Oregon Recognizes Article I, Section 9 Privacy in Internet Browsing Even on Public Wi‑Fi—Terms-of-Service Warnings Do Not Waive; Police-Directed Hotspot Monitoring Is a Warranted “Search”

Case: State v. De Witt Simons, Citation: 375 Or 70 (2026) (Oregon Supreme Court, Mar. 26, 2026)

1. Introduction

State v. De Witt Simons asked whether Article I, section 9, of the Oregon Constitution protects privacy in a person’s internet browsing activity when that person accesses the internet through a publicly available Wi‑Fi network operated by a private business. The Wi‑Fi provider—an A&W restaurant—used a firewall that logged unencrypted web traffic and flagged certain activity. After the provider contacted police, law enforcement coordinated with the provider for roughly a year, obtaining detailed URL logs (255,723 entries) and packet-capture data, without a warrant, ultimately leading to a home search warrant and convictions for encouraging child sexual abuse (ORS 163.684).

The key issues were:

  • Privacy/right-to-scrutiny question: Does Article I, section 9 recognize a protected privacy interest in internet browsing on public Wi‑Fi?
  • Contract/notice question: Do Wi‑Fi “terms of service” warning that the provider may monitor and cooperate with authorities eliminate that privacy right?
  • State action question: When does a private network operator’s monitoring become attributable to the state?
  • Remedy: If the monitoring was a warrantless search, should suppression follow and how should the warrant for the home search be evaluated on remand?

2. Summary of the Opinion

The Oregon Supreme Court reversed the Court of Appeals in part and reversed the circuit court judgment, remanding for further proceedings. The court held:

  • Article I, section 9 protects internet browsing privacy even when a person uses a third-party network, including a public Wi‑Fi hotspot.
  • Terms-of-service provisions like those here do not extinguish that privacy right; otherwise, privacy in internet activity would be effectively eliminated given the ubiquity of ISP/technology terms.
  • A&W’s year-long monitoring was state action because it was guided and supported by police (including instructions not to block the user, tailored logging, alerts to an officer email, and ongoing coordination).
  • The year-long surveillance was a “search” under Article I, section 9; it was warrantless, and on this record the state failed to establish an exception to the warrant requirement.

The court resolved the case on the Oregon Constitution and declined to reach the Fourth Amendment question.

3. Analysis

A. Precedents Cited and How They Shaped the Decision

1) Article I, section 9 methodology: “rights,” not “expectations”

  • State v. Juarez-Godinez, 326 Or 1 (1997): Provided the familiar sequencing—first determine whether conduct is a “search” or “seizure”; if not, Article I, section 9 does not apply.
  • State v. Wacker, 317 Or 419 (1993): Anchored the definition that a “search” occurs when the government invades “a protected privacy interest.”
  • State v. Campbell, 306 Or 157 (1988) and State v. Tanner, 304 Or 312 (1987): Central to the court’s framing that Article I, section 9 protects “the privacy to which one has a right,” not what one “reasonably expects.” Campbell’s “freedom from scrutiny” test (“if engaged in wholly at the discretion of the government”) became the opinion’s normative yardstick for digital surveillance.
  • State v. Newcomb, 359 Or 756 (2016): Reinforced that protected privacy is measured by “social and legal norms of behavior, such as trespass laws and conventions against eavesdropping,” again focusing evaluation on government conduct.
  • State v. Davis, 313 Or 246 (1992): Supported the proposition that Article I, section 9 limits “governmental conduct generally” (“[n]o law shall violate”), not merely statutes.
  • State v. Smith, 327 Or 366 (1998): Used for the threshold point that if conduct is not a “search,” Article I, section 9 protections do not attach; also cited for the need to read section 9 in light of technological capacity.

