On June 22, the Supreme Court issued its decision in Los Angeles v. Patel, striking down a Los Angeles city ordinance that allowed law enforcement to inspect hotel guest registers on demand as facially unconstitutional.  Writing for a 5-4 majority, Justice Sotomayor held that the ordinance violated the Fourth Amendment by failing to provide for any form of review of search requests before hotels were forced to comply with law enforcement demands.  According to the Court, this failure was fatal to the City of Los Angeles’ argument that the ordinance satisfies the requirements for the administrative search exception to the Fourth Amendment’s warrant requirement.

The ordinance, Lost Angeles Municipal Code Section 41.49, required hotel operators to maintain records containing specified information about each hotel guest.  Operators were required to make this information available to any officer of the Los Angeles Police Department for inspection on demand, and faced arrest and jail time for failure to comply.  A group of hotel owners brought a facial constitutional challenge to the statute under the Fourth Amendment.  After the district court ruled in favor of the city and the Ninth Circuit affirmed, holding that the hotels lacked a reasonable expectation of privacy in the records, the Ninth Circuit reversed after rehearing the case en banc.  The Ninth Circuit’s en banc decision found not only that the records constituted the hotel’s “private property,” but that the ordinance violated the Fourth Amendment by failing to provide for an opportunity to obtain review of the search demand prior to punishment for a refusal to comply.

The Supreme Court affirmed the Ninth Circuit’s holding, finding that the ordinance failed to meet the requirements for the administrative exception to the search warrant.  First, the Court held that facial challenges are permitted under the Fourth Amendment, although Justice Sotomayor cautioned that such challenges are “unlikely to succeed where there is substantial ambiguity as to what conduct a statute authorizes.”  Turning to the merits of the claim, the Court held that the ordinance did not satisfy the requirements for the administrative search exception to the Fourth Amendment’s warrant requirement.  According to the Court, unless consent or exigent circumstances exist, the administrative search exception only applies if the subject of the search is provided with “an opportunity to obtain pre-compliance review before a neutral decisionmaker.”  Justice Sotomayor emphasized that the Court’s decision only requires “an opportunity” for pre-compliance review, such as that provided by an administrative subpoena, and a review would not need to occur if the hotel operator voluntarily complied.  An officer would also have the power to seize the registry, pending the outcome of a challenge to the search, if the officer reasonably suspects that the hotel operator may tamper with the registry.

Justice Scalia, joined in his dissent by Justice Thomas and Chief Justice Roberts, argued that the ordinance was facially constitutional due to the hotel industry’s status as a “closely regulated business.”  Justice Sotomayor’s majority opinion disagreed, noting that the Court’s jurisprudence has only identified a limited number of closely regulated industries, of which hotels are not one.  In addition, the Court noted that the warrantless inspections were not necessary to the statutory scheme and the inspection program did not include adequate safeguards regarding the frequency and consistency of its application.

While the Court’s decision may be of limited impact in circumstances involving exigent circumstances or other exceptions to the warrant requirement, such as within the national security context, the decision does establish that more ordinary administrative searches must provide some form of pre-compliance review.  The Court does allow for relatively simple methods of compliance, such as an administrative subpoena, which can be issued without a showing of probable cause.  However, the Court’s holding will establish some safeguards, however limited, for businesses and individuals to obtain review of certain government requests for information.

Photo of Caleb Skeath Caleb Skeath

Caleb Skeath helps companies manage their most complex and high‑stakes cybersecurity and data security challenges, combining deep regulatory insight, technical fluency, and practical judgment informed by leading incident response matters.

Caleb Skeath advises in‑house legal and security teams on the full lifecycle of…

Caleb Skeath helps companies manage their most complex and high‑stakes cybersecurity and data security challenges, combining deep regulatory insight, technical fluency, and practical judgment informed by leading incident response matters.

Caleb Skeath advises in‑house legal and security teams on the full lifecycle of cybersecurity and privacy risk—from governance and preparedness through incident response, regulatory engagement, and follow‑on litigation. A Certified Information Systems Security Professional (CISSP), he is trusted by clients across highly regulated and technology‑driven sectors to provide clear, practical guidance at moments when legal judgment, technical understanding, and business realities must be aligned.

Caleb has deep experience leading and overseeing responses to complex cybersecurity incidents, including ransomware, data theft and extortion, business email compromise, advanced persistent threats and state-sponsored threat actors, insider threats, and inadvertent data loss. He regularly helps in‑house counsel structure and manage investigations under attorney‑client privilege; coordinate with internal IT, information security, and executive stakeholders; and engage with forensic firms, crisis communications providers, insurers, and law enforcement. A central focus of his practice is advising on notification obligations and strategy, including the application of U.S. federal and state data breach notification laws and requirements along with contractual notification obligations, and helping companies make defensible, risk‑informed decisions about timing, scope, and messaging.

In addition to his work responding to cybersecurity incidents, Caleb works closely with clients’ legal, technical, and compliance teams on cybersecurity governance, regulatory compliance, and pre‑incident planning. He has extensive experience drafting and reviewing cybersecurity policies, incident response plans, and vendor contract provisions; supervising cybersecurity assessments under privilege; and advising on training and tabletop exercises designed to prepare organizations for real‑world incidents. His work frequently involves translating evolving regulatory expectations into actionable guidance for in‑house counsel, including in highly-regulated sectors such as the financial sector (including compliance with NYDFS cybersecurity regulations, the Computer Security Incident Notification Rule, and GLBA guidelines and guidance) and the pharmaceutical and healthcare sector (including compliance with GxP standards, FDA medical device guidance, and HIPAA).

Caleb’s practice also addresses evolving and emerging areas of cybersecurity and data security law, including advising clients on compliance with the Department of Justice’s Data Security Program, CISA‑related security requirements for restricted transactions, and preparation for new regulatory regimes such as the CCPA cybersecurity audit requirements and federal incident reporting obligations. He regularly counsels clients on how artificial intelligence and connected devices intersect with cybersecurity, privacy, and consumer protection risk, and how to support innovation while managing regulatory exposure.

Caleb also has extensive experience helping clients navigate high-stakes cybersecurity-related inquiries from the Federal Trade Commission, state Attorneys General, and other sector-specific regulators, including incident-specific inquiries as well as broader inquiries related to an entity’s cybersecurity practices and the security of product or service offerings. For companies that have entered into cybersecurity-related settlement agreements with regulators, Caleb has helped guide them through compliance with settlement agreement obligations, including navigating required third-party assessments and strategically responding to cybersecurity incidents that can arise while a company is subject to a settlement agreement. Caleb also routinely works hand-in-hand with colleagues in Covington’s class action litigation, commercial litigation, and insurance recovery practices to prepare for and successfully navigate incident-related disputes that can devolve into litigation.