STATE v. SHARAK (2026)

¶1 Google scans its users’ content to identify child sexual abuse material (CSAM). In this case, Google flagged files in a Google Photos account, an employee opened and viewed the files, and Google reported the content to law enforcement. Officers traced the files to Andreas Rauch Sharak, and he was convicted of possession of child pornography. Now, he challenges the evidence used to convict him, arguing that Google was a government actor and violated his Fourth Amendment rights when it searched his files.

¶2 The court of appeals certified this case to us, asking us to address questions regarding: (1) whether Rauch Sharak had a reasonable expectation of privacy under Google's terms of service; (2) whether Google's search was a private or government search; and (3) whether law enforcement needed a warrant before viewing the files flagged by Google.

¶3 We focus on the second of the court of appeals’ questions and hold that Google acted as a private actor—not as an instrument or agent of the government—when it scanned Rauch Sharak's files and an employee opened and viewed files flagged as CSAM. As a result, Google's search did not implicate Rauch Sharak's Fourth Amendment rights, and neither did law enforcement's subsequent search, which repeated the private search without expanding its scope. Because Google's status as a private actor is dispositive, we do not reach the court of appeals’ question regarding a reasonable expectation of privacy. We affirm Rauch Sharak's judgment of conviction.

I. BACKGROUND

¶4 Google is an electronic service provider (ESP). The company scans its users’ content, searching for files that match a list of known CSAM and flagging such files for review. In August 2021, Google flagged four files as potential CSAM and submitted a CyberTip to the National Center for Missing & Exploited Children (NCMEC). The tip contained the four files, and Google noted that an employee had viewed each of them. The tip identified the suspect as “Andreas Rauch” and provided his location and IP address data.

¶5 NCMEC forwarded the tip to the Wisconsin Department of Justice. After subpoenaing the associated telecommunication company, the Department linked the IP address to a dwelling in Jefferson County and forwarded the tip to the Jefferson County Sheriff's Office. A detective in that office viewed the files from the tip without a warrant. He then obtained a search warrant to search Rauch Sharak's home and devices. Upon executing the warrant, law enforcement found CSAM on Rauch Sharak's phone.

¶6 Rauch Sharak was charged with 15 counts of possession of child pornography. He filed a motion to suppress, arguing that Google acted as an instrument or agent of the government and its warrantless search of the files violated his rights under the Fourth Amendment. He said that the government was involved in the search via a constellation of federal statutes surrounding CSAM reporting and liability for internet content. In response, the State argued that there was no Fourth Amendment violation either because Rauch Sharak had no reasonable expectation of privacy under Google's terms of service or because the private search doctrine applies. Under the private search doctrine, the government may repeat a search done by a private actor without implicating the Fourth Amendment, so long as the government does not exceed the scope of the private actor's search. See United States v. Jacobsen, 466 U.S. 109, 115, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984).

¶7 The circuit court denied the motion to suppress without a hearing. It concluded that there was no Fourth Amendment violation because Rauch Sharak had not met his burden to establish that Google acted as an instrument or agent of the government. In doing so, the court made a series of observations regarding the federal statutes upon which Rauch Sharak relied.¹ It also concluded that Rauch Sharak had a reasonable expectation of privacy. Rauch Sharak pled guilty and appealed the judgment of conviction.

¶8 The court of appeals certified this case to our court. It asked us to address three issues:

1. Whether a person who holds an electronic account with an ESP retains a reasonable expectation of privacy, as to the government, in files that the ESP obtains from the account, despite terms of service that provide that the ESP will scan the account for illegal content and may report such content to law enforcement.

2. Whether an ESP's scan and review of files in a person's electronic account constitute a private search or a government search under State v. Payano-Roman, 2006 WI 47, 290 Wis. 2d 380, 714 N.W.2d 548.

3. Whether a law enforcement officer is required to obtain a warrant before opening and viewing any files that the ESP sent to NCMEC, which then sent the files to law enforcement.