2) Limited exposure to third parties does not erase constitutional privacy

  • State v. Lien/Wilverding, 364 Or 750 (2019): A cornerstone analogy. Even though garbage placed curbside is exposed to a sanitation company and is physically accessible to others, social/legal norms still treat rummaging and scrutiny as “highly improper.” The Simons court imported this reasoning: modern life may require some exposure to intermediaries, yet constitutional privacy norms can persist.
  • Gollersrud v. LPMC, LLC, 371 Or 739 (2023): Reinforced that “risk of possible disclosure” to third parties is not dispositive. Like employer email monitoring, internet access inherently involves intermediaries (ISPs, hosts) that may have rights to monitor—yet that practical reality cannot collapse privacy protection.
  • Tort/privacy references via McLain v. Boise Cascade Corp., 271 Or 549 (1975), Mauri v. Smith, 324 Or 476 (1996), and Hinish v. Meier & Frank Co., 166 Or 482 (1941), plus Restatement (Second) of Torts section 652B: These authorities, used in Lien/Wilverding and referenced here, illustrate how “highly offensive” intrusions inform the “social and legal norms” lens under Article I, section 9.

3) Rejecting “terms-of-service as waiver” as a constitutional rule

  • State v. Lien/Wilverding, 364 Or 750 (2019): Provided the principle that section 9 privacy “is not defined by private property or contractual rights,” even if those rights may “inform” analysis. That principle directly undercut the Court of Appeals’ reliance on A&W’s terms of service.
  • The court also cited United States v. Warshak, 631 F3d 266 (6th Cir 2010) (in a footnote discussion) to show that even under the Fourth Amendment, courts have rejected treating an ISP intermediary role as eliminating warrant protections for content.

4) Distinguishing prior Oregon tracking precedent

  • State v. Meredith, 337 Or 299 (2004): The state’s primary reliance. The court distinguished Meredith because it involved a government-owned truck and tracking only its location in the context of employment; by contrast, Simons involved a private person’s computer, private browsing activity, and a public-access network functioning more like a conduit than an employer-owned instrumentality.
  • State v. Campbell, 306 Or 157 (1988): Used both as historical foundation and as contrast—Campbell condemned warrantless clandestine technology-enabled scrutiny that, if discretionary, would be “a staggering limitation on personal freedom.” Simons treats year-long URL/PCAP monitoring as analogous in “freedom from scrutiny” terms.

5) State action: when private monitoring becomes government conduct

  • State v. Sines, 359 Or 41 (2016): The leading statement that private conduct can become “so intertwined” with state conduct that it becomes subject to constitutional restrictions; also supplied the “communicated authorization” focus.
  • State v. Benton, 371 Or 311 (2023): Updated and synthesized the state-action approach—objective statements and conduct, not subjective motives; no single metric; ultimate question is whether state guidance/encouragement/support makes conduct fairly attributable to the state.
  • State v. Smith, 310 Or 1 (1990) and State v. Acremant, 338 Or 302 (2005): Provided factors such as initiation/planning/control/support and the limited role of motive.

6) Federal cases used for context (but not dispositive)

  • Carpenter v. United States, 585 US 296 (2018) and Riley v. California, 573 US 373 (2014): Cited to underscore modern dependence on digital connectivity and the stakes of pervasive digital surveillance (while reaffirming Oregon’s distinct “rights” framework).
  • Oliver v. United States, 466 US 170 (1984): Cited to illustrate the Fourth Amendment “reasonable expectation of privacy” framing that Oregon expressly does not adopt.

B. Legal Reasoning

1) The protected interest: internet browsing is private in the section 9 sense

The court reasoned from social reality and constitutional principle: “Participation in the modern world virtually requires access to the internet,” and access necessarily passes through third parties. Because third-party intermediaries are unavoidable, a rule that “possibility of monitoring and disclosure” destroys privacy would, functionally, eliminate privacy in internet use altogether. Drawing on Lien/Wilverding and Gollersrud, the court treated “limited exposure” to intermediaries as compatible with continued constitutional protection against government scrutiny.

2) Contract notice does not set the constitutional baseline

The Court of Appeals had treated A&W’s user agreement (warnings about monitoring, suspension, and cooperation with authorities) as defeating privacy. The Supreme Court rejected that approach because Article I, section 9 evaluates the permissibility of government scrutiny under social/legal norms, not the shifting boilerplate of private terms. The court emphasized the practical ubiquity of terms-of-service in all internet access (including at home via an ISP), warning that elevating such terms into a constitutional waiver mechanism would enable “governmental mass surveillance without limitation.”

