What is a “Keyword Warrant”?

“Keyword warrants” are search warrants “which force search engines to provide personal information on anyone who may have inputted certain terms….” C. Edano, “Beware What You Google: Fourth Amendment Constitutionality of Keyword Warrants,” 97 Wash.L.Rev. 977, 978 (2022):

In October 2020, the Denver Police Department hit a wall. The Department was investigating an arson at a home of eight individuals, killing five who were trapped inside. Police executed at least twenty-three search warrants, four of which searched through thousands of people’s locations via their mobile devices. Yet still, police officers could not pinpoint their suspect. Police then decided to follow in the footsteps of other departments around the nation; they filed three warrants to uncover any Google searches that included the address of where the fire occurred.

Id. at 977-78 (emphasis added).

Keyword warrants compel search engines to hand over the personal data of users who have searched specific terms, within a certain timeframe, sometimes within a certain area.

Id. at 979 (emphasis added).

Ms. Edano notes: “Keyword warrants do not demand the search history of a specific person, but rather, keyword warrants demand the information of persons who have searched for a single or various keywords. These demands for information are not tied to a crime in terms of location or any other tangible piece of evidence. Instead, keyword warrants suspect individuals who shared a common interest in specific words or addresses.”  Id. at 984.

The article states that: “Google, the most popular search engine, retains data on users’ identities and what users search, making it the ideal target of these warrants.”  Id. at 979-80.

Google retains incredibly detailed personal data. Google collects personal identifiers (name, phone number, and address), demographic information, commercial information, biometric information (if provided), internet and network information (search terms, content and advertisement views, interaction with applications, browsers, devices, IP addresses, and activity on third-party sites that use Google services), geolocation data, voice and audio information (if provided), professional or educational information (if using an account maintained through an organization), photos and videos, and emails and documents. Google generally protects private information by only allowing the user to see this data and shielding user data from “unauthorized access, alteration, disclosure, or destruction of information” Google keeps. As of 2020, Google began automatically deleting users’ location history and web and application activity after eighteen months for newly created accounts. However, certain actors, such as national or international governments, can demand user information, and law enforcement has increasingly used third party subpoenas and warrants to seek personal user information.

Id. at 981-82.  “Similar to Google, Microsoft collects an abundance of personal information through Bing search, and because Windows owns most of the worldwide computer market share, most computer-users have access to Bing.”  Id. at 983.

Ms. Edano’s law review article compares keyword warrants to geofence warrants and tower dump warrants.  A petition to the U.S. Supreme Court is pending on geofence warrants. Certiorari Petition to U.S. Supreme Court in 4th Circuit Geofence Decision – E-Discovery LLC (Aug. 4, 2025).

For a discussion of the Stored Communication Act (“SCA”) and keyword warrants, see Google LLC v. United States, 2025 WL 778150, at *1 (D.D.C. Feb. 25, 2025).

[T]he SCA permits the Government to require the disclosure of the widest possible range of information if it applies for a “warrant” “using the procedures described in the Federal Rules of Criminal Procedure” or a state counterpart. [18 U.S.C.] § 2703(a), (b)(1)(A), (c)(1)(A). SCA warrants require no prior notice to the subscriber, but, under Federal Rule of Criminal Procedure 41, they — like all warrants — require “a judicial finding of probable cause based on sworn testimony or an affidavit.”

Id. at *1.  The Google court wrote:

Throughout its investigation [Redacted], the United States has repeatedly obtained a series of “reverse search” warrants directed to Google for information pertaining to various of its account holders or users. Reverse-search warrants are a peculiar species of warrant. They “differ from warrants authorizing surveillance of a known suspect, since they are normally employed when the identity of a suspect is unknown.” …The Government typically goes through a two-step process when seeking such warrants…. At step one, it obtains a warrant for anonymized information about various accounts or users that match certain criteria — e.g., that they were in a particular location (a “geofence” warrant) or searched for certain terms (a “keyword” warrant) within a given timeframe…. After reviewing and culling that information, the Government then — at step two — obtains a second warrant or court order to de-anonymize accounts it wishes to investigate further.

Id. at *2 (emphasis added).

In Google, the government served a keyword warrant and the court described the process: “In response, Google turned over thousands of responsive searches along with anonymized user data for an estimated 1,341 users’ who had made those searches….  The Government then began a process of reviewing that information and seeking de-anonymization of the user data in tranches — step two. ”  Id.  It then obtained a supplemental warrant for identifying information on users who made ~293 of the searches.  Id.  “Google subsequently provided de-anonymized information on 251 users.”  Id.  The government than obtained a second warrant “for another batch of users”; however, Google had already purged those files. Id.

A year and a half later, the United States procured the warrant at issue here…. Approved again under § 2703 and Rule 41, it sought identifying information about users who had made approximately 537 of the searches previously identified (“querying users”), as well as anyone who had shared devices or identifiers with those users (“technically connected users”)…. For the querying users — thought to encompass between 283–311 accounts — the warrant demanded the same information as did prior supplemental warrants…. Slightly more circumscribed information was sought for the technically connected users.

Id. at *2.

