A federal appeals court has ruled that the warrantless collection of cellphone tower data, which can be used to track the location of a suspect, is unconstitutional without a probable-cause warrant from a court.

A three-judge panel of the 11th Circuit Court in Florida ruled that the government's warrantless collection of a defendant's cell site data violated his reasonable expectation of privacy.

"In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy," they wrote in their ruling (.pdf). "The obtaining of that data without a warrant is a Fourth Amendment violation."

Although the decision covers only three states – Florida, Georgia, and Alabama – it constitutes the first time that a federal appeals court has ruled in favor of a warrant for cell site data and is being touted by civil liberties groups as a victory in the effort to protect phone users from unreasonable searches and seizures.

“The court’s opinion is a resounding defense of the Fourth Amendment’s continuing vitality in the digital age," said Nathan Freed Wessler, a staff attorney with the American Civil Liberties Union. "This opinion puts police on notice that when they want to enlist people’s cell phones as tracking devices, they must get a warrant from a judge based on probable cause. The court soundly repudiates the government’s argument that by merely using cell a phone, people somehow surrender their privacy rights.”

The ruling could have implications for other warrantless metadata collection programs, according to Jennifer Granick, civil liberties director at the Stanford Center for Internet and Society. Granick wrote today that because the ruling involves stored cell site data it undermines the NSA's phone metadata collection program, which the government has argued is allowed because customers relinquish their right to privacy when it comes to a company's business records. Granick points out that the appeals court ruling today found that the defendant in this case "had an expectation of privacy despite the fact that the cell data was also the company’s business record."

The case involves Quartavious Davis, a 22-year-old who was convicted of participating in a string of armed robberies against businesses in Florida in 2010 and was sentenced to 1,941 months – nearly 162 years – in prison, though it was his first offense.

Prosecutors obtained the conviction through the use of surveillance video that showed a man matching Davis's description robbing a number of stores and through the testimony of his accomplices, who said he had carried a weapon during the crime spree as well as a witness who said that Davis shot at him outside of a Wendy's fast-food restaurant after the gang had robbed it.

But prosecutors also used more than 11,000 location records – known as cell site records – that investigators obtained from Davis's wireless carrier without a warrant to place Davis and his accomplices in the vicinity of the businesses that were robbed around the time the crimes occurred.

Investigators obtained the data not with a warrant but with a so-called 2703(c)(B) order from a federal magistrate judge, which does not require investigators to show probable cause. Instead, the order only requires a showing "that there are reasonable grounds to believe that the .... records or other information sought, are relevant and material to an ongoing criminal investigation."

The cell site records include a record of all calls made by a cell phone as well as the location of the cell tower to which the phone connected to make the call, allowing authorities to track the location of a caller. Using this data, investigators were able to determine that Davis, or someone carrying his phone, had used the phone near six of the seven crime scenes around the time of the robberies.

Davis filed two separate motions to suppress the electronic evidence in his initial trial on grounds that investigators did not obtain a probable-cause warrant to collect the data from cell phone carriers. But the U.S. District Court denied both motions.

Davis appealed to the 11th U.S. Circuit Court of Appeals seeking to reverse the conviction on grounds that investigators violated his Fourth Amendment rights, among other grounds.

Although the three-judge appeal panel ruled that Davis's cell site information was constitutionally protected, they found no reason to reverse his conviction, determining instead that the "good faith" exception applied in that law enforcement agents had relied in good faith on the magistrate judge's opinion in issuing the court order for the records.

The judges based their opinion about the cell site records in part on the Supreme Court's ruling in 2012 in United States v. Jones. That case involved the government's use of a GPS tracker on the vehicle of a convicted drug dealer to track his movement. The Supreme Court judges ruled in that case that the use of a GPS tracker constituted a search under the Fourth Amendment.

The government argued in the Davis case, however, that cell site location data was different from GPS data and deserved less protection than that data. Although the appellate judges agreed that cell site data "is distinguishable" from GPS data, they wrote that the distinctions actually worked "against the government’s case rather than in favor of it."

They noted that while the location of a car is largely tracked in public spaces, a cell phone "can accompany its owner anywhere. Thus, the exposure of the cell site location information can convert what would otherwise be a private event into a public one. When one’s whereabouts are not public, then one may have a reasonable expectation of privacy in those whereabouts."

They wrote that while it may be the case that GPS location information on an automobile "would be protected only in the case of aggregated data" just one point of cell site location data "can be within a reasonable expectation of privacy. In that sense, cell site data is more like communications data than it is like GPS information."

The government had also argued that Davis didn't have a reasonable expectation of privacy because he had surrendered that expectation by exposing his cell site location to his service provider when he placed the call.

But the judges noted that the prosecutor in Davis's case had undermined this argument when he told the jury that the defendants "probably had no idea that by bringing their cell phones with them to these robberies, they were allowing [their cell service provider] and now all of you to follow their movements on the days and at the times of the robberies....”

The judges concluded that Davis had not "voluntarily disclosed his cell site location information to the provider in such a fashion as to lose his reasonable expectation of privacy."

The American Civil Liberties Union, the Center for Democracy & Technology, the Electronic Frontier Foundation, and the National Association of Criminal Defense Lawyers filed an amicus brief supporting his argument that the government violated the Fourth Amendment when it obtained his location records without a warrant.