Major Privacy Win: Supreme Court Protects Location Data While Age-Gating Laws Threaten Anonymity
Featured image: Photo by Miguel Á. Padriñán on Pexels.
In a significant moment for digital rights, the U.S. Supreme Court has issued a landmark ruling affirming constitutional protections for people’s location data. This decision strengthens the Fourth Amendment against government surveillance in the digital age, offering a crucial safeguard for personal privacy. However, this victory arrives amidst growing concerns over new legislative efforts, particularly age-gating laws, which threaten to erode online anonymity and compel the collection of sensitive personal information, creating a complex and often contradictory landscape for privacy advocates and ordinary citizens alike. While the highest court moves to protect our digital footsteps, state legislatures are considering measures that could force individuals to surrender deeply private details to access everyday online services, posing an existential threat to the very notion of anonymous internet use.
A Landmark Victory for Location Privacy
The U.S. Supreme Court delivered a resounding win for digital privacy in the case of Chatrie v. United States, ruling that the Constitution protects individuals’ location data. This decision establishes that even short-term surveillance of a person’s movements in the physical world constitutes a search under the Fourth Amendment [1]. This ruling significantly expands upon the Court’s 2018 landmark decision in Carpenter v. United States, which dealt with prolonged tracking via cell phone location data. The Chatrie decision confirms that even brief periods of location data surveillance can reveal “private matters,” including “a wealth of detail about a person’s familial, political, professional, religious, and sexual associations” [1].
A critical aspect of the ruling is its recognition that records generated by apps on a user’s phone—data necessarily shared with third-party tech companies—are considered the user’s “own” and are entitled to Fourth Amendment protection. This applies broadly to “emails, documents, photographs, [ ] calendars” as much as to location data, suggesting wide-ranging implications for various forms of digital information we entrust to third parties [1].
The case specifically addressed geofence warrants, a form of dragnet surveillance where police compel companies, predominantly Google, to provide location data from every electronic device within a specified area during a particular time frame. These warrants do not name a suspect or a specific device, instead casting a wide net that risks turning innocent bystanders into suspects merely for being in the vicinity of a crime [1]. In the Chatrie instance, a 2019 geofence warrant compelled Google to search millions of user accounts within a radius of a Northern Virginia crime scene, an area encompassing numerous homes, businesses, and a church [1].
A federal district court in Virginia had previously ruled in 2022 that the geofence warrant plainly violated the Fourth Amendment, noting the government’s lack of particularized probable cause for every individual within the geofence [1]. This was further supported by a 2024 federal Fifth Circuit Court of Appeals ruling that declared geofence warrants “categorically prohibited by the Fourth Amendment” [1]. In response to growing legal scrutiny, Google announced changes in 2023 to its location data storage practices, which have made mass geofence searches of its users’ location data impossible since July 2025 [1]. While this marks a significant step forward, the threat of mass surveillance persists through other avenues, such as data brokers who collect and aggregate location data from various apps, and “cell tower dump” warrants, which provide access to data on everyone within range of specific cell towers [1]. The Chatrie opinion is expected to shape how lower courts address police access to location and other digital data moving forward, pressing for broader Fourth Amendment protections for user information [1].
The Rising Tide of Age-Gating and its Privacy Perils
While the Supreme Court has bolstered privacy protections, a concerning trend in legislative initiatives threatens to undermine online anonymity and data security. Several states are moving to implement sweeping age-gating frameworks across internet-enabled devices, operating systems, and online services. Illinois’ House Bill 5511, for example, is a deeply flawed piece of legislation that mandates digital platforms collect and share users’ ages [2]. This bill, modeled after controversial legislation in California and New York, forces platforms to strip away basic features like personalized content feeds and overnight notifications for young people unless “verifiable parental consent” is secured [2].