Google then moved to quash, unsuccessfully.  The court held that Google did not have “any statutory or constitutional right to bring a pre-execution motion to quash on the ground that the warrant violates the Fourth Amendment.”  Id. at *3.  Next, it clarified “that, in any event, no changed circumstances call into question the original probable-cause determination, and Google’s invocations of the First Amendment and the Due Process Clause do not entitle it to any further protections.”  Id. Finally, the court concluded “by rejecting Petitioner’s claim that the records requested are too voluminous in nature to produce and that compliance would thus pose an undue burden.”  Id. After explaining its analysis in detail, the Google court wrote: “For the foregoing reasons, the Court will affirm the Order below and deny Google’s Motion to Quash. A separate Order so stating will issue this day.”

“The full extent of law enforcement’s use of keyword search warrants remains largely unknown.”  Brian L. Owsley, “Searching A Person’s Thoughts: Keyword Search Warrants and Fourth Amendment Concerns,” 28 Stan. Tech. L. Rev. 66, 69 (2024).

One example is a 2017 fraud case.  The fraudster obtained a funds transfer using the victim’s identifying information.  The police “sought to compel Google to produce information on all persons or devices who searched for the victim’s name during the 38-day span of December 1, 2016, to January 7, 2017.”  Id. at 73. The warrant was issued and served; however, the results are not known. Id.

In 2018, a bomb in Austin, Texas, killed a man.  It exploded on his front porch.  Additional bombs exploded. “After the first three explosions, the FBI sought and received three keyword search warrants. These warrants sought information from the search engines operated by Google, Yahoo, and Microsoft for various iterations of the street addresses where the explosions occurred.”  Id. at 74.  After a fourth bomb, the FBI applied for information of searches around the explosion site based on street names. Id.  Later, :”the FBI filed a fifth search warrant application directed at Google related to the Austin explosions. Specifically, this warrant requested data from Google for various search terms like ‘pipe bomb,’ ‘PVC bomb,’ ‘explosive,’ ‘ied,’ ‘trigger,’ ‘package,’ and ‘fragmentation.’”  A suspect was identified, fled, and detonated a bomb, killing himself. Id.

Prof. Owsley describes a number of other uses of keyword searches, id., passim; see also Nicole Chan, “Wrong Search at the Wrong Time: Keyword Search Warrants and the Fourth Amendment,” 45 Cardozo L. Rev. 271, 272, 284 (2023), and the technical process in detail:

When Google is served with a keyword search warrant compelling the company to identify users who searched for a particular term during a particular time frame, it implements a staged process to produce a response for law enforcement.

First, an employee in Google’s Legal Investigation Support team formulates a text-based query matching the warrant’s specifications. The query is then run against billions of daily search records from Google Search and Google Maps. (Users can delete their search records, potentially excluding them from these searches.)

Once matches are identified from this search, the Legal Investigation Support team creates a CSV file containing records of searches matching the specified terms. These may be limited to exact matches, or, more commonly, “the results may extend to queries that include the specified search terms as part of a query that contains other words.”

Next, Google de-identifies the CSV results to remove the account-identifying information from the results. Google produces this de-identified version to law enforcement as “potentially responsive data” that includes a number of different categories of information. These various categories include the search date and time; the coarse location data of where the user conducted the search based on the internet protocol (“IP”) address; the user’s actual search; and the user’s actual results from the Google search. Moreover, this initial production would also contain the host, which is the Google domain name that the user contacted. Typically, it would include the request, “which is the latter part of the URL, following the host, that is associated with the user’s search.” When the search is performed by an authenticated user’s account, the results would also contain an abbreviated Google identifier known as a GAIA ID. If the user does not have an authenticated account, then an abbreviated version of that person’s Browser Cookie ID would be provided. Finally, the categories include “the associated user agent string.”

By abbreviating either the GAIA ID or the Browser Cookie ID, the Litigation Investigation Support team de-identifies the data produced in response to the keyword warrant. After receiving this initial production, a law enforcement officer reviews it to determine whether the de-identified results might be relevant to the criminal investigation. For example, Google’s initial de-identified production might reveal a number of users searched for terms requested by the warrant during a specific timeframe. After a review of the de-identified data related to those users, law enforcement officers may exclude searches for which the complete query contained additional search terms outside the parameters of their search. Additionally, officers may exclude results related to addresses in cities or states outside the targeted criminal investigation area.

When the original search warrant does not authorize the law enforcement agency to obtain identifying data regarding the targeted suspects, the officers must apply for another search warrant ordering the disclosure of this data and information. Here, when Google provides information based on abbreviated GAIA IDs, the data includes the IP address related to the search (when available), the full GAIA ID, and the basic subscriber information associated with that GAIA ID, as defined in the Stored Communications Act. For further queries that include abbreviated Browser Cookie IDs instead, Google provides the IP address related to the search as well as the full Browser Cookie ID.

Google maintains that this process is designed to safeguard its users’ privacy, with narrowly-tailored search parameters and a two-stage deanonymization process helping to ensure that law enforcement only gets the  information that would prove useful in investigating a particular crime.

Id. at 69-71; see also Chan, “Wrong Search,” 45 Cardozo L.Rev. at 287.[1]

____

[1] A forthcoming blog, “Geofencing, Geotargeting, and Geo-blocking, in Civil Litigation, Information Governance, and Regulation,” will address how those concepts are beginning to appear in civil contexts.