2026, the case arrived as a dispute about Google geofence warrants. The Court held that police conduct a Fourth Amendment search when they obtain a person’s historical Google Location History—even when the period is only two hours and even though the records are held by a third party. But the opinion’s logic is not limited to a particular Google product. Instead, it addresses a method of investigation: define a place and a time, search the location records of an unknown group of people, and work backward until someone emerges as a suspect.
The Chatrie Court vacated the judgment below and sent the case back for consideration of whether the warrant satisfied probable cause and particularity at each stage. See Google Data and the Geofence Warrant Process. While Chatrie did not invalidate geofence warrants categorically, it did something more foundational: it required the government to defend its acquisition of historical location data as a Fourth Amendment search.
That matters well beyond Google. Google now generally stores Maps Timeline data on users’ devices, with an optional encrypted cloud backup. As the old server-side geofence model diminishes, its most obvious successor is the cellular area search: a carrier geofence that begins with a geographic boundary and time window and returns the devices the carrier estimates were there. The database is different, but the investigative architecture is the same.
What a Cellular Area Search Does
A cellular area search requires a wireless carrier to identify devices that its system estimates were within a specified area during a specified period. The process begins when law enforcement identifies a geographic area. In the following example, the request is represented by the blue circle, which has a diameter of approximately 600 meters.
Depending on the carrier and the request, the warrant return includes two distinct categories: Timing Advance data and Proprietary Location Estimates.
Timing Advance is a network synchronization measurement. A cell site measures signal latency and uses it to keep a handset’s transmissions properly timed. Although Timing Advance is a measurement of delay, it can be expressed as an inferred distance. Buildings, terrain, signal reflection, network configuration, and other forms of multipath propagation can distort the inference; the numerous problems with using Timing Advance to determine the distance from the tower are beyond the scope of this article.
Here, the device’s Timing Advance arc crosses into the area law enforcement defined, so the carrier treats the device as responsive and includes it in the return. A match of this kind reflects where the arc places the device, not a verified location.
Proprietary Location Estimates go a step further. These are estimated geographic coordinates, sometimes paired with a confidence rating or radius. They are produced by algorithms the carrier developed for its own business, engineering, and network-optimization purposes, and are often categorized as specialized historical location data, distinct from the Timing Advance band-distance values used in traditional forensic mapping. See, e.g., Inside the Black Box: Excluding Evidence Generated by Algorithms. The confidence rating reflects only the provider’s own assessment of how much certainty it assigns to a given estimate, not an externally validated margin of error. And because the algorithms are proprietary and unpublished, their accuracy cannot be independently determined, verified, or peer-reviewed by forensic examiners or the scientific community. This is one reason practitioners are cautioned against relying on these estimates uncritically in legal proceedings.
Here, the carrier places the device’s estimated coordinate at the edge of the defined area—represented by the black circle, so the device is included in the return. Because that coordinate is an algorithm’s computed estimate rather than a measurement, a point that lands just inside, or just outside, the boundary may not reflect where the device actually was.
How an Area Search Differs from a Tower Dump
An area search is related to a tower dump, but the two are not identical. A tower dump identifies devices that were connected to one or more specified towers during a particular period. Because a tower may serve a large and irregular coverage area, the return can include phones located well beyond the immediate crime scene. An area search purports to be narrower. Instead of returning every device that used a tower, the carrier filters its records using an estimated geographic position and returns devices it places inside a defined radius or polygon. But narrower does not necessarily mean more reliable. A tower dump rests on the historical fact that a device communicated with a particular site or sector. An area search depends on the carrier’s estimate of where that device was—a conclusion that may rest on proprietary methods, uncertain confidence thresholds, and imperfect radio conditions.
Both techniques nevertheless share the same constitutional structure. They begin with an unidentified population, collect information belonging largely to people not suspected of wrongdoing, and use comparison and elimination to generate suspects. Courts evaluating tower dumps have already recognized their inherently sweeping nature and the likelihood that they will expose information belonging to uninvolved people.
Why Chatrie‘s Reasoning Reaches Cellular Area Searches
Chatrie turned on three points that are relevant to area searches: that historical cell phone location data is protected, that a brief time window is not exempt, and that the third-party doctrine does not defeat it. Each of these principles applies with at least equal force to area-search records.
1. This Is Protected Historical Cell Phone Location Data
An area search is, if anything, an easier case than Chatrie, because carrier records are the very category Carpenter protected. Google Location History was generated by a technology company’s consumer feature; carrier location records are historical cell-phone location information generated and retained by a wireless network to reconstruct where a device was. Chatrie emphasized that everything Carpenter relied on in protecting Cell Site Location Information (“CSLI”) applied “as well or better” to Google Location History, and it described the protected category broadly: when the government accesses historical cell-phone location information, Location History and CSLI alike, it conducts a search.
The precision of a particular area search may fall somewhere between conventional CSLI and Google Location History. But that does not place the technique outside the doctrine. The point of the carrier’s query is to reconstruct where devices were and to identify people from that reconstruction. That is precisely the governmental capability that animated both Carpenter and Chatrie. Lower precision is not necessarily constitutionally reassuring. An inaccurate system may expose less about the movements of each individual while exposing the records of more innocent people. Imprecision can reduce evidentiary reliability while increasing the breadth of the sweep.
2. A Short Time Window Does Not Create a Fourth Amendment Exemption
A short window does not exempt an area search from the Fourth Amendment. In Chatrie, the government argued that two hours of location data was too little to be a search, and the Court rejected that proposed “grace period.” Even a brief window can disclose a visit to a home, hospital, lawyer’s office, place of worship, or political gathering. More fundamentally, whether surveillance is a search cannot depend on what it happens to reveal after the fact—the government cannot inspect a protected record first and decide only afterward, based on whether the result proved sensitive, whether the Fourth Amendment applied. Thus, an area search covering one location for thirty minutes or an hour does not escape scrutiny; Chatrie forecloses any categorical argument that location surveillance falls outside the Fourth Amendment below some undefined number of hours.