II. STANDARD OF REVIEW

¶9 We concentrate on the court of appeals’ second question regarding whether Google acted as an instrument or agent of the government. This presents a mixed question of fact and law. We will not overturn a circuit court's findings of fact unless clearly erroneous. Payano-Roman, 290 Wis. 2d 380, ¶16, 714 N.W.2d 548. However, “we independently determine the ultimate question of whether the search was a government search or a private search.” Id.

III. ANALYSIS

¶10 We hold that Google acted as a private actor—not as an instrument or agent of the government—when it scanned Rauch Sharak's files and an employee opened and viewed files flagged as CSAM. We first explain the applicable test, and then apply it to Google's search here. Lastly, we address how our answer to the private-actor question affects the court of appeals’ other two questions.

A. Private Actors and the Fourth Amendment

¶11 Generally, the Fourth Amendment protects citizens from unreasonable searches and seizures by the government, not private actors. U.S. Const. amend. IV; Skinner v. Ry. Lab. Execs.’ Ass'n, 489 U.S. 602, 614, 109 S.Ct. 1402, 103 L.Ed.2d 639 (1989).² However, the Fourth Amendment is implicated when a private actor acts as “an instrument or agent of the Government.” Skinner, 489 U.S. at 614, 109 S.Ct. 1402. We must determine whether Google acted as an instrument or agent of the government here.

¶12 The defendant bears the burden of proving by a preponderance of the evidence that a private actor acted as an instrument or agent of the government. Payano-Roman, 290 Wis. 2d 380, ¶23, 714 N.W.2d 548.

1. When does a private actor act as an instrument or agent of the government?

¶13 The parties debate whether we must conduct a totality of the circumstances analysis or whether Payano-Roman introduced a more formulaic analysis. We explain the relevant authorities, and then turn to the debate.

¶14 The Supreme Court has said that whether a private actor acts as an instrument or agent of government “turns on the degree of the Government's participation” and must be resolved “in light of all the circumstances.” Skinner, 489 U.S. at 614, 109 S.Ct. 1402 (quoting another source).

¶15 In Skinner, the Supreme Court considered regulations surrounding railroad-employee intoxication testing and held that railroads acted as instruments or agents of the government. Id. at 614–16, 109 S.Ct. 1402. The Federal Railroad Administration had promulgated regulations that authorized railroads to test employees for intoxication. Id. at 606, 109 S.Ct. 1402. The regulations preempted any conflicting state laws or regulations, prevented employees from refusing testing, and prohibited railroad companies from negotiating away the testing procedures. Id. at 615, 109 S.Ct. 1402. The Supreme Court said there were “clear indices of the Government's encouragement, endorsement, and participation” in the testing, and held that railroads that tested employees under these regulations were subject to the Fourth Amendment. Id. at 615–16, 109 S.Ct. 1402.

¶16 In Payano-Roman, we adopted Skinner’s totality of the circumstances test. Payano-Roman, 290 Wis. 2d 380, ¶21, 714 N.W.2d 548 (citing Skinner, 489 U.S. at 614–15, 109 S.Ct. 1402). We also said “[t]he court of appeals ․ stated three requirements that must be met for a search to be a private search”:

(1) the police may not initiate, encourage or participate in the private entity's search; (2) the private entity must engage in the activity to further its own ends or purpose; and (3) the private entity must not conduct the search for the purpose of assisting governmental efforts.

Id., ¶18 (quoting State v. Rogers, 148 Wis. 2d 243, 246, 435 N.W.2d 275 (Ct. App. 1988)). In addition, we said a search may be a government search if it is a “joint endeavor” between private and government actors. Id., ¶19.

