Can the government see everything on your phone? Close to it, if it uses the right legal tool for the right category of data — but a warrant stands between federal agents and the most revealing material, and strong encryption paired with a passcode blocks some of it entirely. What’s really at stake is not whether the government can reach your call logs, messages, location trail, browsing history, and cloud backups, but which of those it can get quickly, which require a judge, and which it can simply purchase without asking anyone.
Where Your Phone Data Actually Lives
Your phone is not a sealed container. Call logs sit with your carrier. Cell tower connection records sit with your carrier. Photos, messages, and documents often sit in iCloud or Google Drive backups. App developers hold usage data. The device in your pocket is only one copy of your life, and the government can pursue any of those copies using different rules for each.
That matters because the legal barrier depends on where the data is and what type it is. The contents of your phone get one level of protection. Records held by your carrier get another. Data a company has already packaged and sold to a broker gets almost none.
When the Government Needs a Warrant
The Fourth Amendment protects you from unreasonable searches, and for phone data that generally means the government needs a warrant supported by probable cause before it digs into your device or pulls detailed records about your communications and movements.1Legal Information Institute (LII) / Cornell Law School. Fourth Amendment – Wex – US Law
Two Supreme Court decisions carry most of the weight. In Riley v. California (2014), the Court unanimously held that police cannot search a cell phone taken during an arrest without a warrant, recognizing that a modern phone holds “a digital record of nearly every aspect of their lives.”2Justia Law. Riley v California 573 US 373 (2014) Four years later, in Carpenter v. United States (2018), the Court ruled that the government also needs a warrant to obtain historical cell-site location records showing which cell towers your phone connected to over time.3Supreme Court of the United States. Carpenter v United States (06/22/2018)
A warrant is not a blank check. It must specifically describe what will be searched and what evidence is being sought, so an open-ended trawl through everything on your device is not supposed to pass muster.4Legal Information Institute (LII) / Cornell Law School. Probable Cause – Wex – US Law
What the Government Can Get Without a Warrant
Plenty of phone data moves under a lower legal standard than probable cause. Knowing which categories fall into which bucket is the difference between assuming your data is protected and understanding what actually is.
Subpoenas and Court Orders
Under the Stored Communications Act, some records — subscriber information, billing records, IP addresses — can be pulled from your carrier or app provider with a subpoena, which requires no probable cause showing. More sensitive material like the contents of stored messages or emails generally requires a warrant or at least a court order with a higher standard of proof.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
Wiretap Orders
Real-time interception of calls or messages is the most invasive tool and carries the strictest requirements. Under the federal Wiretap Act, the government must show probable cause, demonstrate that ordinary investigative methods have failed or would be too dangerous, and get a judge’s approval. A wiretap order lasts a maximum of 30 days, though extensions can be granted.6Office of the Law Revision Counsel. 18 US Code 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications
National Security Letters
The FBI can issue National Security Letters directly to phone companies and internet providers in national security and counterterrorism investigations, with no judge involved. An NSL can compel subscriber names, addresses, billing records, and length of service. It cannot reach the content of communications. NSLs historically came with gag orders barring the recipient from telling you, though legal challenges have loosened some of those restrictions.7Cornell Law School. National Security Letter
Emergency Disclosures
If a provider believes in good faith that an emergency involving danger of death or serious injury requires immediate action, federal law lets it hand both communications content and customer records to the government voluntarily, with no warrant or subpoena.8Office of the Law Revision Counsel. 18 US Code 2702 – Voluntary Disclosure of Customer Communications or Records The exception was written for kidnapping and active-threat situations, but it depends on the provider’s own judgment about what qualifies.
Foreign Intelligence Collection Can Sweep You In
FISA Section 702 lets the government collect communications of non-U.S. persons located outside the country for foreign intelligence purposes. If a foreign target communicates with someone inside the United States, that American’s side of the conversation is collected too, in what the intelligence community calls “incidental collection.”9INTEL.gov. Incidental Collection in a Targeted Intelligence Program
Congress reauthorized Section 702 in April 2024 through the Reforming Intelligence and Securing America Act, which runs until April 2026. FBI agents must now get supervisory approval before searching the Section 702 database using an American’s name or identifier, and they must document a specific factual basis for each search. Queries involving elected officials, political candidates, religious organizations, or media members require higher-level approval.10Congressional Research Service. FISA Section 702 and the 2024 Reforming Intelligence and Securing America Act The underlying reality did not change: if you communicate with someone overseas who is a surveillance target, your messages can end up in a government database.
Cell-Site Simulators
Cell-site simulators, sometimes called Stingrays, mimic cell towers to trick nearby phones into connecting. Once connected, the device can identify your phone, pinpoint your location, and in some configurations capture call metadata, unencrypted text messages, and even the content of calls on older 2G networks. A single device can pull information from thousands of phones in the surrounding area.
Since 2015, the Department of Justice has required federal agents to obtain a search warrant before using one, except in emergencies and other narrow circumstances.11U.S. Department of Justice. Department of Justice Policy Guidance – Use of Cell-Site Simulator Technology Compliance has been uneven. Reports have shown that agencies including ICE, DHS, and the Secret Service have used the devices without following their own warrant rules. State and local police operate under varying rules and often with little oversight.
Border Searches Change the Rules
At a U.S. border or airport customs checkpoint, the ordinary warrant requirement largely falls away. Customs and Border Protection has authority to inspect electronic devices of any traveler, citizen or not, entering or leaving the country.12U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry
CBP separates two levels. A basic search, where an officer manually scrolls through your phone, can be done on anyone without any suspicion. An advanced search, where an officer connects external equipment to copy or forensically analyze the phone, requires reasonable suspicion of a legal violation or a national security concern, plus approval from a supervisor at the GS-14 level or higher.13U.S. Customs and Border Protection. CBP Directive No 3340-049A Border Search of Electronic Devices CBP searched the devices of over 16,000 travelers in the first quarter of fiscal year 2026 alone.
