State of Wisconsin, Plaintiff-Respondent, v. Eric M. Naparalla, Defendant-Appellant. (2026)

¶1 Naparalla appeals from a judgment convicting him of possession of child pornography following his entry of a guilty plea. He argues that the circuit court erred in denying his motion to suppress the evidence he asserts was obtained in violation of his Fourth Amendment rights. For the reasons that follow, we affirm.

BACKGROUND

¶2 Instagram is an Electronic Services Provider (ESP) that offers messaging capabilities for its users. Using special software called PhotoDNA, Instagram scans all content uploaded or transmitted by a subscriber or user, searching for files that match a list of known child sexual abuse material (CSAM) and flagging such files for review. PhotoDNA was developed by Microsoft. Microsoft has made the software available to ESPs and the National Center for Missing and Exploited Children (NCMEC).

¶3 When scanning images later identified as coming from Naparalla's Instagram account, the PhotoDNA system flagged some images as depicting CSAM. Instagram alerted the NCMEC, which matched some of the files to known child pornography without opening and reviewing the photos, but by reviewing the photos’ hash values. The NCMEC then alerted the Wisconsin Department of Justice (DOJ) and provided the DOJ with the CyberTip report. The CyberTip report informed the DOJ that an Instagram user with the account labeled “tiffany3xd” had uploaded one or more digital files depicting child sexual abuse. Investigators traced the tiffany3xd Instagram account to Naparalla. The record reflects that DOJ agents viewed the flagged images without seeking a warrant to do so, but later sought and received a warrant to search Naparalla's house.

¶4 The State initially charged Naparalla with four counts of possession of child pornography following the search, but later voluntarily dismissed two counts after realizing that they were duplicate images. Naparalla subsequently filed a motion with the circuit court seeking to suppress the CyberTip report evidence as the product of an unconstitutional search. He argued that “[t]he warrantless search of the attachments to the CyberTip violated ․ Naparalla's Fourth Amendment rights to be free of unreasonable searches and seizures[.]” Accordingly, Naparalla maintained, all fruits of the poisonous tree should be suppressed. After considering the briefs and arguments of the parties, the court denied Naparalla's motion.

¶5 Naparalla entered a guilty plea to one of the two counts of possession of child pornography. The circuit court sentenced him to the mandatory minimum of three years of initial confinement. It also imposed five years of extended supervision. Naparalla appeals, renewing his challenge to the CyberTip report as violative of his Fourth Amendment rights.¹

DISCUSSION

¶6 The Fourth Amendment protects the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures[.]” U.S. CONST. amend. IV; see also Wis. Const. art. I, § 11. Warrantless searches “are per se unreasonable under the Fourth Amendment—subject only to a few specifically established and well-delineated exceptions.” Katz v. United States, 389 U.S. 347, 357 (1967) (footnote omitted). Fourth Amendment protections, however, are “wholly inapplicable ‘to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any governmental official.’ ” United States v. Jacobsen, 466 U.S. 109, 113-14 (1984) (citation omitted).

¶7 The issue before us is whether the circuit court erred in concluding that the State did not violate Naparalla's Fourth Amendment right to be free from unreasonable government searches and seizures. This presents a mixed question of fact and law. State v. Payano-Roman, 2006 WI 47, ¶16, 290 Wis. 2d 380, 714 N.W.2d 548. We will not overturn a circuit court's findings of fact unless clearly erroneous. Id. “However, we independently determine the ultimate question of whether the search was a government search or a private search.” Id.

¶8 Naparalla first takes issue with the State's position that he lacked a reasonable expectation of privacy in the CSAM material in his Instagram account. To challenge a search, “a defendant must have ‘a legitimate expectation of privacy’ in the area or items subjected to a search.” State v. Tentoni, 2015 WI App 77, ¶7, 365 Wis. 2d 211, 871 N.W.2d 285 (citation omitted). A defendant bears the burden of establishing a reasonable expectation of privacy. State v. Bruski, 2007 WI 25, ¶22, 299 Wis. 2d 177, 727 N.W.2d 503.

¶9 The State argues that Naparalla did not have a reasonable expectation of privacy in the CSAM sent through his Instagram account. However, even if we assume, without deciding, that he did have an expectation of such privacy, we now explain why Naparalla's assertion that Instagram was not a private actor when it scanned the images using PhotoDNA fails to persuade us.

¶10 “Private searches are not subject to the Fourth Amendment's protections because the Fourth Amendment applies only to government action.” Payano-Roman, 290 Wis. 2d 380, ¶17. Wisconsin courts apply a three-part test to determine when a search constitutes a private party search: “(1) the police may not initiate, encourage or participate in the private entity's search; (2) the private entity must engage in the activity to further its own ends or purpose; and (3) the private entity must not conduct the search for the purpose of assisting governmental efforts.” Id., ¶18 (citation omitted).

¶11 Applying the Payano-Roman factors here, it is clear that Instagram was a private actor. Naparalla has not established that the police initiated, encouraged, or otherwise participated in Instagram's PhotoDNA scan of the images Naparalla sent. See id. Moreover, Naparalla has failed to successfully challenge the State's position that Instagram furthers its own corporate interests when it scans transmitted images to ensure that CSAM is kept off its platform and does not scan the images to assist the government. See id.