¶17 When it came to our analysis in Payano-Roman, we looked at the totality of the circumstances. There, the defendant, upon arrest, swallowed a baggie suspected to contain heroin and was brought to the hospital. Id., ¶¶6–9. At the hospital, his medical team and law enforcement worked together to administer laxatives such that he would pass the baggie of heroin. Id., ¶¶11–12. The defendant was under arrest at the time, law enforcement was present for his whole stay at the hospital, and an officer physically helped administer the laxative. Id., ¶27. The defendant eventually passed the baggie and officers collected it as evidence. Id., ¶27. The question was whether administering the laxative was a private or government search. We held that it was a government search. Id., ¶28. We presented a list of facts and based our conclusion on a series of observations related to the considerations we listed, none of which were treated as dispositive. Id., ¶¶27–28. Taking the totality of the circumstances into account, we observed that the search was a “joint endeavor,” that law enforcement agents “participated in” the search, and that the search had a “dual purpose” with both medical and law-enforcement ends. Id., ¶28.

¶18 The parties debate whether we must consider the totality of the circumstances or whether Payano-Roman contemplates something more rigid. The State argues that courts should consider the totality of the circumstances. By contrast, Rauch Sharak argues for a more rigid formula. He says that all of Payano-Roman’s three listed considerations are required for search to be private. Any one of them could be dispositive, he argues, because the Payano-Roman court said “three requirements ․ must be met.” Id., ¶18. Likewise, he suggests the “joint endeavor” framing is a separate test for whether a search is a government search. Id., ¶19.

¶19 We agree with the State. When considering whether a search is a government or private search, we consider the totality of the circumstances. Skinner, 489 U.S. at 614, 109 S.Ct. 1402; Payano-Roman, 290 Wis. 2d 380, ¶21, 714 N.W.2d 548. The ultimate inquiry is whether the private actor acted as an instrument or agent of the government. See Skinner, 489 U.S. at 614, 109 S.Ct. 1402. We clarify that the considerations listed in Payano-Roman are not requirements. See 290 Wis. 2d 380, ¶¶18–19, 714 N.W.2d 548. Although a court may analyze those considerations—whether the police initiate, encourage, or participate in the search; the private actor's purpose; and whether the search was a joint endeavor—no one consideration is dispositive. In the end, this approach stays true to the totality of the circumstances analysis in Skinner and Payano-Roman. See Skinner, 489 U.S. at 614, 109 S.Ct. 1402; Payano-Roman, 290 Wis. 2d 380, ¶¶27–28, 714 N.W.2d 548.³

2. Did Google act as an instrument or agent of the government here?

¶20 Having established the relevant test, we turn to Google's search in this case. Considering the totality of the circumstances, we conclude that Rauch Sharak has not met his burden to show that Google acted as an instrument or agent of the government.

¶21 As an initial matter, we note that Rauch Sharak bears the burden to show that Google acted as an instrument or agent of the government, and here we have a sparse record. See Payano-Roman, 290 Wis. 2d 380, ¶23, 714 N.W.2d 548 (laying out the burden). There was no suppression hearing in this case. Instead, the circuit court said the facts were not in dispute and adopted facts from the State's suppression-motion response. Rauch Sharak has not challenged any of the circuit court's actions or findings in this regard. Considering the record in front of us, we determine Rauch Sharak has failed to meet his burden.

¶22 The undisputed facts suggest that Google did not act as an instrument or agent of the government. To begin, the government was not involved in Google's search. Google scanned Rauch Sharak's files on its own. An employee opened and viewed the files without law enforcement participation. The government became involved only after Google created the CyberTip. Compare the facts here with Payano-Roman, for instance, where the defendant was in custody, police officers sat in his hospital room during the search, and an officer physically administered the laxative to get access to the swallowed evidence. See 290 Wis. 2d 380, ¶27, 714 N.W.2d 548; see also United States v. Booker, 728 F.3d 535, 540–41 (6th Cir. 2013) (emergency room doctor is a government agent for Fourth Amendment purposes where the defendant was in police custody, police brought the defendant to the hospital to have contraband removed from his rectum, and the police knew that the doctor would do a procedure to remove it). In short, the government became involved only after Google scanned, opened, and viewed Rauch Sharak's files. That lack of government involvement suggests Google was not acting as an instrument or agent of the government.

