Important to Know: Law Enforcement Can Use Biometric Data to Unlock Smartphones

How secure is your smartphone data if you use biometrics, such as a fingerprint or face recognition, to access your smartphone?

The Fifth Amendment provides that “[n]o person . . . shall be compelled in any criminal case to be a witness against himself.  The privilege against self-incrimination extends not only to answers that would in themselves support a conviction under a federal criminal statute but likewise embraces those which would furnish a link in the chain of evidence needed to prosecute an individual for a crime.  To assert the privilege against self-incrimination, a witness must show that information is: (1) compelled; (2) incriminating; and (3) testimonial.  A statement is considered “testimonial” when an accused’s “communication must itself, explicitly or implicitly, relate a factual assertion or disclose information.”  Determining whether an act is “testimonial”  has been the subject of debate, resulting in splits among the different Circuit Courts.   Whether the act is testimonial in nature turns on whether the individual  is “us[ing] the contents of his own mind” or making a “cognitive assertion” to communicate something factual versus a compelled physical act, which requires no such cognitive assertion.  

Examples of compelled physical acts that are not afforded Fifth Amendment protections include submitting to fingerprinting, having blood drawn, and standing in a lineup.  Producing documents in response to a government-issued subpoena is a common example of a testimonial act that is afforded Fifth Amendment protections.

Given the prevalent use of smartphones today, personal and detailed information contained therein is often a key source of evidence used by the government to bring criminal charges and secure convictions.   Accordingly, what Fifth Amendment protections, if any, do individuals have against government intrusion into their devices?  

This issue arose recently in 2024 in United States v. Payne, 99 F. 4th 495 (9th Cir. 2024), a Ninth Circuit case involving a traffic stop where police officers forcibly grabbed a defendant’s thumb to use his thumbprint to unlock his smartphone.  In Payne, the Ninth Circuit found no Fifth Amendment protection from the forcibly compelled use of the defendant’s thumb, reasoning that there was no “act of production” by the defendant, because the police did not instruct the defendant to unlock his phone, but rather, they grabbed his finger and used it to unlock the phone.  Second, the Ninth Circuit cautioned that its opinion “should not be read to extend to all instances where a biometric is used to unlock an electronic device.”  Id. at 513 (emphasis in original).  Indeed, “the outcome on the testimonial prong may have been different had [the police] required Payne to independently select the finger that he placed on the phone.”  Id.  Thus, the Ninth Circuit found the forcibly compelled use of the defendant’s fingerprint required no cognitive exertion and was more like compelled physical acts like submitting to fingerprinting or having blood drawn, which are not afforded Fifth Amendment protections.

Interestingly, in 2025, a similar case appeared in the D.C. Circuit in United States v. Brown, 125 F.4th 1186 (D.C. Cir. 2025), where the Court held that the police violated the defendant’s Fifth Amendment right against self-incrimination by compelling the defendant to unlock his smartphone using his fingerprint.  The D.C. Circuit reasoned that its holding was consistent with Payne because the police here asked the defendant to unlock his smartphone, which required the defendant to use the contents of his mind to select the correct finger that would unlock his smartphone, whereas in Payne, the police made no such request.  This seems like a difference without a distinction, since the police in Brown could have forcibly compelled the defendant to try all fingerprints, like in Payne, to unlock the device if the defendant had refused to comply.  

Also, in both Payne and Brown, the defendants asserted Fourth Amendment violations, which protect against unreasonable searches and seizures by the government.  However, the appellate court in both cases rejected the Fourth Amendment arguments without difficulty. In Payne, the defendant was on parole in California and subject to California’s standard search conditions that covered his electronic devices and, therefore, the defendant had waived his Fourth Amendment rights.  In Brown, the D.C. Circuit declined to reach the Fourth Amendment question, but it is notable that the government had a search warrant that allowed for the “the compelled display” of thumbprints or other “physical biometric characteristics” to unlock his phone.  

In the Ninth Circuit, Payne made clear that individuals have no Fifth Amendment rights to protect against the government’s forcible compulsion to access smartphones using biometric data, such as a thumbprint or face scan.  Indeed, Payne suggests that law enforcement may obtain access to smartphones using biometric data even where the individual initially refuses to provide a fingerprint or face scan. 

If a smartphone’s biometric data is not enabled, law enforcement cannot access a smartphone through these “non-testimonial” means as described in Payne and Brown, presenting a significant barrier to law enforcement.  Of course, the government, subject to compliance with the Fourth Amendment, still could seize a smartphone and then attempt to access the data through other means, such as by overriding a password.  However, whether the government could override a password or address other security measures on a smartphone is not a foregone conclusion versus grabbing an individual’s finger and placing it on the phone to unlock a smartphone.