The PA Supreme Court has announced that “when the average internet user opens an unencrypted internet browser and performs a search on a website such as Google, he or she voluntarily enables the creation and collection of data, and, in such circumstances, has no societally recognized expectation of privacy.”
“When John Kurtz wanted to know the home address for K.M.—a woman that he later kidnapped and raped—he did just that. He ‘Googled’ it.”
“In a subsequent investigation into Kurtz’ crimes, the Pennsylvania State Police (“PSP”) obtained … a ‘reverse keyword search warrant’ for the records that Google generated during the week prior to the assault. The warrant was not directed at a specific person’s activity, but instead targeted all searches performed on Google’s search engine for K.M.’s name or address. Over one year later, Google informed the PSP that it had reviewed its records and had found that someone had conducted two searches for K.M.’s address a few hours before the attack. PSP investigators then were able to determine that the same IP address was used for both searches, and that the IP address was associated with Kurtz’ residence.”
Having “reason to suspect that Kurtz was the perpetrator … investigators tracked Kurtz around the clock and soon found a connection between him and K.M. [T]hey also retrieved a cigarette butt they observed him discard from which they obtained a viable DNA sample that matched DNA evidence obtained from K.M.”
Kurtz was arrested and confessed not only to K.M.’s rape and abduction, but to having committed four other assaults of different victims. His cases were consolidated and he was tried, convicted and sentenced after which time he filed an appeal, asserting that the PSP failed to establish probable cause individualized to him, as is constitutionally required to support issuance of a search warrant.
The Superior Court concluded that “[b]y typing in his search query and pressing enter, [Kurtz] affirmatively turned over the contents of his search to Google, a third party, and voluntarily relinquished his privacy interest in the search. The panel opined that its ruling was buttressed by Google’s Privacy Policy, which specifically allowed for the company to turn over search results when requested by law enforcement and which he assented to by using the company’s search service.”
Kurtz’s petition for allowance of appeal was granted to determine “whether the Superior Court erred in concluding that an individual does not have a reasonable expectation of privacy in his or her electronic content, particularly in his or her private internet search queries and IP address?”
The Supreme Court first explained that “before a person can challenge the validity of a search warrant, he or she first must demonstrate an expectation of privacy in the area searched. In this case, we must decide whether a person who conducts general, unprotected internet searches has an expectation of privacy in the records generated by those searches.”
Relying heavily on the “third-party doctrine,” the Court further explained that “[w]hile ‘a man’s home is, for most purposes, a place where he expects privacy,’ that privacy does not extend to those ‘objects, activities, or statements that he exposes to the plain view of outsiders.’ Such shared materials are ‘not protected because [that person has exhibited] no intention to keep them to himself.’”
In other words. “a person lacks an expectation of privacy in information or materials when that person exposes them to a third party.”
“The point is not that Google has agreed to turn that data over to a third party only in certain circumstances. The point is that Google itself is the third-party. Once a user agrees voluntarily to Google’s collection of the information, there no longer is a reasonable expectation of privacy in that information. What Google agrees to do with that information is irrelevant. By that juncture, the user already has exposed that information to a third-party: Google.”
THE INTERNET IS NOT THE SAME AS A CELL PHONE
The Court took time to distinguish one’s use of the internet from one’s use of a cell phone. “The use of the internet is not involuntary, as cell phones have become. To the contrary, every time a person logs on to the internet, that person makes a choice. She chooses to input data into a network owned and operated by an internet service provider. While users (reasonably) may believe that their searches are private, they nonetheless willingly transmit data to a third party whenever they type terms into a search engine and hit the ‘Enter’ key. Unlike the cell phone user who cannot avoid creation of a data trail, the internet user can avoid or minimize the creation of such records by using other methods of research.”
The point is that the data trail created by using the internet is not involuntary in the same way that the trail created by carrying a cell phone.
SOME INTERNET SEARCHES MAY STILL RETAIN AN EXPECTATION OF PRIVACY
The Court emphasized that “our analysis here is limited to general, unprotected internet searches, i.e., open the search engine, type words into the search bar, and tap the “Enter” key.”
“To be clear, this case is limited to general, unprotected internet use. The result may, in fact, differ if an internet user has taken efforts to secure some degree of privacy. For instance, a user who accesses the internet using a “virtual private network,” who uses an internet browser that does not collect or share data, or who visits websites that are password-protected, such as those related to one’s medical care, might retain a constitutionally recognizable expectation of privacy.”
COMMONWEALTH V. JOHN EDWARD KURTZ, No. 98-99-100 MAP 2023 (Pa. 12/16/2025)
https://www.pacourts.us/
