Lawfare Daily: The Privacy Law That's Supposed To Be Protecting Us Online Turns 40

In this episode of The Lawfare Podcast, Michael Dreeben, a renowned Supreme Court advocate, delivers a reflective and insightful opening address at the event 'Installing Updates to ECPA,' marking the 40th anniversary of the Electronic Communications Privacy Act (ECPA). Dreeben traces the evolution of Fourth Amendment jurisprudence from its 18th-century roots to modern digital challenges, emphasizing how the framers' physical-world understanding of privacy fails to capture the complexities of electronic communication. He highlights key Supreme Court cases—Katz, Kylo, Jones, Riley, and Carpenter—that have incrementally adapted constitutional protections to new technologies, yet reveals the limitations of relying solely on judicial interpretation. These decisions, while landmark, are reactive, narrow in scope, and often delayed by years. Dreeben argues that the Fourth Amendment alone cannot adequately protect digital privacy due to doctrinal gaps like the third-party doctrine, the distinction between government and private searches, and the lack of regulation around data brokers. He underscores the urgent need for legislative reform, particularly an updated Stored Communications Act, to address modern realities such as cloud storage, location tracking, and extraterritorial data access. The episode concludes with a call for Congress to act, suggesting that only comprehensive legislation can provide the detailed, forward-looking privacy protections that courts cannot deliver on their own. Key takeaways include: (1) The Fourth Amendment’s physical focus is ill-suited for digital privacy; (2) Supreme Court rulings are reactive and insufficient for comprehensive protection; (3) The third-party doctrine undermines privacy expectations in digital communications; (4) Private companies are not bound by the Fourth Amendment, creating a major regulatory gap; (5) Data brokers operate in a legal gray area with no Fourth Amendment constraints; (6) The Stored Communications Act’s 180-day rule is arbitrary and outdated; (7) Extraterritorial data access remains unresolved; and (8) Only legislative action can provide the detailed, future-proof privacy framework needed.