3. The Third-Party Doctrine Is Especially Weak Here
The third-party doctrine is even weaker here than it was in Chatrie, because carrier location data is generated more automatically than Location History. In Chatrie, the user had affirmatively enabled a Google feature, yet the Court still held the resulting information was not voluntarily shared in the traditional sense; modern cell-phone use does not amount to consent for the government to inspect a person’s historical movements. Carrier records require even less of the user: a phone must communicate with the network to function, and the network creates timing, registration, site, and sector records as an incident of providing service, without the user meaningfully choosing to disclose anything. If enabling a consumer feature did not surrender Fourth Amendment protection in Chatrie, carrying a functioning phone should not either. Carpenter rejected that premise for CSLI, and Chatrie reinforced it: a person does not relinquish privacy in location information simply by doing the ordinary things cell-phone users do.
The Deeper Problem: The Search Identifies Its Own Targets
The most important feature of an area search is architectural. A conventional warrant defines its object before execution: the place to be searched and the persons or things to be seized. A cellular area search defines a geographic boundary and time window, but the people whose records it will examine are unknown when the warrant is issued. The government uses the search itself to discover who its targets are. Put differently, the government does not begin with a person whose records it has probable cause to obtain. It begins with a crowd and searches the crowd’s location records until a person of interest emerges.
That was also the structure of the warrant in Chatrie. At the first stage, Google produced location data for every device within the geofence. Officers then selected subsets for additional location information and ultimately for identification. The majority stressed that the warrant said little about how those selections would be made. Justice Jackson went further, concluding that the later stages gave officers too much discretion and operated without a meaningful judicial check, resulting in a “roving commission” to decide whose privacy would receive the next level of intrusion. An area search may compress those stages, but the inversion remains. The carrier conducts a search for location records belonging to unknown people and returns those who satisfy its geographic estimate. Investigators then decide which identifiers to pursue, compare, exclude, or unmask.
The reliability problem makes that inversion more serious. The geographic coordinates provided are impacted by multiple factors, including multipath propagation, network conditions, and untested proprietary algorithms. Thus, records outside the intended physical area may be included, while records inside it may be missed. These concerns bear directly on probable cause and particularity. A warrant cannot meaningfully describe the place to be searched if neither the magistrate nor the executing officers understand how the provider translates the requested location into the dataset it actually searches.
Why Chatrie Matters for Area Searches
Where area-search data already requires a warrant, Chatrie‘s importance is not that it imposes one. It is that it settles what kind of government action this is: a Fourth Amendment search for information in which the target keeps a reasonable expectation of privacy. In doing so, it strips away the arguments the government would otherwise use to keep a defective warrant from being tested. The prosecution can no longer defend a thin or overbroad warrant on the theory that no search occurred, that the location records were voluntarily shared with the carrier, or that the demand was an ordinary business records request. The defendant has a privacy interest, standing to challenge the warrant, and suppression available if it falls short. What remains to litigate is the warrant itself, the Court left probable cause, particularity, and good faith open for exactly that. Four questions frame the fight.
1. Probable Cause. Probable cause that a crime occurred at a location, and even evidence that the perpetrator used a phone, does not by itself establish probable cause to inspect the location records of every device the carrier estimates was nearby. The question is whether the affidavit connects the requested dataset to the crime: why the data is likely to contain evidence, why the chosen radius and duration fit the known facts, and whether a narrower request would have sufficed.
2. Particularity. Particularity requires more than a circle on a map. The question is whether the warrant actually constrains the search: the time window, the location fields sought, the identifiers to be produced, the confidence threshold or inclusion criteria, the permitted uses of the return, the conditions for unmasking, and the handling of nonresponsive data. A warrant that leaves officers free to enlarge the area, lengthen the period, change the filtering method, or identify additional users without returning to a magistrate does not.
3. Reasonableness and Execution. Reasonableness turns on what was searched, not only what the warrant authorized on its face. Did the carrier run the precise boundary supplied by police, or a larger bounding area? How many devices appeared in the unfiltered and filtered results? Were low-confidence estimates included? Were records obtained or examined outside the authorized period? Was uninvolved data retained or used in other investigations? These execution facts determine whether the search stayed within its authorization.
4. Good Faith. The good faith exception under Leon depends on the warrant that existed, not on the novelty of the technology in the abstract. A warrant that conceals the breadth of the query, omits known accuracy limitations, fails to constrain later identification, or leaves the real scope of the search to the provider and executing officers may be so facially deficient that reliance on it was not objectively reasonable.
Bottom Line
An area search follows the same basic structure that made the Google geofence constitutionally consequential: choose a place, search the historical location records of everyone the system associates with it, and identify a suspect afterward. Because carrier estimates may be proprietary, imperfect, and broader than the physical boundary described in the warrant, these searches may present even sharper questions of probable cause, particularity, and reasonable execution. Chatrie does not dictate the answer to every one of those questions. But it changes where the argument begins. The government must defend a cellular area search as a search—and must justify exactly whose records were examined, why they were examined, under what technical assumptions, and subject to what judicial limits.
[1] John C. Ellis, Jr. is a National Coordinating Discovery Attorney for the Administrative Office of the U.S. Courts, Defender Services Office. In this capacity, he provides litigation support and e-discovery assistance on complex criminal cases to defense teams around the country. Before entering private practice, Mr. Ellis spent 13 years as a trial attorney and supervisory attorney with Federal Defenders of San Diego, Inc. He also serves as a digital forensic consultant and expert.