35 F.4th 721
9th Cir.2022Background
- In 2018 Los Angeles required e-scooter companies to obtain permits and to provide real‑time vehicle location data via the Mobility Data Specification (MDS) API as a permit condition. MDS collects start/end points, times and route data for each ride (with high location precision).
- Plaintiff Justin Sanchez, a regular e‑scooter user, alleged LADOT’s collection of MDS data violates the Fourth Amendment, Article I § 13 of the California Constitution, and CalECPA because the data can be retained and later linked to individuals or sensitive locations.
- The district court dismissed Sanchez’s complaint for failure to state a claim (finding no reasonable expectation of privacy in anonymous MDS data and, alternatively, that any search was reasonable), and denied leave to amend.
- On appeal Sanchez argued Carpenter and related decisions require treating MDS collection as a search; LADOT argued Sanchez lacks standing and the third‑party doctrine forecloses a privacy interest.
- The Ninth Circuit affirmed, holding Sanchez had Article III standing but that the third‑party doctrine applied to MDS data (so collection was not a search), dismissed the CalECPA claim for lack of a private right of action, and upheld dismissal without leave to amend.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing | Sanchez alleged a present constitutional injury from LADOT’s collection and retention of MDS data that can reveal movements. | LADOT: injury is speculative — future misuse might never occur. | Sanchez has standing: alleged Fourth Amendment injury is concrete and closely related to traditional harms. |
| Is LADOT’s collection of MDS data a Fourth Amendment "search"? | Carpenter requires special solicitude for location data; MDS can be retained and later deanonymized, so collection is a search. | MDS data are voluntarily disclosed to private operators for the ride; third‑party doctrine applies; MDS differs from continuous CSLI. | Not a search: third‑party doctrine applies because users voluntarily convey location to operators and MDS data are discrete scooter trips, not continuous personal tracking. |
| Applicability of Carpenter / third‑party doctrine | Carpenter signals the third‑party doctrine should not protect broad location collection; MDS risk of future deanonymization makes it similar to CSLI. | Carpenter was limited to historical CSLI; MDS differs (scooters are not indispensable, rides are discrete, data not tied to a persistent personal device). | Carpenter is distinguishable; third‑party doctrine governs here for reasons of voluntary exposure and the nature of the data. |
| CalECPA private right of action | §1546.4(c) allows a person to seek relief from an ‘‘issuing court’’ — district court can be an issuing court — so Sanchez may sue. | The statutory text limits §1546.4(c) to challenges to existing warrants/orders previously issued; only the Attorney General may bring independent enforcement suits. | No private independent action: statute does not authorize Sanchez to bring an independent enforcement suit absent prior targeted legal process; AG has express enforcement power. |
| Dismissal without leave to amend | Plaintiff requested leave to amend. | LADOT: amendment would be futile because no reasonable privacy interest exists and statute provides no private right. | Affirmed: amendment futile as no set of facts could create a reasonable expectation of privacy in MDS and CalECPA supplies no private claim. |
Key Cases Cited
- Carpenter v. United States, 138 S. Ct. 2206 (government acquisition of historical CSLI is a search; third‑party doctrine inapplicable in that context)
- United States v. Jones, 565 U.S. 400 (GPS tracking and trespass framing; long‑term monitoring raises privacy concerns)
- Katz v. United States, 389 U.S. 347 (Fourth Amendment protects people, not places; reasonable expectation of privacy test)
- Smith v. Maryland, 442 U.S. 735 (pen register; information voluntarily conveyed to third parties carries diminished privacy expectation)
- United States v. Miller, 425 U.S. 435 (bank records: disclosure to third party negates expectation of privacy)
- United States v. Knotts, 460 U.S. 276 (short‑term beeper tracking of movements on public roads not a search; left open long‑term surveillance concerns)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (standing requires a concrete injury; intangible harms can qualify)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (standing—injury must be concrete and closely related to historically recognized harms)