Police can see your search history, but in most situations they need a warrant based on probable cause to get it. The Fourth Amendment protects the digital record of what you look up online, and two Supreme Court decisions have made that protection stick for phones and for the data tech companies hold about you. The real answer to whether police can see your search history depends on where the data is stored, who is asking, and whether one of a handful of recognized exceptions applies.
The Warrant Rule
The Fourth Amendment bars unreasonable government searches, and courts have consistently held that people carry a reasonable expectation of privacy in their digital information. To get a warrant, officers file a sworn affidavit laying out facts that would convince a judge a crime occurred and that evidence of it will be found in the specific data they want. Hunches don’t clear that bar.
Two Supreme Court cases anchor the protection. In Riley v. California (2014), the Court ruled unanimously that police cannot search a cell phone seized during an arrest without first getting a warrant, recognizing that a phone’s contents implicate “substantially greater individual privacy interests” than a pat-down of someone’s pockets.1Justia Law. Riley v. California 573 U.S. 373 (2014) Four years later, Carpenter v. United States (2018) extended that logic to records held by third parties, holding that police need a warrant for cell-site location data the Court described as “detailed, encyclopedic, and effortlessly compiled.”2Supreme Court of the United States. Carpenter v. United States
Carpenter dealt with location records, not search queries. But the reasoning covers the same ground. Your search history reveals your health concerns, political interests, financial worries, and personal relationships, exactly the kind of intimate automatically generated record the Court flagged as deserving warrant protection.
Where Your Search History Actually Lives
Search history doesn’t sit in one place, and each location changes how police might reach it.
Your internet service provider can see every website you visit, even if you clear your browser history or use incognito mode. There is no federal law requiring ISPs to retain browsing data for a set period in the United States, but many keep logs for their own business reasons and must preserve records when law enforcement issues a preservation request.
Your device stores history, cookies, cached pages, and autofill data locally. Even after you delete this data, forensic tools used by law enforcement can often recover it from the drive. Deleting removes the easy path to the data; it does not necessarily erase the underlying files.
Search engines and cloud services hold their own copy. Google, Bing, and similar services store your search activity linked to your account and retain it by default until you manually delete it or set up auto-delete. If police serve a warrant on Google, the company turns over what it has.
Incognito mode is the most commonly misunderstood piece of this. Private browsing prevents your browser from saving history, cookies, and form data on your device after the session ends. It does nothing to hide your activity from your ISP, your employer’s network, or the sites you visit.
When Police Don’t Need a Warrant
Several exceptions let law enforcement access digital data without going through the warrant process.
Consent
If you agree to let police look at your phone, computer, or online accounts, no warrant is needed. You are not required to consent, you can refuse, and you can withdraw consent after giving it. Police are not obligated to tell you any of that. A lot of people hand over their phones when asked without realizing they could say no.
Exigent Circumstances
When there is an immediate threat to someone’s safety, a suspect is actively fleeing, or evidence is about to be destroyed, officers can act without a warrant. For digital evidence, this might apply when officers have reason to believe a suspect is about to remotely wipe a device. The bar is high: officers must point to specific, urgent facts, not a general worry that data might disappear eventually.
Border Searches
The border is where digital privacy weakens sharply. U.S. Customs and Border Protection can search electronic devices at ports of entry and international airports without a warrant. CBP distinguishes between “basic” searches, where an officer manually scrolls through a device, and “advanced” searches, where an officer connects external equipment to copy or analyze the contents. Basic searches require no suspicion at all. Advanced searches require reasonable suspicion of a legal violation or a national security concern, plus senior manager approval.3U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry
CBP officers may only examine data stored on the device itself. They are required to disconnect the device from the internet before searching, typically by placing it in airplane mode, and they cannot use your phone to reach cloud-stored data. If you are a U.S. citizen and refuse to unlock your device, CBP cannot deny you entry, though they may detain the device.3U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry
Plain View
If police are lawfully searching a device under a warrant for one crime and encounter obvious evidence of a different crime, they can potentially use it. Courts have applied this “plain view” doctrine to digital searches with varying restrictions. Some allow officers to keep searching under the original warrant after discovering unrelated evidence. Others require a second warrant before pursuing the new lead.
