ESPs Remain Private Actors When Scanning for CSAM; Payano-Roman Factors Are Non-Dispositive Under a Totality Test

I. Introduction

In State v. Andreas W. Rauch Sharak (2026 WI 4), the Wisconsin Supreme Court addressed whether Google’s scanning of a user’s Google Photos content for child sexual abuse material (CSAM)—followed by employee review and a report to the National Center for Missing & Exploited Children (NCMEC)—constituted a government search triggering the Fourth Amendment.

After Google flagged four files, an employee opened and viewed them, and Google submitted a CyberTip to NCMEC. NCMEC forwarded the tip to Wisconsin authorities. A detective then viewed the files from the tip without a warrant and later obtained a warrant to search Rauch Sharak’s home and devices, leading to discovery of CSAM and a conviction for possession of child pornography.

The court of appeals certified three questions concerning (1) reasonable expectations of privacy given Google’s terms of service, (2) whether Google’s scan/review was a private or government search under State v. Payano-Roman, and (3) whether police needed a warrant before opening/viewing files sent via NCMEC. The Supreme Court focused on the second question and resolved the case on that ground.

II. Summary of the Opinion

The Court unanimously held that Google acted as a private actor, not as an instrument or agent of the government, when it scanned Rauch Sharak’s files and when an employee opened and viewed files flagged as CSAM. Accordingly, Google’s actions did not implicate the Fourth Amendment.

The Court further held that law enforcement’s warrantless viewing of the files in the CyberTip did not constitute a Fourth Amendment “search” because it fell within the private search doctrine: police merely repeated Google’s private search without exceeding its scope (a point Rauch Sharak conceded).

Because Google’s private-actor status was dispositive, the Court did not reach the certified question regarding a user’s reasonable expectation of privacy under Google’s terms of service.

III. Analysis

A. Precedents Cited

1. The constitutional baseline: government action requirement

  • Skinner v. Ry. Lab. Execs.' Ass'n, 489 U.S. 602 (1989): The Court treated Skinner as the controlling framework for when private conduct becomes governmental. It emphasized Skinner’s instruction that the inquiry “turns on the degree of the Government’s participation” and must be assessed “in light of all the circumstances.”
    Skinner exemplified government action where federal regulations authorized, structured, and effectively compelled railroads to conduct drug/alcohol testing—preempting state law, limiting employee refusal, and restricting employers’ ability to bargain away testing requirements. Wisconsin used this as the “high watermark” of governmental encouragement/endorsement/participation.

2. Wisconsin’s framework and clarification: what Payano-Roman means

  • State v. Payano-Roman, 2006 WI 47, 290 Wis. 2d 380, 714 N.W.2d 548: Wisconsin previously “adopted” the Skinner totality-of-the-circumstances approach for determining whether a private party acted as a government instrument/agent. In Payano-Roman, officers were present throughout a hospital stay and even helped administer a laxative to recover swallowed drugs; the Court deemed that search a government search given significant police participation and a “joint endeavor.”
    Key clarification in Rauch Sharak: Although Payano-Roman quoted language from the court of appeals about “three requirements” for a search to be “private,” the Wisconsin Supreme Court held those are not rigid requirements and no single consideration is dispositive. The governing method remains the totality of the circumstances.
  • State v. Rogers, 148 Wis. 2d 243, 435 N.W.2d 275 (Ct. App. 1988): Quoted in Payano-Roman for the three considerations often used to characterize a private search (police did not initiate/encourage/participate; private actor furthered its own ends; private actor did not act primarily to assist government). In this decision, those points were re-labeled as considerations rather than mandatory elements.

3. The private search doctrine and “scope” limitation

  • United States v. Jacobsen, 466 U.S. 109 (1984): Cited for the private search doctrine—government repetition of a private search does not count as a Fourth Amendment “search” so long as law enforcement does not exceed the scope of the private search. Wisconsin applied Jacobsen to uphold the detective’s warrantless viewing because Google’s employee had already viewed the same files and the defendant conceded scope was not exceeded.

