|

A Reasonable Expectation of Privacy in the Age of AI

ByCurator

The phrase “reasonable expectation of privacy” sounds like a straightforward promise. Someone shares information for a particular purpose and expects it to remain private beyond that purpose. In American constitutional law, however, the phrase has a more specific role. Its history helps explain why everyday expectations of privacy and legal protection do not always align.

In Katz v. United States (1967), FBI agents attached a listening and recording device to the outside of a public telephone booth used by Charles Katz. The government argued that the surveillance involved no physical intrusion into the booth. The Supreme Court nevertheless held that it violated the Fourth Amendment, explaining that the amendment “protects people, not places.”

Justice John Marshall Harlan II’s concurrence supplied the familiar two-part formulation. A person must exhibit an actual expectation of privacy, and that expectation must be one society is prepared to recognize as reasonable. Closing a telephone booth’s door could matter even though the booth stood in a public place (Katz, 1967). Justia U.S. Supreme Court Center

Later cases complicated that protection when information passed through someone else’s hands. In United States v. Miller (1976), the Court held that a bank customer lacked a protected Fourth Amendment interest in the bank records at issue. In Smith v. Maryland (1979), it reached a similar conclusion about telephone numbers recorded by a pen register. Smith concerned dialing information, rather than the contents of a conversation.

These decisions became central to the third-party doctrine. Information voluntarily conveyed to a third party could fall outside Fourth Amendment protection against government acquisition, even when the person expected the recipient to use it only for a limited purpose (Miller, 1976; Smith, 1979). Justia U.S. Supreme Court Center

Digital technology exposed the limits of treating every disclosure alike. In Carpenter v. United States (2018), the Court held that government acquisition of the historical cell-site location records at issue was a search and generally required a warrant. Those records offered an extensive account of a person’s movements, and their generation was not meaningfully voluntary in the same way as an ordinary disclosure.

The Court described its decision as narrow and did not overrule Miller or Smith. Nevertheless, Carpenter showed that information’s revealing nature and the circumstances of its collection matter. Storage by a third party does not automatically resolve every constitutional privacy question. www.supremecourt.gov

AI agents introduce a related, but distinct, problem. An assistant connected to email, financial information, calendars, and health records may bring previously separate parts of a person’s life together. Access granted to complete one task could expose considerably more information than that task requires. Combined records may also support inferences that no single record would reveal.

An agent’s ability to act adds another dimension. A tool that can read messages may also have permission to send them. Malicious instructions embedded in an email or webpage could attempt to redirect the agent toward disclosure or other unauthorized actions. OWASP identifies excessive functionality, permissions, and autonomy as sources of this risk (OWASP, n.d.). genai.owasp.org

The constitutional distinction remains essential. The Fourth Amendment generally governs government action, rather than a private provider’s independent data practices. Government acquisition of provider-held information raises a separate inquiry. The earlier cases do not establish that everything shared with an AI service loses constitutional protection. everycrsreport.com

For a provider’s own conduct, applicable privacy and consumer-protection laws, enforceable agreements, and representations about data use become central. The FTC has warned AI companies that misleading privacy promises, material omissions, and misuse of customer information can expose them to enforcement under existing law (Federal Trade Commission, 2024). A privacy policy describes practices and commitments; it is not itself a blanket guarantee of confidentiality. www.ftc.gov

The telephone booth in Katz offered a visible boundary. AI systems make that boundary harder to see. A user may authorize access while expecting a narrow purpose, limited retention, and no unrelated disclosure. How clearly do the service’s permissions and practices reflect those expectations? And when an agent can assemble and act on a detailed account of someone’s life, what should count as a reasonable boundary?

References

Views: 16

Similar Posts