Police can find out where your phone has been, who you called, what you texted, what apps you used, and what sits in your cloud backup — and how police track your phone in any given case depends on whether they are pulling records from your carrier, forcing a tech company to hand over stored data, intercepting communications in real time, or searching the device itself. Each route has its own legal standard. Some require a warrant signed by a judge who found probable cause. Some require only a subpoena that no judge ever reviews. A handful require nothing more than your agreement to let an officer scroll.
Tracking Where Your Phone Has Been
Your phone talks to nearby cell towers constantly, and those connections generate cell-site location information (CSLI) that your carrier stores. Investigators can request those records to map your movements. In a dense city with towers every few blocks, the estimate can narrow to a few hundred meters. In rural areas with sparse coverage, the circle is much wider.
GPS data is far more precise, placing a device within a few meters. Apps collect GPS coordinates in the background, and that data ends up with the app developer, the phone’s operating system, or both. Even with GPS switched off, the phone still logs connections to cell towers and Wi-Fi networks that can be used to estimate its position. A carrier can also be asked to “ping” your phone, forcing it to report its current location from the network side without any action on your part.
For historical CSLI, the Supreme Court held in Carpenter v. United States that pulling seven or more days of records is a Fourth Amendment search that requires a warrant based on probable cause.1Oyez. Carpenter v. United States Chief Justice Roberts, writing for the 5-4 majority, described historical CSLI as “an intimate window into a person’s life,” capable of revealing familial, political, professional, religious, and sexual associations through movement patterns.2Supreme Court of the United States. Carpenter v. United States, 585 U.S. 296 (2018) The Court declined to apply the older “third-party doctrine” — which normally strips privacy protection from information you hand over to a company — because a phone is practically a feature of human anatomy and its owner has little real choice about generating CSLI.
Cell-Site Simulators (Stingrays)
Some agencies skip the carrier entirely by using portable devices, commonly called Stingrays or IMSI catchers, that impersonate a legitimate cell tower. When your phone connects, investigators can pinpoint your location and log the unique identifier of every device within range, not just the target’s. Under Department of Justice policy, federal agents must obtain a probable-cause search warrant before using one, with narrow exceptions for emergencies such as imminent threats to life or destruction of evidence.3U.S. Department of Justice. Use of Cell-Site Simulator Technology The policy also prohibits capturing the contents of calls or texts. State and local rules vary; some states require a warrant by statute, others do not go beyond what the Fourth Amendment requires.
What They Can Pull Off the Phone Itself
A seized phone is a rich source of evidence. Modern forensic tools can, in many cases, defeat lock screens and encryption by exploiting software vulnerabilities, and their success depends on the phone model, the operating system version, and how recently the phone was updated. Once investigators have legal authority to search, they can typically access:
- Call logs, including timestamps and duration for incoming, outgoing, and missed calls.
- Text messages, emails, and messaging-app conversations. Deleted messages can often be recovered because the underlying data stays on storage until it is overwritten, which can take months.
- Photos, videos, and audio files, along with metadata that can include the GPS coordinates and time a photo was captured.
- Browsing history, search queries, and downloaded files.
- App data, including social media chat histories, financial transactions, ride-hailing logs, and fitness routes.
- Cloud backups the phone syncs to services like iCloud or Google, which can also be obtained separately from the provider.
The authority to conduct that search almost always requires a warrant. In Riley v. California, the Supreme Court unanimously held that police generally need a warrant before searching the digital contents of a phone seized during an arrest, rejecting the old practice of treating a phone like a wallet.4Justia Law. Riley v. California, 573 U.S. 373 (2014) A phone, the Court reasoned, can hold millions of pages of text and a detailed record of nearly every aspect of its owner’s life.
Warrant, Court Order, or Subpoena: The ECPA Tiers
The Fourth Amendment sets the constitutional floor. Congress built the detailed framework through the Electronic Communications Privacy Act of 1986 (ECPA), which has three parts, each with its own standard of proof.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
Real-Time Interception: The Wiretap Act
Listening to a live phone call or reading a text message in transit requires the highest bar: a warrant based on probable cause, issued by a judge, showing that the interception will reveal evidence of specific serious crimes listed in the statute. These orders last up to 30 days.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
Stored Data: The Stored Communications Act
Data already sitting on a provider’s servers — old emails in Gmail, messages backed up to iCloud — falls under the Stored Communications Act. The rules split by data type. For the contents of stored communications held for 180 days or less, a full search warrant is required. For non-content records like your name, billing address, IP logs, and session times, police can use an administrative subpoena or a court order with a lower standard than probable cause.6Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records In practice, that means your carrier can hand over account information, payment records, and connection logs without a judge ever reviewing the request. Getting the actual content of your texts or emails requires a warrant signed by a judge who found probable cause.
Real-Time Metadata: The Pen Register Act
Real-time collection of routing information — the phone numbers you call and the numbers that call you, without the content — sits at the lowest bar. An investigator only has to certify that the information is relevant to an ongoing criminal investigation. No probable cause required.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA) The statute explicitly forbids capturing content.
When Police Don’t Need a Warrant at All
Several situations let officers reach phone data without going to a judge.