¶12 Our supreme court recently addressed the issue of whether a search by a private entity such as Instagram is a private search under the Fourth Amendment. See State v. Gasper, 2026 WI 3, 419 Wis. 2d 12, 30 N.W.3d 367; State v. Sharak, 2026 WI 4, 419 Wis. 2d 363, 31 N.W.3d 305. As in Gasper with Snapchat and Sharak with Google, Instagram was not acting as a governmental entity with respect to Naparalla's account because it was searching the contents for its own private, business purposes. See Gasper, 419 Wis. 2d 12, ¶22-23; Sharak, 419 Wis. 2d 363, ¶20. The circuit court therefore properly concluded that the private-search doctrine applied because Instagram acted in its own interest in scanning the images.

¶13 Naparalla next argues that even if Instagram is a private actor, the NCMEC is a government actor, see United States v. Ackerman, 831 F.3d 1292, 1295-1300 (10th Cir. 2016), so it needed a warrant to review the tip and send the images to law enforcement. Assuming, without deciding, that the NCMEC is a government actor, there was still no violation if the search by the NCMEC did not expand the scope of the private search. See Jacobsen, 466 U.S. at 115-18 (“The additional invasions of respondents’ privacy by the government agent must be tested by the degree to which they exceeded the scope of the private search.”).

¶14 Here, Instagram, acting on its own accord, was the first to search Naparalla's Instagram account and discover the pornographic images in question. As we explained above, because these invasions of Naparalla's claimed expectation of privacy were committed by a private party and not through government action, they did not violate the Fourth Amendment. See id. at 115. The images the NCMEC relied on were the same ones Instagram had flagged. See id. at 117 (“The Fourth Amendment is implicated only if the authorities use information with respect to which the expectation of privacy has not already been frustrated.”). Therefore, the NCMEC did not violate Naparalla's Fourth Amendment rights because it did not exceed the scope of Instagram's private searching when it sent the images to police, which had already been identified as CSAM by Instagram.

¶15 Finally, Naparalla argues that even if we conclude that Instagram and the NCMEC did not violate his Fourth Amendment rights, those rights still were violated when the DOJ agents allegedly expanded the scope of the search by opening the images flagged by Instagram and forwarded by the NCMEC. Jacobsen and Gasper guide our analysis of this issue.

¶16 In Jacobsen, the Court held that the government agent did not exceed the private search when he reopened a package that Federal Express (Fed Ex) had damaged while in transit, requiring Fed Ex employees to open it and examine its contents for damage. Jacobsen, 466 U.S. at 111, 118. After discovering what the employees identified as likely contraband in the package, they called law enforcement and invited government authorities to review its contents. Id. The Court held that the government agent involved did not expand the private search conducted by Fed Ex employees because the defendant lost his privacy interest in the package once the employees had opened it, examined its contents, and invited the authorities to look at it. Id. at 119. The holding rested on the “virtual certainty that nothing else of significance was in the package[.]” Id.

¶17 In Gasper, our supreme court reaffirmed that courts should apply the Jacobsen test when examining whether the government unconstitutionally expanded a search beyond that of a private actor. Gasper, 419 Wis. 2d 12, ¶43. There, the court concluded that a hash-based search such as the one conducted here makes it virtually certain that the agent reviewing the images could discover no more than what the hash search revealed. See id., ¶¶6, 46. Viewing files identified with hash-value matches does not exceed the scope of the search already done by the private entity. Id. Any expectation of privacy was “frustrated by” the private search. Id. Thus, the court held, when a law enforcement officer opens files searched by a private actor to confirm they are CSAM, it does not expand the search. Id.

¶18 Similarly, we conclude here that any reasonable expectation of privacy Naparalla had in the child pornography was frustrated by Instagram's scanning it with PhotoDNA, labeling it as apparent CSAM, and forwarding it to the NCMEC. The PhotoDNA scan, done by a private party, was equivalent to opening and inspecting Naparalla's files. See id., ¶46. Instagram freely made the files available for inspection by sending it to the NCMEC, which then sent it to law enforcement at the DOJ.

¶19 In sum, Instagram's intervening action in scanning and hashing the images had already destroyed any expectation of privacy that Naparalla may have had, and the hashtag system essentially ensured that the reviewer would view nothing more from Naparalla's Instagram account than the images of child pornography. Thus, as in Jacobsen and Gasper, the DOJ agent's opening of the images presented in this case to confirm that they contained child pornography did not unconstitutionally expand the scope of the search.

CONCLUSION

¶20 For the foregoing reasons, we conclude that, even assuming for the sake of argument that Naparalla had a reasonable expectation of privacy in his Instagram account, it is irrelevant to our ultimate conclusion that the circuit court did not err in denying his suppression motion. As explained, Instagram and the NCMEC acted privately here and not as government agents, but even if the NCMEC had acted as a government agent, it did not expand the scope of the search beyond what the private actor had reviewed. The DOJ agents also did not unlawfully expand the scope of the search when they viewed the flagged images without a warrant.² Accordingly, the suppression motion was properly denied.

By the Court.—Judgment affirmed.

This opinion will not be published. See Wis. Stat. Rule 809.23(1)(b)5 (2023-24).

FOOTNOTES

1.   While this appeal was pending, our supreme court released State v. Gasper and its companion case, State v. Sharak. See Gasper, 2026 WI 3, 419 Wis. 2d 12, 30 N.W.3d 367; Sharak, 2026 WI 4, 419 Wis. 2d 363, 31 N.W.3d 305. Both addressed situations similar to that presented here, and the parties have submitted supplemental briefs addressing this appeal in light of those cases.

2.   We reach our conclusion here based on the Record before us. We disagree with Naparalla's contention that a remand to the circuit court is necessary to further develop the Record regarding the reliability of PhotoDNA or to review the specific terms of service involved here.

PER CURIAM. Eric M.