by David Kim

In an en banc decision, the Supreme Court of Oregon held that Article I, section 9, of the Oregon Constitution protects an individual’s privacy in internet browsing activities even when that individual accesses the internet through a publicly available Wi-Fi network operated by a third party. The Court further held that acknowledging a terms-of-service provision, which informed users that the network operator might monitor activity and cooperate with law enforcement, does not extinguish that constitutional privacy right. Additionally, the Court held that a private party’s coordinated effort with law enforcement to monitor the defendant’s internet traffic for a year constituted state action subject to constitutional constraints. Because the State conducted that surveillance without a warrant and failed to establish that any exception to the warrant requirement applied, the Court reversed and remanded for further proceedings. Having resolved the case under Article I, section 9, the Court did not consider whether the defendant’s Fourth Amendment rights were also violated.

Background

During 2018 and 2019, defendant Randall De Witt Simons accessed the internet from a public Wi-Fi network operated by an A&W restaurant in Lane County, Oregon. The restaurant’s Wi-Fi signal extended beyond its premises, reaching the defendant’s nearby home. The network required no password, but users were required to accept a terms-of-service provision every two to four hours.

A&W’s terms of service, which the owner had copied from internet sources and incompletely adapted, informed users that the business did not “actively monitor” the network “under normal circumstances.” However, the terms also disclosed that A&W reserved the right to restrict illegal activity, might “cooperate with legal authorities … in the investigation of any suspected or alleged crime,” and “may disclose … communications and activities … in response to lawful requests by governmental authorities, including Patriot Act requests and judicial orders.”

A firewall secured the network and logged unencrypted website visits, flagging sites containing images of child pornography or child abuse. In July 2018, A&W’s owner and technology consultant noticed that the firewall had flagged “child abuse images” from a user whose computer was named “IanAnderson-PC.” They contacted law enforcement, and Officer Larsen responded.

When A&W’s consultant asked whether the business should block the user’s network access, Larsen instructed him not to block the user but instead to track the user’s location. The consultant then volunteered to collect and provide specific logs for IanAnderson-PC, manually preparing these logs using a separate application because the firewall was not configured to generate single-user reports. He also created a firewall account enabling the officer to receive email notifications whenever IanAnderson-PC accessed a flagged website.

Over the following year, at Larsen’s direction, A&W provided logs documenting 255,723 webpage visits by IanAnderson-PC between July 1, 2018, and June 29, 2019. Several months into the investigation, A&W also began collecting packet capture data, which could be used to reconstruct the user’s unencrypted internet activity, including search queries and purchases. This data contained 44 images matching children in a national database. At no point during this surveillance did law enforcement obtain a subpoena or search warrant.

Using information from A&W, Detective Weaver employed a “packet sniffer” tracking device to identify radio traffic from the defendant’s computer and traced the broadcast to the defendant’s home. Weaver then obtained a warrant, searched the residence, seized a laptop confirmed to be IanAnderson-PC, and discovered child pornography. The defendant was charged with 15 counts of first-degree encouraging child sexual abuse.

The defendant moved to suppress the evidence, arguing that A&W had acted as a state agent and that monitoring his internet activity constituted an unlawful warrantless search. The trial court agreed that A&W’s owner and consultant had acted as state agents but denied suppression, concluding that the defendant lacked a privacy right in his use of the network. Following a stipulated-facts trial, the defendant was convicted. The Court of Appeals affirmed, reasoning that the defendant had no constitutionally protected privacy right in browsing activities conducted on a guest Wi-Fi network he accessed only after acknowledging terms of service that prohibited illegal activity and disclosed potential monitoring and law enforcement cooperation.

Analysis

The Court observed that Article I, section 9, of the Oregon Constitution differs fundamentally from the Fourth Amendment in its approach to privacy. Under Fourth Amendment jurisprudence, a search occurs when law enforcement invades an individual’s reasonable expectation of privacy. Carpenter v. United States, 585 U.S. 296 (2018). By contrast, Oregon’s constitutional protection focuses not on subjective expectations but on rights. The Court stated that the “privacy protected by Article I, section 9, ‘is not the privacy that one reasonably expects but the privacy to which one has a right.’” State v. Campbell, 759 P.2d 1040 (Or. 1988).