¶23 Moreover, Google had a business reason to complete this search. By searching for and removing CSAM from its platform, Google helps ensure that its users have a good experience using its products. See United States v. Ringland, 966 F.3d 731, 736 (8th Cir. 2020) (“Google acted out of its own obvious interests in removing child sex abuse from its platform.”); United States v. Miller, 982 F.3d 412, 425 (6th Cir. 2020) (“Google ․ sought to rid its virtual spaces of criminal activity ․ to protect [its] business[ ].”). The record reflects as much: Google's terms of service state that users must “comply with applicable laws” to “maintain a respectful environment for everyone,” and Google's abuse policies say that it checks for abuse on its site to “maintain a positive experience for everyone that uses Google products.” The fact that Google had a business purpose independent of any desire to help law enforcement suggests that Google was not acting as an instrument or agent of the government.

¶24 Rauch Sharak's arguments do not convince us otherwise. First, he argues that Google is a government agent because NCMEC participated in the search.⁴ He highlights the circuit court's conclusion that NCMEC provided a list of known CSAM to Google and therefore participated in the search. We reject his assertion that providing a list of known CSAM amounts to involvement in a search—providing a tool to identify contraband is too attenuated to constitute participation in a search. Moreover, it appears that Google may be able to scan user content for CSAM without NCMEC's list, contrary to Rauch Sharak's argument. See Miller, 982 F.3d at 426 (determining that “Google did not even scan for any NCMEC-provided hash values” during the time when it flagged a user's files as CSAM). In the end, NCMEC was not involved in Google's scan of Rauch Sharak's content or the viewing of his files, which, again, Google did independently.

¶25 Rauch Sharak also argues that Google acted as an agent of the government because the federal government enacted and enforces various federal statutes related to ESPs and CSAM. Specifically, he points to 18 U.S.C. § 2258A, 47 U.S.C. § 230, and the criminal and civil statutes referenced in 47 U.S.C. § 230(e)(5). He says these statutes encourage Google to scan for CSAM and provide a law-enforcement reason for Google's search.

¶26 We first look at 18 U.S.C. § 2258A, which regulates CSAM reporting. That section creates a duty for ESPs to submit a CyberTip if they discover potential CSAM-related federal law violations. See § 2258A(a)(1), (2). The ESPs are required to submit CyberTips to NCMEC, which must forward the tips to law enforcement. See § 2258A(a), (c). Importantly, though, the statute contains a disclaimer that “[n]othing in this section shall be construed to require a provider to ․ affirmatively search, screen, or scan for” CSAM. § 2258A(f)(3).

¶27 The disclaimer in 18 U.S.C. § 2258A(f)(3) blunts any argument that 18 U.S.C. § 2258A turns ESPs into instruments or agents of the government. Indeed, § 2258A(f)(3) says searches are not required. Many federal courts have relied on that disclaimer in determining that 18 U.S.C. § 2258A does not turn ESPs into government agents. See United States v. Rosenschein, 136 F.4th 1247, 1256 (10th Cir. 2025); United States v. Sykes, 65 F.4th 867, 877 (6th Cir. 2023); United States v. Rosenow, 50 F.4th 715, 730 (9th Cir. 2022); United States v. Meals, 21 F.4th 903, 907 (5th Cir. 2021); Ringland, 966 F.3d at 736.

¶28 We turn to the other statutes that Rauch Sharak cites—47 U.S.C. § 230 and the statutes referenced in § 230(e)(5). Section 230 governs liability for online content and for ESPs who screen or block user content. See § 230(c). It says that “[n]o provider ․ shall be held liable on account of ․ any action voluntarily taken in good faith to restrict access to or availability of material that the provider ․ considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.” § 230(c)(2)(A). Paragraph 230(e)(5) provides that “[n]othing in this section (other than subsection (c)(2)(A)) shall be construed to impair or limit” enforcement of certain sex-trafficking-related civil and criminal violations. For instance, § 230(e)(5)(B) says that § 230 does not limit state-law prosecutions for conduct that would violate the federal child sex-trafficking provisions in 18 U.S.C. § 1591.

