OR: Third-party doctrine doesn’t apply to data a computer user stores in the cloud

The third-party doctrine doesn’t apply to data a computer user stores in the cloud. State v. Klaus, 351 Or. App. 738 (July 29, 2026) (Oregon’s decision page currently unavailable):

However, some governing principles undoubtedly apply. First, we are mindful that the United States Supreme Court has explained that the privacy interests in digital data are equal to or surpass those of a home, Riley v. California, 573 U.S. 373, 396-97, 134 S Ct 2473, 189 L Ed 2d 430 (2014), and the Oregon Supreme Court has found that reasoning to be “persuasive.” Mansor, 363 Ore. at 222 (citing Riley). Second, the vast majority of people conduct their business online, making digital data an “essential” and necessary part of modern life. See De Witt Simons, 375 Ore. at 82-84 (“Nearly every member of society, young or old, rich or poor, housed or unhoused, will use the internet to conduct what they intend to be private business—indeed, in many cases they must do so. In our age of paperless billing and cloud-based storage, health records are accessed and finances are managed online.”); Steven Arango, Cloudy with a Chance of Government Intrusion: The Third-Party Doctrine in the 21st Century, 69 Cath U L Rev 723, 734 (2020) (advocating for greater protection against warrantless searches of cloud data, and stating, “Today’s world requires speed, access, and reliability—only the cloud can provide all three of these features. Cloud storage is not merely beneficial to everyday life, it is essential.” (Footnotes omitted.)). In the context of abandonment, then, the intent to relinquish interests in digital data must be exceedingly clear, to overcome such strong privacy interests in an “essential” facet of modern life.

Put together, we conclude that the state did not meet its burden to demonstrate that defendant intentionally relinquished all of his protected interests in his digital data stored by third parties. The state cannot point to any evidence in the record, such as defendant giving his cloud accounts and passwords to another person to use instead of him, canceling his email accounts, or demonstrating affirmatively that he no longer wished to continue using his accounts, that would indicate he no longer had rights in his digital data. The state merely points to defendant’s inaction as it relates to the physical laptop itself: defendant did not attempt to hide the laptop, did not manifest an attempt to maintain control over it, failed to assert any ownership interest in the laptop during the divorce proceedings, and failed to return to arbitration after the divorce. Those facts do not address steps defendant did or did not take regarding his digital data. The state thus failed to meet its burden to demonstrate abandonment of the digital data that was not solely on the laptop.