This distinction carries significant analytical consequences, according to the Court. Article I, section 9 directs attention toward governmental conduct and societal expectations for that conduct, rather than toward the individual’s own expectations. The Court reiterated that protected privacy interests are determined by reference to “social and legal norms of behavior,” including whether governmental conduct would violate principles embedded in trespass laws and conventions against eavesdropping. The fundamental inquiry asks whether the government’s conduct, “if engaged in wholly at the discretion of the government, will significantly impair ‘the people’s’ freedom from scrutiny.” Campbell.

Internet Privacy Through
Third-Party Networks

The State argued that accessing the internet through a third party’s property, while knowing that party could monitor and share activity, extinguishes any privacy right. The Court rejected this argument as incompatible with modern realities.

The Court reasoned that participation in contemporary society virtually requires internet access. Wireless access necessarily involves third-party intermediaries, including ISPs for home networks, hotel operators, apartment complexes, or public Wi-Fi providers. Every internet connection carries some risk of third-party monitoring. If this theoretical possibility eliminated constitutional protection, privacy in internet communications would become “a historical footnote,” and Wi-Fi networks would become “access points for governmental mass surveillance without limitation,” according to the Court.

The Court cited State v. Lien/Wilverding, 441 P.3d 185 (Or. 2019), which held that individuals retain privacy interests in curbside garbage despite entrusting it to sanitation companies. In that case, the state Supreme Court recognized that “privacy norms exist notwithstanding some limited public exposure of information.” Similarly, in Gollersrud v. LPMC, LLC, 541 P.3d 864 (Or. 2023), the Supreme Court rejected the argument that employer email monitoring capabilities destroyed attorney-client privilege, reasoning that such logic “ignores the practicalities of modern life” because most personal email providers also reserve monitoring rights.

The Court concluded that societal acceptance of potential third-party monitoring does not translate to acceptance of governmental surveillance through those channels. For Article I, section 9 purposes, the Court declared that “Oregonians have a right to freedom from governmental scrutiny, even if they may not have an expectation to freedom from potential third-party scrutiny.”

Terms-of-Service Provisions

The Court likewise rejected the proposition that A&W’s terms-of-service provision eliminated the defendant’s privacy right. Because virtually all internet access requires accepting some form of terms of service, adopting this position would functionally eliminate constitutional privacy protection for all internet activity.

Terms-of-service provisions represent agreements between private parties, i.e., the service provider and the user. While such provisions may inform the obligations between those parties, “they are not reflective of the general societal and legal norms for government conduct, nor do they dispositively set the standard by which governmental conduct will be judged,” the Court stated.

The Court distinguished State v. Meredith, 96 P.3d 342 (Or. 2004), where the government placed a tracking device on a government-owned vehicle used by a government employee during government work. Unlike that scenario, A&W did not provide the defendant’s computer, nor was the defendant using his computer in A&W’s employment or at A&W’s direction. A&W merely provided a means of access, analogous to a roadway.

State Action

The Court agreed with the trial court that A&W’s year-long surveillance was attributable to the State. Under State v. Sines, 379 P.3d 502 (Or. 2016), private conduct becomes state action when it becomes “so intertwined with the conduct of a state actor that the private citizen’s actions are essentially those of the state.” Courts evaluate objective conduct to determine whether the state was “involved enough in guiding, encouraging, or supporting the informant’s activities that the informant’s conduct is fairly attributable to the state.” State v. Benton, 534 P.3d 724 (Or. 2023).

Nothing indicated that A&W intended to surveil the defendant before law enforcement intervened. A&W’s initial reaction was to contact police and ask whether to terminate the user’s access. Instead, the investigating officer made multiple specific requests for information, A&W modified its firewall to send direct alerts to the officer, and the officer would call when he failed to receive those alerts. Both the consultant and the officer described their relationship as “working together.”

Conclusion

Thus, the Court held that A&W’s owner and consultant were state agents for Article I, section 9 purposes, and their conduct in assisting law enforcement constituted governmental action. That conduct invaded a protected privacy interest and therefore constituted a “search.” Because the search occurred without a warrant and the State established no applicable exception to the warrant requirement, the trial court erred in denying suppression.

Accordingly, the Court reversed the Court of Appeals’ decision in part, reversed the Circuit Court’s judgment, and remanded for further proceedings. See: State v. De Witt Simons, 375 Or. 70 (2026).   

Subscribe today

Already a subscriber? Login