If you refuse to unlock the device, CBP cannot deny a U.S. citizen entry, but it can detain or confiscate the phone. Non-citizens face potentially more serious consequences, including denial of entry.
The Government Can Buy What It Would Otherwise Need a Warrant For
Commercial data brokers collect precise location information, browsing habits, app usage, and other behavioral data from millions of phones and sell it to buyers, including federal agencies. The Department of Homeland Security, the FBI, the DEA, and the Defense Intelligence Agency have purchased location data from commercial brokers. Immigration and Customs Enforcement has bought location data to track individuals in sanctuary cities. Local police departments have made similar purchases.
The practice sidesteps Carpenter. When the government buys commercially available data, it argues no search has occurred and no warrant is needed, even though the data can reveal the same intimate details the Supreme Court said warranted Fourth Amendment protection. Data broker SafeGraph once packaged location data on visitors to every Planned Parenthood clinic in the country, answering how often people visited, how long they stayed, and where they went afterward.
The House passed the Fourth Amendment Is Not For Sale Act in April 2024, which would bar the government from purchasing data from brokers that it would otherwise need a warrant to obtain. As of early 2026, the bill has not passed the Senate.
Geofence and Keyword Warrants
Two newer techniques let the government work backwards from a place or a search term to identify people, rather than starting with a specific suspect.
A geofence warrant orders a company like Google to identify every phone present within a defined geographic area during a specific window of time. The Fifth Circuit has called this the “exact sort of general, exploratory rummaging that the Fourth Amendment was designed to prevent,” because it requires the company to search its entire database of hundreds of millions of accounts.14Congressional Research Service. Geofence and Keyword Searches – Reverse Warrants and the Fourth Amendment The Supreme Court agreed in January 2026 to hear Chatrie v. United States on whether geofence warrants violate the Fourth Amendment, and a ruling is pending.15Supreme Court of the United States. 25-112 Chatrie v United States
Reverse keyword warrants take the same approach with internet searches, demanding a company identify every person who searched for a particular term during a set timeframe. Google, the most frequent target, announced in 2023 that it would begin storing location history on user devices rather than centrally and shorten its default retention period to three months, changes that will make geofence warrants less effective going forward.
What the Government Cannot Easily Reach
End-to-End Encryption
End-to-end encryption is the most effective barrier between the government and your communications. On apps like Signal, WhatsApp, and iMessage, messages are encrypted on your device before they leave, and only the recipient’s device holds the key. The provider never sees the content. When law enforcement serves a warrant on Signal demanding message content, Signal genuinely cannot comply.
Encryption is not invisibility. Metadata often remains accessible even on encrypted platforms. WhatsApp collects metadata including location information, contact details, and data usage patterns. Signal collects almost nothing beyond information like when you registered. The content of your conversations may be locked, but the record of who you talked to, when, and for how long can still map out your life.
Passcodes vs. Fingerprints and Face Scans
If the government has your phone but cannot get in, the next question is whether it can force you to unlock it. Compelling you to reveal a passcode is widely considered “testimonial” under the Fifth Amendment because it forces you to disclose the contents of your mind, much like giving up the combination to a safe. Most courts that have addressed the issue agree this is protected.
Biometrics are treated differently. Some courts treat a fingerprint or face scan as a non-testimonial physical act, like providing a DNA sample, which the Fifth Amendment does not protect. Other courts have ruled that using your fingerprint to unlock a phone is functionally the same as revealing a passcode, because the act implicitly communicates that you own the device and can access its contents. The Supreme Court has not resolved the split. Whether police can force you to press your thumb to your phone depends on which jurisdiction you are in, which is why some security experts recommend a passcode over biometrics if compelled access is a concern.
Your Carrier and Cloud Provider Are the Real Target
When the government wants your records, it usually goes to your carrier or the companies whose apps you use, not to you. AT&T, Verizon, Google, and Apple all store call logs, subscriber information, and various forms of usage data. Providers must comply with valid legal demands, though major tech companies have pushed back on requests they consider overbroad. Google, for example, publishes government data request numbers every six months and notes that it reviews each request against applicable law, sometimes objecting to producing any information at all.16Google Transparency Report. Requests for User Information
One point worth understanding: deleting data from your phone does not delete it from the provider. A deleted text message may still exist on your carrier’s servers, and a photo removed from your phone may still sit in an iCloud backup. The government can pursue those copies with the appropriate legal process.
What Happens If the Government Breaks the Rules
If phone data is obtained through an illegal or unconstitutional search, the main consequence is that the evidence is excluded from a criminal trial. The rule extends further through the “fruit of the poisonous tree” principle: additional evidence discovered as a result of the illegal search is typically inadmissible too.17Cornell Law School Legal Information Institute (LII). Fruit of the Poisonous Tree
There are exceptions. Evidence may still come in if agents would have inevitably discovered it through legal means, if it came from an independent source, or if they relied in good faith on a warrant that later turned out to be defective. That good faith exception has mattered in geofence cases, where courts have found the warrants constitutionally problematic but admitted the evidence anyway because officers reasonably believed they were acting legally.
The exclusionary rule protects you in a criminal case. It does little if you are never charged. Intelligence agencies operating under FISA or executive authority collect and retain data under different rules, and the exclusionary rule’s reach in that setting is far more limited.