4. Analogies and persuasive authorities on government agency and ESP scanning

  • United States v. Booker, 728 F.3d 535 (6th Cir. 2013): Used as a contrast—medical personnel can become government agents where the defendant is in police custody and police orchestrate hospital procedures to recover contraband.
  • United States v. Ringland, 966 F.3d 731 (8th Cir. 2020) and United States v. Miller, 982 F.3d 412 (6th Cir. 2020): Cited to support the proposition that Google has independent business interests in removing CSAM, and that scanning may proceed independent of NCMEC-provided hash lists. These cases reinforced the “private ends” portion of the overall totality analysis.
  • United States v. Rosenschein, 136 F.4th 1247 (10th Cir. 2025); United States v. Sykes, 65 F.4th 867 (6th Cir. 2023); United States v. Rosenow, 50 F.4th 715 (9th Cir. 2022); United States v. Meals, 21 F.4th 903 (5th Cir. 2021); and again Ringland: Cited for the strong federal-circuit consensus that 18 U.S.C. § 2258A, especially its disclaimer that providers need not affirmatively scan, does not convert ESPs into government agents.
  • Children's Health Def. v. Meta Platforms, Inc., 112 F.4th 742 (9th Cir. 2024), cert. denied, 145 S. Ct. 2846 (2025): Cited to characterize 47 U.S.C. § 230(c) as “entirely passive” and unlike the coercive regulatory structure of Skinner.
  • Does 1-6 v. Reddit, Inc., 51 F.4th 1137 (9th Cir. 2022): Used to rebut broad claims that § 230(e)(5) creates sweeping criminal liability for platforms that fail to remove sex trafficking content; the exception applies where the website itself violates the criminal statute by directly trafficking or knowingly assisting/facilitating.
  • United States v. Bebris, 4 F.4th 551 (7th Cir. 2021); United States v. Richardson, 607 F.3d 357 (4th Cir. 2010); State v. Pauli, 979 N.W.2d 39 (Minn. 2022); State v. Lizotte, 197 A.3d 362 (Vt. 2018): Cited to underscore that, “seemingly without exception,” other appellate courts have treated ESP CSAM scanning as private action rather than government search.

5. Ancillary citations shaping the court’s approach

  • Serv. Emps. Int'l Union, Loc. 1 v. Vos, 2020 WI 67, 393 Wis. 2d 38, 946 N.W.2d 35, overruled on other grounds by, Evers v. Marklein, 2025 WI 36, 417 Wis. 2d 453, 22 N.W.3d 789: Cited for the principle that the Court will not develop undeveloped state-constitutional arguments; hence the analysis proceeded solely under the federal Fourth Amendment.
  • Serv. Emps. Int'l Union Healthcare Wis. v. WERC, 2025 WI 29, 416 Wis. 2d 688, 22 N.W.3d 876: Cited to distinguish findings of fact from legal interpretations; the circuit court’s descriptions of statutory purpose/effect were treated as legal questions reviewed independently.
  • State v. Gasper, 2026 WI 3: Noted as a “sister case” addressing when law enforcement exceeds the scope of a private search if an officer opens/views files that an ESP’s systems flagged but no employee actually opened/viewed.

B. Legal Reasoning

1. The rule announced: totality-of-the-circumstances controls; no checklist

The Court’s central doctrinal move is to re-state and sharpen Wisconsin law: the instrument/agent inquiry is not governed by a rigid checklist derived from Payano-Roman and Rogers. Instead, consistent with Skinner, courts must examine the totality of the circumstances to assess “the degree of the Government’s participation.” The factors referenced in Payano-Roman (police initiation/encouragement/participation; private purpose; assistance-to-government purpose; “joint endeavor”) are helpful but non-dispositive.

2. Application to Google’s CSAM scan and employee review

On this record (notably “sparse,” with no suppression hearing), the Court concluded Rauch Sharak failed to carry his burden (preponderance of the evidence) to show Google acted as a government instrument/agent:

  • No government involvement in the search itself: Google scanned; an employee opened and viewed; law enforcement entered only after Google generated the CyberTip. This is the opposite of the police presence and participation that drove the result in Payano-Roman.
  • Independent private/business purpose: The Court credited Google’s interest in maintaining a safe platform and user experience, aligning with Ringland and Miller.
  • NCMEC’s “hash list” argument was too attenuated: Even assuming NCMEC provided a list of known CSAM, the Court deemed that insufficient participation—providing a tool is not the same as joining the search. It also noted authority suggesting Google could scan without NCMEC-provided values (Miller).
  • Federal statutory scheme did not coerce or deputize Google:
    • 18 U.S.C. § 2258A imposes a reporting duty upon discovery but expressly disclaims any requirement to “affirmatively search, screen, or scan” (subsection (f)(3)), which the Court treated as strongly cutting against government-agency status.
    • 47 U.S.C. § 230(c) provides immunity for voluntary good-faith content restriction; it does not compel scanning and is “passive,” unlike Skinner’s coercive regulations.
    • 47 U.S.C. § 230(e)(5) (and its cross-reference to 18 U.S.C. § 1591) did not, on the defendant’s underdeveloped showing, establish that ESPs face criminal liability simply for failing to search and remove illegal content.

