The U.S. Supreme Court on Monday limited the law enforcement use of “geofence” search warrants, in a major legal ruling that is likely to have broad ramifications for privacy rights and law enforcement across the United States.

In the 6-3 ruling, the U.S. top court said that “an individual has a reasonable expectation of privacy in his cell-phone location information.” According to the court, that means people have privacy rights when it comes to the location history collected by their phones, as well as the services and apps running on them. 

Because of that, the court ruled that authorities need to obtain a search warrant when asking tech companies, such as Google, for the location data of their users, including when requesting historical geofence location data. 

In part, the Supreme Court argued that authorities need to obtain a search warrant to get geofence location data because a user is not willingly sharing their location data to a company like Google by simply using its services. If that was the case, then the “third party doctrine,” which generally says people have no expectation of privacy when it comes to data they willingly share with others, would apply. In those cases, authorities don’t need a search warranty to obtain user data from telecom providers, for example. 

Geofence warrants allow law enforcement to force tech companies to hand over information about where any of its millions or billions of users were located at a particular place in time, based on a record of their phone’s location stored in their databases. In practice, police will draw a shape over a map and ask a judge to allow them to demand that tech companies, such as Google, search their vast banks of users’ location data and tell them which of their users was there at the time of inquiry.

Critics argued that these oft-called “reverse” search warrants are unconstitutional because they are inherently overboard and include innocent people’s data.

The court seemed to agree, but stopped short of banning the use of geofence warrants altogether, allowing police to narrow their data requests when asking for a search warrant. 

In other words, the Supreme Court simply ruled that the 4th Amendment, which protects against unreasonable searches and seizures and effectively protects privacy rights, applies to location data collected by companies such as Google from their users’ cellphones. The decision doesn’t stop law enforcement from getting historical cellphone location data, it simply ruled that authorities need to get a search warrant when requesting geofence location information, and show that there’s probable cause that the target may have committed a crime. 

The decision centers on a case brought by Chatrie v. United States, who accused the government of using evidence during his trial for bank robbery collected by an unconstitutional search warrant. Okello Chatrie’s lawyers argued that geofence warrants allow investigators to “search first and develop suspicions later,” and flouting long-standing norms around how government authorities demand to search or seize data from companies. 

Authorities typically have to establish “probable cause” linking a person to a crime to justify a search warrant, whereas critics argue geofence warrants work in reverse.

The Supreme Court took on the case after several legal cases involving geofence warrants, including Chatrie’s, split the courts around the United States, including at the appeals level.

It’s not immediately clear how the ruling will affect past court cases. A spokesperson for the Department of Justice did not respond to a request for comment.

The ruling was not expected to change Chatrie’s sentence in his case as previous courts ruled that the evidence obtained from the geofence warrant was collected in good faith. Chatrie’s attorneys did not respond to a request for comment from TechCrunch.

The Supreme Court ruled that it is now up to the Appeals Court to decide whether the search warrant requested in the Chatrie case showed probable cause and thus was valid. 

Some companies that were frequently targeted with requests for location data, like Google, have begun storing users’ location data on their devices and not on their servers to stop handing over users’ data, prompting investigators to go to the users themselves. Other companies that store location data, such as Microsoft, Uber, and Yahoo, also receive geofence warrants on a regular basis.