Seventh Circuit (2026) affirms a finding that accepting Dropbox's terms was consent to the scan that led to a criminal case; a Supreme Court petition is pending

On 5 May 2026 the U.S. Court of Appeals for the Seventh Circuit decided No. 25-1536 (171 F.4th 587), an appeal in a federal criminal case that began with a Dropbox report to the National Center for Missing and Exploited Children (NCMEC). This archive does not name the defendant or describe the charges. The opinion dates Dropbox's report to NCMEC to 2018. It records that access to Dropbox is contingent on agreement to its terms of service, and that one term allows Dropbox to examine users' data to ensure that it is not being used for illegal purposes. The defendant argued that Dropbox's search of his files was attributable to the government and so needed probable cause or a warrant. The district court did not rule on that ground. It ruled instead that the defendant had consented to the search by assenting to Dropbox's terms. The Seventh Circuit reviewed that finding deferentially: it held that the finding of consent "cannot be set aside as clearly erroneous", and affirmed the denial of the motion to suppress. The decision is therefore an affirmance of one consent finding, for one defendant, under the terms as the opinion describes them.

The core of the reasoning is about the wording of the contract. The court wrote: "The language of this contract unambiguously permits Dropbox to scan all files at its option", and described the contract as allowing Dropbox to "reveal the contents for five specified purposes". It acknowledged "that few people pore over consumer contracts or try to grasp how they might work in practice", but said that "the fact that a contract is lengthy and poorly understood does not justify reading it with a thumb on the scale". On the point that the terms say Dropbox may examine files rather than that it will, the court wrote: "A consent granting an option to search remains a consent." It also wrote: "The record of this case does not show the probability that any given file on Dropbox will be inspected, or how often." The court's statement is about what this contract permits. It is not a finding about how many files Dropbox actually inspects, and the opinion gives no such figure.

What the court left open is whether Dropbox acted as a government agent. The defendant argued that NCMEC is part of the government and that Dropbox's searches were therefore attributable to the United States. The court assumed, without deciding, that NCMEC counts as part of the government, but wrote: "It is far from clear to us that an entity’s practice of sending information to a governmental body makes that entity the equivalent of the government itself." It noted that federal law requires providers to report known material to NCMEC but, as the opinion puts it, does not require any service to monitor its customers' data (it cites 18 U.S.C. §2258A(f)). It then wrote that "Potentially it matters why Dropbox looked through its users’ files": whether to carry out a governmental programme imposing duties on Dropbox, or to implement a policy Dropbox formulated on its own. The opinion reports that, in response to a discovery motion, Dropbox explained that it "has a private business interest in enforcing" its prohibition on the content at issue and "keeping its platform safe for account holders and others by voluntarily searching for and removing this content." The court said that this "private motive makes the search look private", but also that it was not the ground on which the district court had decided the motion. The consent ruling carried the decision, so the agent question was not resolved.

The opinion describes a split among the courts of appeals. Of the defendant's request that Dropbox's terms be held not clear enough to consent to a search in which a public body such as NCMEC has an interest, it says: "Three courts of appeals appear to have adopted that approach." It cites decisions of the Fourth Circuit (2026), the Second Circuit (2024) and the Sixth Circuit (2010), and names none of them here. The Seventh Circuit said those decisions conclude that language similar to Dropbox's is "insufficient because it says that a service may examine and disclose the contents of their files, rather than that they will do so", and that it did "not see why this should matter". Saying it was not inclined to reconsider its own earlier precedent, it also wrote that "A conflict among the circuits would persist no matter what we did."

The defendant has sought Supreme Court review. The Court's docket for No. 26-460, docketed 7 October 2026, with the Seventh Circuit (No. 25-1536) as the lower court and the United States as respondent, shows: on 27 July 2026 an application (26A128) was granted extending the time to file a petition for a writ of certiorari to 2 October 2026; on 2 October 2026 the petition was filed, with a response due 6 November 2026; and on 2 November 2026 a motion to extend the time to file a response was granted, extending it to and including 7 December 2026. The docket as captured on 4 November 2026 shows no response filed and no order on the petition. This archive makes no prediction about whether the Court will take the case.

Why it matters for ordinary users. Dropbox's Terms of Service, as captured by this archive (effective 7 January 2025), say: "To provide these and other features, Dropbox accesses, stores, and scans Your Stuff." The Seventh Circuit decision is not about that sentence. It concerns one defendant's acceptance of Dropbox's terms as the opinion describes them, in a case dating from 2018, and a deferential review of one finding of consent. In the court's words, what matters is "a clear grant of permission to inspect". The court also wrote, by analogy to a driver who tells a police officer the trunk may be opened, that consent of this kind "does not extinguish all privacy in that space". Three limits apply. This archive has not compared the terms the court considered with the current Terms. The opinion does not say how often Dropbox scans any file. And the opinion itself describes other circuits as having taken a different approach. See also csam-hash-matching-content-scanning-surveillance-vector for what Dropbox publishes about its detection and reporting, and the answer at /questions/does-dropbox-scan-my-files.

This entry records a legal development. It does not suggest that Dropbox acted contrary to its Terms, or that any Dropbox report to NCMEC was wrong.