3. Consequences for the warrant question: private search doctrine resolves it

Having found Google was a private actor, the Court treated law enforcement’s viewing of the CyberTip files as falling within United States v. Jacobsen: a non-search so long as the police do not exceed the private search’s scope. Because a Google employee had viewed the images first and Rauch Sharak conceded police stayed within that scope, no warrant was required for the detective’s initial viewing of those files.

4. Why the Court avoided the “expectation of privacy” question

The certified issue about reasonable expectations of privacy under Google’s terms of service became unnecessary once the Court concluded there was no government search by Google and no Fourth Amendment “search” by police under the private search doctrine. The Court explicitly declined to reach that question.

C. Impact

1. Doctrinal impact in Wisconsin: clarifying Payano-Roman

The most important state-law development is the Court’s clarification that Wisconsin uses a totality-of-the-circumstances approach—not a rigid three-part test—to decide when a private party becomes a government instrument/agent. Litigants can still argue the Payano-Roman/Rogers considerations, but courts are instructed not to treat any single factor as dispositive.

2. Practical impact on CSAM investigations involving ESPs

The decision strongly supports continued reliance on ESP CyberTips where (a) the provider’s systems flag content, (b) a provider employee actually opens/views the flagged files, and (c) law enforcement limits its initial viewing to what the private actor viewed. In such circumstances, Wisconsin courts are positioned to treat initial police viewing as within Jacobsen absent scope expansion.

3. Litigation shift to “scope” and to cases like State v. Gasper

Because “private actor” status for ESPs is now strongly reaffirmed, suppression litigation is likely to pivot to whether police exceeded the private search’s scope—especially when an ESP’s automated systems flagged content but no human reviewer opened/viewed it. The Court itself signaled this as a live issue by pointing to State v. Gasper.

4. Statutory “encouragement” is not “deputization”

The Court’s reasoning draws a line between statutes that encourage or protect private moderation (e.g., immunity and reporting rules) and regimes that compel or structure private searches so thoroughly that the private actor becomes a government instrument (as in Skinner). That line will matter in future challenges to public-private enforcement partnerships in digital contexts beyond CSAM.

IV. Complex Concepts Simplified

  • “Instrument or agent of the government”: A private company’s actions can count as government action if the government is sufficiently involved—through direction, control, participation, or coercive regulation. Wisconsin now emphasizes a holistic, fact-driven inquiry.
  • Totality of the circumstances: Courts do not apply a checklist; they consider all relevant facts together (who initiated the search, who participated, the private actor’s motives, the regulatory environment, etc.).
  • Private search doctrine (United States v. Jacobsen): If a private party already searched something, police can repeat that same search without a warrant—but only up to the same scope. Viewing additional files or revealing new information beyond what the private party saw can require a warrant.
  • CyberTip / NCMEC: A CyberTip is a report submitted by an electronic service provider to NCMEC when the provider discovers apparent CSAM. NCMEC forwards the report to law enforcement. In this case, NCMEC’s role occurred after Google’s scan and employee review.
  • Hash matching (CSAM detection): Providers often detect known CSAM by comparing digital “fingerprints” (hash values) of files against databases of known illegal images. The Court treated the provision of hash lists as a tool rather than government participation in a specific search.

V. Conclusion

State v. Rauch Sharak delivers two principal takeaways for Wisconsin Fourth Amendment law. First, it clarifies that determining whether a private actor is a government instrument/agent is a totality-of-the-circumstances inquiry; the considerations referenced in Payano-Roman and Rogers guide but do not control the analysis. Second, it reaffirms that an ESP like Google remains a private actor when it scans for CSAM and reviews flagged files for its own reasons, and that police may view the same files without a warrant when doing so stays within the scope of the provider’s private search under Jacobsen. The decision aligns Wisconsin with the dominant appellate consensus and shifts future disputes toward the “scope” boundary highlighted by the Court’s reference to State v. Gasper.