A Supreme Court ruling on the search and seizure of cellphones is being hailed as a victory for digital privacy, but technology can still put your private data in law enforcement’s hands.

On Wednesday, the justices unanimously ruled in Riley v. California that warrants are required for cellphone searches at the time of arrest. Such warrantless searches have been a point of controversy, and only six states have declared them illegal. But how exactly will the court’s decision change what takes place in jurisdictions across the country?

We couldn’t find data on how often warrantless cellphone searches on arrest occur, but the American Civil Liberties Union (ACLU) did obtain a copy of an extraction report that shows which types of data law enforcement was accessing. The information included call logs, text messages, photos, videos, contacts and web history, as well as data on location history (based on cell towers and Wi-Fi networks), passwords and content that had been manually deleted.

But the high court’s decision doesn’t prohibit warrantless cellphone tracking by police. The ACLU conducted a study in 2012 in which it filed more than 380 public record requests to local law enforcement agencies across the U.S. Of the roughly 250 agencies that responded, 92 reported engaging in cellphone tracking, and only 10 reported that they did not track cellphones. (The remainder provided a vague statement or no statement at all about phone tracking.) Only six of the agencies that tracked cellphones said warrants were required by local or state law.

This is the crux of the Supreme Court ruling — law enforcement agencies now need a warrant to search anyone’s cellphone at the time of arrest, but they can obtain similar information by using their own cellphone-tracking technology or by obtaining data from cellular-service providers. Through tracking, law enforcement agencies can determine whether a phone has been in any given area at any given time. Additionally, they can access further information, such as call logs and text messages.

It appears law enforcement makes use of this ability. The New York Times reported in 2012 that cellphone carriers responded to 1.3 million requests from law enforcement agencies for this kind of subscriber information in the previous year. A single agency, California’s San Bernardino County Sheriff’s Department, provided the ACLU with 283 pages of invoices from AT&T, Verizon, Sprint, T-Mobile and other cellphone carriers, which accounted for just one year of its surveillance operations.