State legislatures had a busy week passing electronic privacy laws. Will Congress follow?

First, the Texas legislature unanimously passed HB 2268, which requires state law enforcement to obtain a search warrant before accessing emails and other forms of electronic communications content from service providers. This law is necessary because the federal Electronic Communications Privacy Act ("ECPA") -- which most state electronic privacy laws are modeled after -- hasn't kept up with changes in technology. First enacted in 1986, ECPA allows law enforcement to bypass the warrant requirement to obtain the contents of communications that have been in electronic storage for more than 180 days. This archaic dividing line makes no sense in an age where people store emails and other documents in their inboxes and in the cloud forever. And as the Sixth Circuit Court of Appeals ruled in 2010 in United States v. Warshak, a nonwarrant requirement violates the Fourth Amendment's prohibition against unreasonable searches.

We've repeatedly asked Congress to update ECPA to bring it in line with the 21st century and despite a number of false starts, it seems real ECPA reform could happen in 2013. Even the Department of Justice recently indicated before a congressional committee that a warrant requirement made sense. But rather than wait on the sidelines for Congress to pass ECPA reform, Texas stepped up and passed privacy protection on its own. And its not the only state to do so. EFF sponsored similar legislation in California, SB 467, that recently passed the California Senate 33-1 and is set to be heard by the Assembly's Public Safety Committee on June 11. 

Meanwhile, over in Maine, the legislature just passed LD415, which requires police get a search warrant before tracking a person through their cell phone or other electronic device. We've long argued in court that people have a reasonable expectation of privacy in their public movements, meaning a search warrant is required before police can use cell site tracking, a GPS device or a "Stingray" to follow a person's movements throughout the day. Last year, Supreme Court justices Sotomayor and Alito gave support to this idea in their concurring opinions in United States v. Jones where both believed people have a reasonable expectation of privacy in their public movements. Justice Alito even wrote that "in circumstances involving dramatic technological change, the best solution to privacy concerns may be legislative."

Maine heeded Justice Alito's words, ensuring its residents' locational privacy remains protected by statute. Maine isn't the first state to pass this type of legislation. Last year, the California legislature passed SB 1434, a bill co-sponsored by EFF and the ACLU of Northern California that also would have required police obtain a search warrant before tracking a person's location through an electronic device. Despite broad bipartisan support for the law, Governor Jerry Brown vetoed the law. We hope Maine's bill meets a better fate.

Location privacy legislation has been introduced in Congress, too. Two separate bills introduced by Senator Ron Wyden (S 639) and Representative Zoe Lofgren (HR 983) this year seek to do exactly what Maine and California's laws did: require a warrant for location tracking. But the last time Senator Wyden introduced his GPS Act in 2011, the bill languished for almost a year before even getting a committee hearing and then disappeared for the remainder of the congressional term.

With states getting in on the privacy protection action, Congress should feel pressure to update the law to protect everyone across the country. Now that states as politically diverse as California, Texas, and Maine are taking affirmative steps to bring search warrant requirements to sensitive electronic data, Congress should see that privacy legislation is bipartisan and feasible. Hopefully, that means the legislation currently pending in Congress won't get stuck in the rigors of DC politics but actually have a chance at passing.