Arizona Supreme Court Holds: No Search Warrant or Court Order is Needed to Obtain an Internet User’s IP Address or ISP Subscriber Information

State v. Mixton
Arizona Supreme Court   |   January 11, 2021
Written by: Justin Ackerman

In 2016, an undercover Tucson Police Department detective posted an advertisement on an online forum seeking users interested in child pornography. Someone with the user name “tabooin520” contacted the detective and asked to be added to a group chat on a messaging application called “Kik.” Once added, tabooin520 sent images and videos of child pornography to the group chat and to the detective.

At the detective’s request, federal agents with Homeland Security Investigations (“HSI”) subpoenaed Kik to obtain tabooin520’s IP address. Kik provided the IP address to the detective. The detective, using publicly available databases, determined that Cox Communications (“Cox”) was the ISP for the IP address. HSI agents then subpoenaed on Cox for the subscriber information associated with the IP address.

Cox complied with the subpoena, and disclosed the name of the subscriber—William Mixton—and his address and phone number. The detective used this information to obtain and execute a search warrant on Mixton’s residence. Detectives seized a cell phone, an external hard drive, a laptop, and a desktop computer. A subsequent search of these devices revealed photos and videos of child pornography, as well as the messages, photos, and videos that Mixton, under the username “tabooin520,” sent to the detective.

Mixton was indicted on twenty counts of sexual exploitation of a minor under fifteen years of age.  Mixton moved unsuccessfully to suppress the subscriber information and all evidence seized from his residence on the grounds that the Fourth Amendment and the Arizona Constitution required a warrant or court order to obtain his IP address and ISP subscriber information. A jury convicted Mixton on all counts, and he appealed.

In a split decision, the court of appeals affirmed Mixton’s convictions and sentences. State v. Mixton, 247 Ariz. 212, 220 ¶ 13 (App. 2019).  Mixton then sought review with the Arizona Supreme Court.

The Arizona Supreme Court granted review to consider “whether the United States or Arizona Constitution requires a search warrant or court order to obtain IP addresses and ISP subscriber information.”  In a 4-3 decision, the Court affirmed Mixton’s conviction and sentence.  Justice Lopez delivered the majority opinion of the Court, joined by Justices Gould, Beene and Montgomery.

With respect to the Fourth Amendment, the Court held that “the Fourth Amendment does not protect IP addresses and ISP subscriber information because such information falls within the exception created by the ‘third-party doctrine.’”  That doctrine differentiates information a person seeks to preserve as private (which requires a warrant or court order) from information that is not private because the person shares it with others (and which does not require a warrant or court order).  A person has no expectation of privacy in information he voluntarily discloses to third parties, even if there is an assumption it will be used only for a limited purpose.  And, because it is no longer private, the government may obtain such information from a third party without triggering the Fourth Amendment’s protections.  In this case, said the Court, “[a]s with bank records and dialed telephone numbers, an internet user voluntarily provides subscriber information and IP addresses to third-party ISPs and servers. Subscriber information and IP addresses also do not reveal the substance or content of the internet user’s communication any more than the information affixed to the exterior of a mailed item.”  As such, this information is not subject to the Fourth Amendment and does not require a search warrant.

The Court then held that Arizona’s Constitution, article 2, section 8, also does not require the State to obtain a warrant or court order to acquire a person’s IP address or ISP subscriber information.  This section of the Constitution, known as the Private Affairs Clause, provides that “[n]o person shall be disturbed in his private affairs, or his home invaded, without authority of law.”  The Constitution does not define “private affairs,” and the section’s history does not delineate the scope of its application.  The Court therefore used a “reasonable expectation analysis” to determine how to apply the Private Affairs Clause.  And under that analysis, use of the internet comes with no reasonable expectation of privacy.  “Most of us understand that what we do on the [i]nternet is not completely private. Our ubiquitous and pervasive internet use that is internet-connected, cloud-dependent, and app-reliant for personal communications, all manner of commercial transactions, 24-7 entertainment, and universal positional tracking, makes it hard to believe that anyone still retains this largely antiquated notion of anonymity in their internet use.”  Website operators are constantly collecting and sharing data on internet user’s activity.  Such information sharing, said the Court, is fundamentally inconsistent with any notion of privacy; and as such there is no reasonable expectation of privacy in that information.

The Court therefore concluded that “an IP address and subscriber information are not ‘private affairs’ under the Private Affairs Clause because the nature of the information is inconsistent with privacy: an internet user’s expectation of privacy in such non-content information is unreasonable in light of the nature of the information; it is voluntarily shared with third parties; and such third parties own, and often engage in pervasive legal derivative use of, it.”   As a result, the majority affirmed Mixton’s conviction and sentence.

Justice Bolick, joined by Justices Brutinel and Timmer dissented.  Focusing on the Private Affairs Clause, the dissent opined that the majority’s reasonable expectation analysis provides an “amorphous standard” that is absent in Arizona’s constitutional text. Specifically, the reasonable expectation framework “replaces an objective state constitutional command with a subjective standard whose meaning changes over time to reflect an evolving societal consensus.”  Instead, the dissent would hold that the Private Affairs Clause encompasses both personal and business matters, even if transmitted through third parties, based on the plain language of the Clause and an analysis of its adoption from colonial times.  The dissent said Arizona’s constitutional provision is irreconcilable with the later-emerging federal “third-party” doctrine that allows the government to obtain without a warrant any information divulged to a third party.