The 180-Day Quirk in Federal Law
The Stored Communications Act, part of the Electronic Communications Privacy Act passed in 1986, governs when the government can force a provider like Google or an ISP to hand over your information. For the content of your communications and stored data held for 180 days or less, the government must obtain a warrant. For content stored longer than 180 days, the statute technically allows a subpoena or court order with prior notice to you, on a showing of “specific and articulable facts” that the information is relevant to an investigation. That is a lower bar than probable cause.4Office of the Law Revision Counsel. 18 USC 2703 Required Disclosure of Customer Communications or Records
The distinction made more sense in 1986, when storing email on a server for months was unusual. Today it is largely obsolete in practice. Google, Microsoft, and other major providers voluntarily require a warrant for all content regardless of age, and some states have eliminated the distinction by statute.
Basic subscriber records are treated differently. The government can obtain your name, address, phone number, payment method, and session times through an administrative subpoena, with no probable cause and no judge involved. Subscriber records do not include the substance of your searches.4Office of the Law Revision Counsel. 18 USC 2703 Required Disclosure of Customer Communications or Records
Reverse Keyword Warrants
A traditional warrant identifies a suspect and asks a provider for that person’s data. A reverse keyword warrant flips the direction: police ask a search engine to identify everyone who searched for a particular term during a specific time window. If a victim’s name was Googled before a killing, investigators might seek records of everyone who searched that name in the days before.
Privacy advocates argue these warrants sweep up data from thousands of innocent people and resemble the “general warrants” the Fourth Amendment was designed to prevent. A 2026 Pennsylvania Supreme Court decision upheld the use of a reverse keyword warrant in a rape investigation, a ruling that drew sharp criticism from civil liberties organizations.
Google was historically the primary target because it maintained a massive centralized database of user searches. On the related question of geofence warrants, Google announced in 2023 that it would move location data storage to individual user devices rather than its centralized Sensorvault; by July 2025, all historical location data had been deleted from the Sensorvault, effectively ending Google’s ability to respond to geofence warrants. Keyword warrants involve different data and remain a separate legal question.5Every CRS Report. Geofence and Keyword Searches Reverse Warrants and the Fourth Amendment
Can Police Force You to Unlock Your Phone?
Even with a valid warrant, police face a practical problem when the device is locked. Whether they can compel you to unlock it depends on how it is secured, and federal courts are split.
Compelling someone to reveal a numeric passcode is widely viewed as forcing them to disclose the contents of their mind, which the Fifth Amendment’s protection against self-incrimination generally prohibits. Courts have often compared it to forcing someone to reveal the combination to a wall safe.
Biometric unlocking is genuinely unsettled. The Ninth Circuit ruled in U.S. v. Payne that forcing a suspect to press a finger to a phone sensor was not “testimonial” because it required no mental effort, closer to giving a blood sample than revealing a secret. The D.C. Circuit reached the opposite conclusion in U.S. v. Brown (2025), holding that compelling a thumbprint unlock violated the Fifth Amendment because it communicates the suspect’s knowledge of how to access the device and control over its contents.6Center for Democracy and Technology. Circuit Court Split Lays the Groundwork for SCOTUS Case on Biometric Cell Phone Unlocking
Until the Supreme Court resolves the split, the answer depends on where you live. Some attorneys suggest disabling biometric unlock before any encounter with law enforcement, since the protections around passcodes are far more settled than the ones around fingerprints and facial recognition.
What Happens If Police Break the Rules
If police obtain your search history through an illegal search or a defective warrant, the exclusionary rule bars the government from using that evidence against you in a criminal prosecution. Evidence police found only because of the illegal search also gets excluded under the “fruit of the poisonous tree” doctrine. If an unlawful look at your browsing history led officers to a witness they would never have found otherwise, that testimony can be thrown out too.
The rule has limits. If officers relied in good faith on a warrant that later turned out to be invalid, the evidence may still come in. And the rule applies only in criminal cases. It will not help in a civil lawsuit, a deportation proceeding, or other non-criminal contexts.
State Laws and Data Stored Abroad
Federal law sets the floor. A growing number of states have raised the ceiling. California’s Electronic Communications Privacy Act (CalECPA) requires a warrant before state or local law enforcement can access the contents or metadata of your communications, demand location records from your cell phone provider, or use surveillance technology to gather information about your phone. CalECPA eliminates the federal 180-day distinction entirely and extends warrant protection to metadata, which federal law treats as less private than content. Specifics vary state to state, but the trend runs toward stricter protection than federal law.
One boundary worth knowing: storing data abroad no longer keeps it out of reach. The CLOUD Act, passed in 2018, lets U.S. law enforcement compel American companies to produce data regardless of where the servers physically sit. A provider can challenge the order if compliance would violate the laws of the country where the data is stored, but a U.S. court can override that objection. There is no direct mechanism for the individual whose data is being sought to challenge a CLOUD Act order.