The Warrant You'll Never See: How US Agencies Can Access Canadian Data Without a Court

Aug 5

Written By Garth B

How Safe Are Canadians from US Surveillance They Never See? (Part 2 of 3)

Part 1 looked at the quiet way US agencies reach your data: they buy it, sidestepping the warrant process entirely. This post looks at the legal route, where the government compels the data instead of purchasing it. But you may be surprised to learn that "legal" does not always mean "a judge agreed." There are two possible doors in this case and one does indeed open to a court of law. However, a US agency can open door number 2 all by itself and a Canadian is already on the wrong side of it.

A Canadian's data lives in US-controlled systems, reachable by US legal process, sometimes with a judge, sometimes without; sometimes with notice, sometimes without

The Vacuum Warrant that Scoops up Everything: Geofencing

A normal search warrant starts with a suspect: police name a person, convince a judge, and collect that person's records. However, a geofence warrant (AKA a reverse-location warrant) runs the process backwards. Police name a place and a time (say a city block between 2 and 3 pm) and order a company to hand over data or devices inside that defined box. You start with the location and work backwards to the people.

The company on the receiving end is almost always Google, which stores detailed "Location History" for enormous numbers of users. Because the request is defined by geography rather than by suspicion, it sweeps up bystanders, those in the wrong place at the wrong time. Privacy advocates note that a single geofence request can rope in the location records of hundreds or even thousands of innocent people. [1]

Where Geofencing is Used

Now, while I have you at that “cringe” moment, you may be wondering what jurisdictions use geofence warrants. At the time of this writing we were unable to find any reference to a reported Canadian decision documenting the standard Google-style process in which police obtain every device identifier within a geographic boundary and then progressively identify users. Canadian police could theoretically seek comparable information using a search warrant, general warrant or production order but section 8 of the Canadian Charter of Rights and Freedoms would apply:

“Everyone has the right to be secure against unreasonable search or seizure.” [3]

In the case of the EU, EU law can prohibit general or indiscriminate geofence surveillance, but it does not categorically prohibit every geographically targeted location-data order. The EU Charter of Fundamental Rights has several constraints that can apply here. So it seems that “the land of the free” is really the only jurisdiction where geofence warrants are established and documented.

To be fair American courts seem to be disagreeing if this type of warrant violates their constitutional 4th amendment (unreasonable search and seizure). On June 29, 2026, the US Supreme Court weighed in for the first time. In Chatrie v. United States, decided 6-3 and written by Justice Elena Kagan, the Court held that when police obtain your stored location history from a company like Google, that is a "search" under the Fourth Amendment (you have a reasonable expectation of privacy in it) so the government has to clear the Constitution's bar first. [2]

The summons that skips the judge

The second door doesn't involve a judge at all. American Federal agencies such as DHS and ICE can issue administrative summonses (and subpoenas) on their own authority and only approved by the agency itself, not reviewed by a neutral court. [4] Here is the part most people don't realize: a company that receives one is not actually required to comply unless and until a court orders it to. [7] But companies frequently hand the data over anyway.

The Canadian, The Customs Law, and no judge

This is not hypothetical. On February 14, 2026, DHS issued an administrative summons to Google demanding a sweep of personal information about a man identified in court only as John Doe: his name, where he lives, extensive records of his physical movements, the websites he visits, and the people he communicates with online. [5] Doe is a Canadian citizen who lives in Canada and has not set foot in the United States since 2015. [5] DHS issued the demand on its own authority, with no court involved, citing a customs-enforcement statute enacted in 1930 after Doe posted criticism of the Trump administration's immigration enforcement on X. [5]

Mr. Doe regularly posts strongly worded criticism of President Trump and his policies on social media, including X. Collectively, these posts have received more than 100,000 views.

The ACLU, representing him, is suing to quash the summons, and it frames the stakes bluntly: earlier cases like this targeted people inside the US, but Doe is abroad, so if DHS can reach him, it may be able to monitor a critic anywhere in the world. [4]

Will You Even Know?

Mr. Doe only knows about the summons for one reason: Google told him.

That notice is the only thing that gave him the chance to fight it in court and also inform the rest of us about these practices. But notification is not guaranteed and Google recently withheld it. In 2025, ICE sent Google an administrative subpoena for the account data of Amandla Thomas-Johnson, a student who had briefly attended a campus protest. Google handed over his information without advance notice, breaking a promise it had made to users for nearly a decade to tell them before disclosing their data to law enforcement. [6]

So notice is the difference between Doe, who could sue, and Thomas-Johnson, who found out only after his data was already gone. Whether you ever learn that your information was handed over can come down to a company's discretion.

Canadian Vulnerability

So while American courts argue over their 4th amendment rights what about data belonging to Canadian’s when a company with American ties receives an Administrative Summons? Decades ago, in United States v. Verdugo-Urquidez (1990), the Supreme Court held that its protections do not extend to a nonresident foreigner's property located abroad, and suggested that a non-citizen earns those protections only after developing "substantial connections" with the country. [8] A Canadian sitting in Canada has no such connection.

Whether a ruling like Chatrie shelters someone in Doe's position (his data sits on Google's US servers, even though he does not) is unsettled, and existing law works against him. His case is testing that exact frontier. [4]

Taken together, the problem is clear: the government used an administrative summons against Doe, avoiding the judicial review required for Chatrie’s warrant, while Doe may not receive the constitutional protection Chatrie strengthened. The safeguard was strengthened for Americans in the same season a Canadian was being targeted with the one tool it doesn't touch.

Where this leaves us

Whichever door is used, the thought from Part 1 holds: a Canadian's data lives in US-controlled systems, reachable by US legal process, sometimes with a judge, sometimes without; sometimes with notice, sometimes without.

In Part 3, we turn home and ask the question that actually matters for Canadians: does Canadian law protect you here and can it do anything at all when the data, and the company holding it, answer to Washington?