Case5:15-xr-90304-HRL Document30 Filed07/29/15 Page40 of 46 1 subpoenas, court orders or search warrant.”12 Id. Verizon’s privacy policy says nothing about 2 how or when CSLI is generated.13 There is no mention, for instance, that every call made or 3 received, every text sent or received, and every data connection will generate CSLI. Nor is there 4 mention of how accurate the vaguely worded “wireless location” information might be. 5 Additionally, far from giving its subscribers any understanding of the length of time for which 6 their location information will be stored, Verizon’s policy states only: “Personally identifiable and 7 other sensitive records are retained only as long as reasonably necessary for business, accounting, 8 tax or legal purposes.” Id. (emphasis added). The record does not establish how long “as long as 9 reasonably necessary” is. The Court cannot conclude that such a policy provides the basis for 10 United States District Court Northern District of California 11 consent to the government’s acquisition of sixty days’ worth of historical CSLI. AT&T’s policy fares no better. AT&T informs its subscribers that it will collect their 12 “location information,” which includes “the whereabouts of your wireless device.” AT&T Policy. 13 “Location information,” AT&T’s policy continues, “is generated when your device communicates 14 with cell towers, Wi-Fi routers or access points and/or with other technologies, including the 15 satellites that comprise the Global Positioning System.” Id. The AT&T policy tells subscribers 16 that AT&T “automatically collect[s] information” when they “use our network,” and that AT&T 17 may provide this information to “government agencies” in order to “[c]omply with court orders.” 18 Id. The policy also contains information regarding the accuracy of the “wireless location 19 information” that AT&T collects, explaining that AT&T “can locate your device based on the cell 20 tower that’s serving you” up to 1,000 meters in urban areas and 10,000 meters in rural areas. Id. 21 At no point, however, does AT&T’s privacy policy give the cell phone user any indication 22 23 24 25 26 27 28 12 The mere mention of “court orders” in a privacy policy cannot provide a basis for consent. As the Verizon policy makes clear, cell phone users at most can consent to “valid” court orders—i.e., those that are not constitutionally infirm. 13 The Fifth Circuit’s brief analysis of privacy policies was limited to instances where cell phone users are making phone calls. See Fifth Circuit Opinion, 724 F.3d at 613. As explained earlier, the factual record here also includes CSLI generated by continuously running apps and automatic pinging, as well as the receipt of text messages. Verizon’s policy gives the user no indication that any of these passive activities will generate CSLI. 40 Case No. 15-XR-90304-HRL-1(LHK) ORDER AFFIRMING DENIAL OF APPLICATION FOR HISTORICAL CELL SITE LOCATION INFORMATION