3) The conduct at issue: year-long URL and PCAP collection is “scrutiny” that triggers the warrant rule

The monitoring went far beyond a single incident: it captured exact URLs (including file names) and PCAP data capable of reconstructing unencrypted communications—over a year. Under the court’s “freedom from scrutiny” framework (from Campbell), discretionary government access to that level of browsing detail is precisely the kind of technologically amplified surveillance Article I, section 9 must address.

4) Attribution: A&W became a state agent after police direction and coordination

The court agreed with the trial court that the private actors’ conduct was attributable to the state once law enforcement instructed A&W not to block the user, asked for continued logging tailored to “IanAnderson-PC,” received automated alerts, and worked “collaboratively” for a year. Applying Sines and Benton, those objective facts demonstrated sufficient guidance and support to make A&W’s surveillance “fairly attributable to the state.”

5) Warrant requirement and the state’s litigation posture

Having found a warrantless search, the court noted that “on this record, the state failed to establish that an exception to the warrant requirement applied,” and further observed that the state had not argued an applicable exception. The remedy was reversal and remand for the trial court to reconsider the suppression/controversion motion in light of the new constitutional holding.

C. Impact

  • Public Wi‑Fi is not a constitutional “privacy-free zone”: Investigators cannot avoid warrants merely because a suspect uses an open hotspot or a network the suspect does not “operate or control.”
  • Terms-of-service warnings are not automatic constitutional waivers: Boilerplate stating that a network “may monitor” or “may cooperate” does not eliminate the Article I, section 9 privacy right in browsing activity. (The court also flagged, without deciding, that explicit “consent” language might raise a distinct warrant-exception question in another case.)
  • State-action doctrine gains practical teeth in tech investigations: When police “work collaboratively” with private network operators—directing ongoing collection, tailoring tools, and integrating alerts—courts are likely to treat the private entity’s collection as state action.
  • Doctrinal signal for other third-party digital data: The opinion’s reasoning (limited exposure does not erase privacy; intermediaries are unavoidable) is likely to influence disputes over other categories of detailed digital traces held by third parties, especially where access enables reconstruction of a person’s intellectual and associational life.
  • Litigation consequences: The remand posture leaves room for disputes about suppression causation and warrant-taint analysis in subsequent proceedings, but the core constitutional rule now constrains investigative design going forward.

4. Complex Concepts Simplified

  • Article I, section 9 “search”: In Oregon, a search occurs when the government invades a privacy interest the public has a right to enjoy—measured by social/legal norms and the dangers of unchecked government scrutiny (not by what an individual “expected”).
  • URL logs: A URL is the precise web address visited. Logging URLs (including file names) can reveal far more than general domain names; it can expose specific pages, queries, and content paths.
  • Unencrypted traffic: Data sent without encryption can be read by intermediaries on the network path; that technical accessibility does not, by itself, make government inspection constitutionally permissible.
  • PCAP (packet capture) data: A recording of data packets transmitted over a network; it can allow reconstruction of unencrypted browsing and communications content.
  • MAC address / “packet sniffer”: A MAC address identifies a network interface; a “packet sniffer” can detect and help locate radio traffic associated with a device.
  • State action / state agent: A private party becomes a state agent when police involvement—through guidance, encouragement, support, or coordination—makes the private conduct fairly attributable to the government.

5. Conclusion

State v. De Witt Simons establishes an important Oregon constitutional rule for the digital age: Oregonians retain an Article I, section 9 privacy right in their internet browsing activities even when they access the internet through a public Wi‑Fi network they do not control, and that right is not nullified by standard terms-of-service warnings. When law enforcement coordinates with a network operator for sustained monitoring and collection of detailed browsing data, that conduct is attributable to the state and constitutes a “search” requiring a warrant absent a proven exception. The decision rejects a path by which ubiquitous internet contracts could have become a de facto license for warrantless digital surveillance.

Note on the separate opinion: Justice Bushong concurred in the remand disposition and agreed the year-long surveillance should be treated as a “search” requiring a warrant, but rejected the majority’s conclusion that defendant had a protected privacy right in use of A&W’s Wi‑Fi under the court’s existing “protected privacy interest” framework. The concurrence/dissent urged reconsideration, in a future case with briefing, of Oregon’s traditional approach to defining a “search” under Article I, section 9.