¶29 Rauch Sharak argues that this scheme encourages ESPs to scan for CSAM by granting immunity to ESPs that moderate content and creating civil and criminal liability if ESPs do not scan for CSAM.⁵ While we acknowledge that the statutes Rauch Sharak identifies may encourage ESPs to search for CSAM, we do not think he has shown that the statutes turn Google into an instrument or agent of the government under the totality of the circumstances. Though § 230(c) may grant immunity to ESPs that choose to scan for CSAM, it does not require, reward, or incentivize scanning for CSAM in the first place. See Children's Health Def. v. Meta Platforms, Inc., 112 F.4th 742, 762 (9th Cir. 2024) (saying that § 230(c) “is fundamentally unlike the regulations in Skinner” because it is “entirely passive”), cert. denied, ––– U.S. ––––, 145 S. Ct. 2846, 222 L.Ed.2d 1130 (2025). Moreover, § 230(c)(2)(A) grants immunity for “any action voluntarily taken in good faith to restrict access to” obscene material, which sweeps far more broadly than would be required to induce Google's CSAM scan at issue here.

¶30 Likewise, § 230(e)(5) does not turn Google into an instrument or agent of the government. Rauch Sharak claims that ESPs risk criminal liability for failing to remove CSAM from their platforms, but does not develop an argument for why that is so, even in light of evidence otherwise. See Does 1-6 v. Reddit, Inc., 51 F.4th 1137, 1145 (9th Cir. 2022) (holding that § 230(e)(5)(A) “requires that a defendant-website violate the criminal statute by directly sex trafficking or, with actual knowledge, ‘assisting, supporting, or facilitating’ trafficking, for the immunity exception to apply”). Rauch Sharak's assertion about sex-trafficking liability is not enough to show that the government was involved in Google's scan for CSAM here. In the end, these statutes are unlike the regulations in Skinner which required that employees comply with intoxication testing or lose their jobs and prevented employers from negotiating away the testing requirements. See 489 U.S. at 615, 109 S.Ct. 1402. Even if the statutes encourage Google to scan for CSAM or provide a law-enforcement purpose, Rauch Sharak has not shown that they are enough to turn Google into an instrument or agent of the government.

¶31 We note that our decision here puts us in good company. Seemingly without exception, federal circuit courts and other state supreme courts have held that ESPs like Google are private actors when searching for CSAM on their platforms. See, e.g., United States v. Bebris, 4 F.4th 551, 560–62 (7th Cir. 2021); Rosenow, 50 F.4th at 728–35; Miller, 982 F.3d at 425–26; United States v. Richardson, 607 F.3d 357, 364–67 (4th Cir. 2010); State v. Pauli, 979 N.W.2d 39, 51–52 (Minn. 2022); State v. Lizotte, 208 Vt. 240, 197 A.3d 362, ¶¶22–23 (2018).

¶32 In sum, we must consider the totality of the circumstances to determine whether “the degree of the Government's participation” in the search made Google an “instrument or agent” of the government. See Skinner, 489 U.S. at 614, 109 S.Ct. 1402. Rauch Sharak has not met his burden to show that Google acted as an instrument or agent of the government here. Google scanned and viewed Rauch Sharak's files on its own. It had a business reason to do so. Law enforcement became involved only after Google submitted a CyberTip. And even though federal statutes may encourage these searches, they are not enough to make Google an instrument or agent of the government, especially considering the disclaimer in 18 U.S.C. § 2258A(f)(3).

B. Warrant Requirement and Expectation of Privacy

¶33 Having answered the court of appeals’ question regarding private action, we briefly address the other two questions.

¶34 The court of appeals asked whether “a law enforcement officer is required to obtain a warrant before opening and viewing any files that [an] ESP sent to NCMEC.” We answer that question based on the record and arguments in front of us. In this case, we determine that law enforcement did not need a warrant before opening and viewing the files in the CyberTip because law enforcement's search falls under the private search doctrine. Under that doctrine, the government does not conduct a “search” under the Fourth Amendment when it repeats a search by a private actor and stays within the scope of the private search. See Jacobsen, 466 U.S. at 115–16, 104 S.Ct. 1652. Here, an employee at Google viewed the images before law enforcement did, and Rauch Sharak concedes that law enforcement's search falls within the scope of Google's search. Thus, there was no “search” under the Fourth Amendment, and law enforcement did not need a warrant before viewing the files in the CyberTip.⁶

¶35 The court of appeals also asked whether users like Rauch Sharak have a reasonable expectation of privacy in their online accounts where terms of service say that an account will be scanned for illegal content. Because we determine that no Fourth Amendment violation occurred here, we need not consider whether Rauch Sharak had a reasonable expectation of privacy as to the government's search.

