Smith v. Maryland, Third Party Doctrine as Applied to Reddit Users
Naadia Chowdhury
This past Friday, Reddit users were concerned about government internet surveillance and the privacy of their data. In its annual report, Reddit typically lists the kinds of requests it gets for its consumer information and for complaints to remove content. Reddit’s latest annual report was missing a paragraph that typically says Reddit did not receive a national security letter to conduct electronic surveillance. This indicated to users that the government may have sent Reddit a national security letter allowing the FBI to conduct surveillance and access user information without a warrant or court order.1
To become a user on Reddit, you do not need to disclose a lot of information. Potential users create a username and disclose their email addresses. Compared to other social platforms, there is not a lot of directly identifiable information. It can be argued, however, that an email address is enough information to track down an individual.
Even if the FBI was not working under the national security exception to the requirement of getting a warrant or court order to complete surveillance, it seems unlikely that Reddit users could successfully argue they have privacy rights against the government from accessing their information. Based on Smith v. Maryland, Reddit users do not have a legitimate expectation of privacy regarding their information because they disclose their email addresses and activities on Reddit to Reddit employees and the company. Any information a Reddit user discloses is information he or she voluntarily conveys to the company and therefore, assumes the risk of having their information revealed to a government official.
In United States v. Forrester, the Ninth Circuit Court of Appeals determined internet users have no legitimate privacy expectations in the IP addresses of the websites they visit. The information Reddit users disclose seem analogous to this case and so, users have weak legal protections in their information.
It is still not clear if privacy policies that companies have will alter the analysis courts undertake to determine whether there is a legitimate expectation in privacy. It would be logical that the assumption of the risk a user undertakes when registering on a website with a privacy policy guaranteeing to keep the user’s information safe would be altered and be a more limited assumption. If Reddit provides a privacy policy, perhaps an argument can be made, but as of 2008, protections against government electronic surveillance are fairly weak under the Smith test.