Consent. If you agree to a search, no warrant is needed. Consent must be voluntary, but officers are not required to tell you that you can refuse. This is where most people unknowingly give up their Fourth Amendment protection. You can withdraw consent at any time with a clear statement such as “I’m withdrawing my consent to this search,” and the officer must stop. Anything found before you withdraw, though, is still evidence. Vague complaints that the search is taking too long generally will not count as a withdrawal.
Exigent circumstances. An immediate threat to someone’s life, a risk of evidence being destroyed, or active pursuit of a fleeing suspect can justify acting without a warrant. The Carpenter majority preserved this exception even for CSLI.7U.S. Courts. Privacy, Technology, and the Fourth Amendment Once the emergency ends, officers typically need a warrant to continue.
Non-content records via subpoena. As noted above, subscriber information, billing records, and connection logs can be obtained under the Stored Communications Act with an administrative subpoena or a relevance-standard court order.6Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records That includes who you called, when, and your IP addresses.
The border. U.S. Customs and Border Protection has broad authority to inspect electronic devices carried by anyone entering or leaving the country, regardless of citizenship. CBP policy distinguishes a basic search, where an officer manually scrolls through your phone with no suspicion required, from an advanced search that connects external equipment to copy or analyze contents. The advanced search requires reasonable suspicion of a legal violation or a national security concern, plus senior-manager approval.8U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry Officers must disable data and network connections first, so only locally stored data is searched. Federal appeals courts are split on how far this authority reaches, and the Supreme Court has not resolved the split.
Can Police Force You to Unlock the Phone?
This sits at the intersection of the Fourth and Fifth Amendments, and the law is genuinely unsettled. Whether unlocking counts as compelled testimony depends on how you unlock and which court is deciding.
Most courts that have addressed passcodes and PINs treat them as testimonial because typing one in reveals what is in your mind: you know the code, you control the device, and you can access what’s on it. The government can still compel disclosure under the “foregone conclusion” exception if it can show it already knows with reasonable certainty that specific evidence exists on the device and that you can access it.
Biometrics have split the federal courts. The Ninth Circuit ruled in 2024 that compelling a fingerprint to unlock a phone is not testimonial, comparing it to booking-stage fingerprinting or blood samples. The D.C. Circuit reached the opposite conclusion in early 2025, holding that a compelled biometric unlock is different because it communicates the suspect’s knowledge and control. The Supreme Court has not resolved the disagreement, so the answer depends on where you are when police make the demand.
Geofence and Reverse Keyword Warrants
A traditional warrant targets a person. A geofence warrant asks a company like Google, “who was in this area?” A reverse keyword warrant asks, “who searched for this term?” These matter to the person asking how police track their phone because they can sweep you in without any suspicion attached to you specifically. In 2021, more than a quarter of all warrant requests Google received were geofence warrants.
In August 2024, the Fifth Circuit Court of Appeals held that geofence warrants are “modern-day general warrants” categorically prohibited by the Fourth Amendment, because they force a company to search its entire database and sweep up data on potentially millions of innocent people who happened to be nearby.9U.S. Court of Appeals for the Fifth Circuit. United States v. Smith The court still allowed the evidence in under the good-faith exception. The ruling isn’t binding nationwide. The Colorado Supreme Court, for instance, upheld a reverse keyword warrant, finding that specific search parameters sufficiently narrowed the scope to satisfy the Fourth Amendment.10Congressional Research Service. Geofence and Keyword Searches – Reverse Warrants and the Fourth Amendment The Supreme Court has not weighed in.
What Cloud Data Sits Outside Carpenter
Emails, photos, documents, and messages backed up to services like Google Drive or iCloud share many of the features that troubled the Carpenter majority: they are deeply personal, practically unavoidable in modern life, and generated with little meaningful choice. Courts have reached inconsistent results. The Sixth Circuit recognized a reasonable expectation of privacy in the contents of emails held by an internet provider. The Ninth Circuit found a warrantless search permissible where the provider’s terms of service granted it the right to investigate illegal activity. No Supreme Court decision has directly extended the Carpenter framework to cloud-stored content, and that gap leaves real uncertainty for anyone whose digital life lives on a third-party server.
Practical Steps To Protect Your Rights
You have no obligation to consent to a phone search. Officers may ask in a way that makes it sound routine or mandatory, but unless they have a warrant or a valid exception applies, you can say no. If you do consent, remember that anything found before you withdraw is fair game. Withdraw with a direct verbal statement; body language and hedging generally will not work.
If police have a warrant, the search’s scope is set by the warrant. A warrant authorizing a search for drug transaction records does not give officers open access to every personal email on the device. Note anything that appears to exceed the warrant’s scope so your attorney can challenge it later.
Lock the phone with a strong alphanumeric passcode rather than relying solely on biometrics. Given the current circuit split, a passcode offers stronger Fifth Amendment protection in most jurisdictions than a fingerprint or face scan. Keep the operating system updated, because forensic extraction tools exploit known software vulnerabilities that patches often close. And if you are crossing an international border, understand that the normal warrant requirement effectively disappears; travelers concerned about device privacy sometimes carry a clean phone or back up and wipe their primary device before crossing.