IV. CONCLUSION

¶36 Google acted as a private actor—not as an instrument or agent of the government—when it scanned Rauch Sharak's files and an employee opened and viewed files flagged as CSAM. Thus, Google's search did not implicate Rauch Sharak's Fourth Amendment rights, and neither did law enforcement's subsequent search, which repeated the private search without expanding its scope. We affirm Rauch Sharak's judgment of conviction.

By the Court.—The judgment of the circuit court is affirmed.

FOOTNOTES

1.   The circuit court interpreted some of the federal statutes at issue—47 U.S.C. § 230 and 18 U.S.C. § 1591—saying that the statutes:(1) [were] developed in response to congressional dissatisfaction with ESPs not being willing sufficiently in the [opinion] of Congress to engage in any form of content moderation and especially not willing to do so through affirmative efforts, perhaps, as articulated by Congress, out of fear of liability; (2) were intended to specifically shield ESPs from liability if they choose to engage in moderating activities; (3) specifically defined the type of content that was being targeted—“materials that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing or otherwise objectionable;” (4) specifically shielded ESPs from liability for targeting this type of content “whether or not such material is constitutionally protected;” (5) limited the scope of § 230 immunity for ESPs that published content promoting or facilitating prostitution and sex trafficking creating liability for ESPs that do not affirmatively search out and remove such content; (6) expanded the definition of human trafficking under the Trafficking Victims’ Protection Act (“TVPA”) to more explicitly cover ESPs that “benefit from participation in a venture which has engaged in sex trafficking;” and (7) were introduced explicitly to remove what lawmakers believed to be federal impediments on local law enforcement actions against ESPs.

2.   Rauch Sharak mentions the analogous provision of the Wisconsin Constitution—Wis. Const. Art. I, § 11—but does not develop any independent argument under that provision. Thus, we treat this as a federal Fourth Amendment claim. See Serv. Emps. Int'l Union, Loc. 1 v. Vos, 2020 WI 67, ¶24, 393 Wis. 2d 38, 946 N.W.2d 35 (“We do not step out of our neutral role to develop or construct arguments for parties ․”), overruled on other grounds by, Evers v. Marklein, 2025 WI 36, 417 Wis. 2d 453, 22 N.W.3d 789.

3.   Because we determine that none of Payano-Roman’s considerations are dispositive, we reject Rauch Sharak's argument that the circuit court was required to determine that Google acted as an instrument or agent of the government when the circuit court found one of Payano-Roman’s considerations was not met.

4.   Rauch Sharak argues that NCMEC is a government actor. Because we determine NCMEC did not participate in Google's search here, we need not resolve whether NCMEC is a government actor.

5.   Rauch Sharak relies on a series of conclusions by the circuit court regarding the purpose and effect of these statutes. See supra, note 1. Though he frames the circuit court's conclusions as findings of fact, they are interpretations of statutory text, legislative history, and statutory history. Such statutory interpretation is “a quintessential question of law” which we review independently. See Serv. Emps. Int'l Union Healthcare Wis. v. WERC, 2025 WI 29, ¶5, 416 Wis. 2d 688, 22 N.W.3d 876. So, we do not adopt the circuit court's conclusions.

6.   In a sister case to this one, we take up the question of whether law enforcement exceeds the scope of a private search when an officer, upon receiving a CyberTip, opens and views files that an ESP virtually scanned but did not open and view. See State v. Gasper, 2026 WI 3, 419 Wis. 2d 12, 30 N.W.3d 367.

Janet C. Protasiewicz, J.