In August 2020, an arson in Denver killed five members of a Senegalese immigrant family in their home on North Truckee Street. Investigators had almost nothing: grainy footage of three masked figures, no plate, no name. Weeks in, they obtained a warrant directing Google to identify accounts that had searched the street address in the fifteen days before the fire. A handful of accounts came back. Three teenagers were charged, and one of them, Gavin Seymour, challenged the warrant all the way to the Colorado Supreme Court.
That case, People v. Seymour, decided in October 2023, is the first ruling from a state high court on the technique. It is worth understanding not because the outcome was dramatic but because the reasoning shows how thin the legal protection around search history currently is.
What makes a keyword warrant different
Ordinary process runs from a known person to their data. Police develop probable cause that a specific individual committed a crime, describe that person, and ask a magistrate for their records. Particularity, the constitutional requirement that a warrant describe the place to be searched and the things to be seized, is satisfied by naming the target.
Reverse warrants run the other direction. They start with a fact about the crime and search the entire population of a database for people matching it. The best known version is the geofence warrant, which draws a circle on a map and asks for every device inside it. A keyword warrant does the same thing across query logs instead of location logs.
The population being searched is everyone. Before the provider can produce the handful of accounts that typed the phrase, it has to run the query against the records of every user it has. The narrowing happens after the search, not before it, which is the inversion that makes these warrants legally contested.
The Fourth Amendment's particularity requirement was written to stop general warrants: open-ended authority to rummage until something incriminating turns up. A reverse warrant is narrow in what it returns and unlimited in what it examines. Courts have not settled which of those two properties governs.
What the Colorado court actually held
The Colorado Supreme Court reached three conclusions, and they do not point the same direction.
First, it recognized a constitutionally protected privacy interest in a person's Google search history. That matters. Search queries are records held by a third party, and under the doctrine that grew out of Smith v. Maryland and United States v. Miller in the 1970s, information voluntarily handed to a company has often been treated as unprotected. The court declined to extend that logic here, following the direction the U.S. Supreme Court took with cell site location data in Carpenter v. United States.
Second, it found the warrant constitutionally defective. There was no individualized probable cause tying any particular account to the crime at the time it was signed.
Third, it declined to suppress the evidence anyway, applying the good faith exception: the officers had gone to a judge, the law was unsettled, and excluding the evidence would not deter anything. Seymour was later convicted.
So the technique produced a defective warrant, a recognized privacy interest, and a conviction that stood. The court also limited its holding to the facts in front of it rather than resolving keyword warrants generally, which is why the practice continues.
What a provider can answer, and what it cannot
A keyword warrant is only useful against a provider that retains query logs linked to identifiers. That is a design property, not a legal one, and it varies more than most people assume.
| Data | Where it usually lives | Answerable by warrant |
|---|---|---|
| Search queries tied to an account | Server-side activity history, retained by default | Yes |
| Queries from a signed-out browser | Server-side, keyed to a cookie or device identifier | Often, with weaker attribution |
| Location timeline | Moved to on-device storage by Google starting in late 2023 | Largely no longer |
| Queries to a no-logs search engine | Not retained | No |
The third row is the interesting one. Google announced in December 2023 that Location History would move to the device, and geofence warrants against it lost most of their power as a result. Search history sits in a different product surface and was not part of that change. If you assume the geofence retreat covered your queries too, it did not.
Why these are hard to fight
Three structural problems make keyword warrants resistant to challenge.
Almost no one has standing. If your account was scanned and not returned, you will never learn it happened. Only the person charged gets to argue about the warrant, and by then the search has already occurred. The other millions of people whose records were queried have no notice and no forum.
Gag orders are routine. Warrants to providers frequently arrive with non-disclosure orders attached, so even aggregate reporting arrives late and incomplete. Several of the earliest known keyword warrants, including a 2017 order in Edina, Minnesota and a 2020 federal case in Wisconsin, only became public through unsealing or reporting rather than through disclosure. The same secrecy structure covers national security letters and much of the process described in our piece on the gaps in ECPA.
The good faith exception absorbs novelty. When a technique is new, the law about it is unsettled, and unsettled law is exactly the condition the good faith exception was built to forgive. A defendant can win the constitutional argument and still lose the motion, which is what happened in Colorado.
What actually reduces exposure
This is a supply question before it is a legal one. A warrant can only be answered out of records that exist.
- Use a search engine that does not retain queries against an identifier. This is the only measure that removes the record rather than obscuring it. Our comparison of private search engines covers what the main options actually retain, which is not identical across them.
- Turn on auto-delete, then verify the setting. Google made activity auto-delete a default for new accounts in 2020, but older accounts kept whatever they had. A shorter retention window shrinks the period a warrant can reach.
- Understand what signing out does and does not do. A signed-out query is still logged against a cookie and an IP address. That is weaker attribution, not absent attribution.
- Separate the network path from the query when it matters. Routing through Tor breaks the IP link, though it does nothing about an account you stay logged into. The trade-offs are covered in Tor versus VPN.
None of this is a shield against a targeted investigation of a known person, and it is not meant to be. It changes whether you appear in the bulk output of a query run against everyone, which is a different exposure and the one most people are unknowingly carrying.
The broader pattern
Keyword warrants belong to a family of techniques that treat a company's retained logs as a searchable population register. Geofence warrants did it with location. Tower dumps did it with cell connections. Keyword warrants do it with intent, which is the part that unsettles people: a query is closer to a thought than to a movement, and the record of it exists only because retention is the default business model.
The durable fix is not procedural. Data that was never collected cannot be produced, subpoenaed, breached, or repurposed years later under a legal standard nobody has written yet. That principle covers query logs, message metadata, and everything in our piece on data minimization.