Massachusetts police must now get a search warrant before they can track a person's past movements through their cell phone in an important new decision that has implications beyond just cell tracking in the Bay State.

In Commonwealth v. Augustine, state police relied on federal law to obtain an order authorizing the disclosure of two weeks worth of historical cell site records from Sprint in connection with a murder investigation. But the order wasn't a search warrant supported by probable cause. Years after obtaining the records and a criminal case was brought against Augustine, a different judge found the police had violated the Massachusetts state constitution when it failed to get a warrant.

The judge reasoned people have an expectation of privacy in their movements under the state constitution. That was true even though the records were owned by Sprint. The state appealed to the Massachusetts Supreme Judicial Court, and with the help of Kit Walsh of the Berkman Center for Internet and Society at Harvard Law School, we filed an amicus brief arguing that the trial judge got it right, and that a search warrant is needed before police can track a person's every movement for an extended period of time.

Thankfully, the high court agreed with us, becoming the second state supreme court—after New Jersey—to rule police need to get a warrant to track. Noting that a cell phone is an "indispensable" part of modern life and are ubiquitous as almost a "permanent attachment" to our body, the court ruled that people have a right to be free from invasive, long term tracking of their movements. While the state quibbled with whether cell tracking is as precise or accurate as GPS tracking of a car, the high court believed cell tracking implicated even greater privacy concerns than GPS tracking because unlike a device attached to a car, a cell phone is carried almost everywhere a person goes. If the location information police can obtain from a cell phone wasn't precise, there'd be no reason for the government to request it.

Just as important as its conclusion that people have an expectation of privacy in their long term public movements, the court also found that expectation was not diminished just because the cell site records belonged to Sprint. The state argued the U.S. Supreme Court's 1979 decision in Smith v. Maryland meant people don't have an expectation of privacy in information they turn over to others, including phone data stored by a phone provider. But Augustine rejected this argument, ruling the information at issue in Smith—phone numbers a person dialed—was less revealing than the location information sought here. Plus it noted users don't voluntarily turn their location information over to the cell phone provider in a meaningful way. Instead, the location information is just a "serendipitous" and welcomed byproduct of what a user is really trying to do: make a phone call.

This great decision could play an important role in the ongoing debate about location privacy and the wealth of records stored by third parties. Last year's positive gains on location privacy in state courts and legislatures across the country has carried over in 2014, and another judicial decision requiring a warrant to track not only protects more people but adds to the growing momentum in states like Maryland and Wisconsin, which have pending legislation requiring police obtain a warrant, and could hopefully turn the tide on pending court cases looking at the issue.

The court in Augustine also shared the concerns of U.S. Supreme Court Justice Sonia Sotomayor in her concurring opinion in United States v. Jones about whether the notion that people don't have an expectation of privacy in information turned over to others is viable in the digital age. Other courts have expressed similar misgivings. In December, Judge Richard Leon in D.C. rejected the government's attempt to use Smith to justify the NSA's bulk collection of phone metadata. Last week, a federal judge in Oregon found patients have an expectation of privacy in a state managed prescription medication electronic database, ruling that the DEA had to seek a warrant, not a subpoena, to obtain records from the database. And on Valentine's Day, the Hawai'i Supreme Court found an expectation of privacy in a customer's GNC (the vitamin and nutrition store) membership records. If more courts follow these decisions and think about 21st century privacy expectations with more nuance, the government's argument that it's unreasonable to expect privacy in anything turned over to a third party would be flipped on its head.

That is, if more courts say people do have an expectation of privacy in data held by third parties, it's the government's contrary argument that becomes unreasonable.