Privacy advocates warn that such measures are a “massive privacy and free speech nightmare,” effectively dismantling online anonymity, jeopardizing data security, and severely restricting access to constitutionally protected speech for both young people and adults [2]. These schemes also pose an existential threat to the open-source ecosystem that underpins the modern internet and can cut off vital lifelines for vulnerable youth, particularly those in non-traditional families who rely on online communities for support and information [2]. The rush to adopt these age-bracketing regimes before their effectiveness, legality, or functional aspects have been tested in court or in practice is premature and legally risky [2].
Diverse Methods, Unified Risks in Age Verification
The implementation of age verification mechanisms, such as those mandated in the UK for platforms hosting content deemed “harmful,” introduces a complex array of privacy implications [3]. As of July 2025, all platforms in the UK with such content are legally obligated to verify users are over 18 [3]. However, the methods used for age verification vary widely, and each carries its own set of privacy risks, making it difficult for users to understand what data is being collected, by whom, and for how long [3].
Common age verification methods include facial age estimation, where a photo or video of a user’s face is analyzed to estimate their age. While some services claim to delete the image immediately after estimation, many upload photos to third-party servers, raising concerns about accidental leaks of current location or other identifying background elements [3]. Photo-ID matching, which compares a user’s photo to a government-issued document like a driving license or passport, is considered even more sensitive due to the wealth of personal information contained on such IDs. Data retention policies for these services are often opaque, and past incidents, like Discord’s previous system where IDs were stored indefinitely and exposed in a data breach, highlight the dangers [3].
Other methods include open banking, where an age-check service securely accesses bank information to confirm age without sharing the full date of birth, and credit card age checks, which rely on the fact that one must be over 18 to obtain a credit card [3]. Email verification estimates age by analyzing an email address’s usage across other online services, while mobile operator checks confirm if a phone number has age filters applied [3].
Unfortunately, no current age verification option is perfect in terms of protecting privacy. These issues are compounded for marginalized groups, particularly LGBTQ+ individuals, for whom data sharing can have life-altering consequences. Information revealing sexual orientation, gender identity, or HIV status can be exploited by employers, governments, family members, scammers, or bad actors, leading to harassment, discrimination, arrest, or violence [3, 4]. The Electronic Frontier Foundation (EFF) therefore stands against broad age-gating mandates, arguing that they compromise privacy and inevitably limit access to lawful speech, valuable online communities, and arts and culture [3].
Corporate Responsibility and Default Privacy
Beyond legislative mandates, corporate practices significantly impact user privacy. The case of Grindr, a popular dating application for the LGBTQ+ community, serves as a stark reminder of the need for companies to prioritize user safety and privacy by default [4]. Despite its role as a vital platform, Grindr has a documented history of mishandling sensitive user data, including sharing HIV status and precise location with advertisers without valid consent [4]. This type of data exposure has led to real-world harm, such as a data broker selling Grindr location data that was used to ‘out’ a gay priest [4].
Advocates are calling for Grindr, and indeed all platforms handling sensitive data, to implement privacy-by-default settings. This includes opting users out of behavioral advertising by default, as such advertising relies on extensive collection and sharing of personal data across a vast network of advertisers and data brokers, leaving users with little control over their information [4]. Grindr, for instance, has been observed contacting numerous third-party tracking domains and sharing mobile advertising identifiers (MAIDs), which are not anonymous and can be linked to more directly identifying information like emails and phone numbers, potentially exposing a user’s sexuality to the advertising ecosystem [4].</p
Sources
- [1] Victory! Supreme Court Says Constitution Protects People’s Location Data (www.eff.org)
- [2] EFF to Gov. Pritzker: Veto Illinois’ HB 5511 (www.eff.org)
- [3] LGBT Q&A: What Data Are Companies in the UK Collecting When Verifying My Age? (www.eff.org)
- [4] EFF to Grindr: This Pride Month, Put Safety and Privacy Over Profits (www.eff.org)
- [5] Amazon fined $2.25M for withholding evidence from fraud victims (www.bleepingcomputer.com)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
