Tom Goldstein posted an interesting comment last night in response to my earlier discussion of third-party consent in Fourth Amendment law, and I wanted to both highlight the comment and respond to it. Here is the main part of Tom's comment, with paragraph breaks added for clarity:

  Having argued Randolph today, I thought it would be worth mentioning why I think that the dichotomy [Orin] draws between reasonable expectations of privacy and the reasonableness of the search is doesn't quite hold in the context of third-party consent, even if it holds elsewhere.
  For example, Orin is quite right that even if you have an "expectation of privacy," a search pursuant to a warrant will be "reasonable." Consent, however, is different - the theory of consent searches is that the individual "voluntarily relinquishes" or even "waives" his privacy interests (though it isn't subject to the "knowing waiver" requirement applicable to trial rights), which is very close to saying that he has no "expectation of privacy." A principle rationale of these third-party cases from Frazier to Matlock to Rodriguez, in particular, is that the search is "reasonable" because the defendant has "assumed the risk" that his co-tenant would admit the police. That "assumption of the risk" rationale, if not a perfect parallel to "expectations of privacy," is its near-twin.
  If Scott Randolph had the "expectation" of privacy that his objection would be honored it is hard to say that he "assumed the risk," or at least assumed a reasonable risk. . . .

  I don't think that's right, and I wanted to explain why. As I see it, suspect consent and third-party consent are very different animals. In the case of suspect consent, the individual voluntarily gives up his privacy rights. In such cases, valid consent and waiver of a "reasonable expectation of privacy" do indeed blend together. But third-party consent cases are very different. In these cases, the defendant necessarily has a reasonable expectation of privacy in the place to be searched. The defendant isn't waiving or voluntarily relinquishing his privacy rights; he often won't even know that the search is occurring.

  The closest cousin of third-party consent in Fourth Amendment law isn't defendant consent, but rather the private search doctrine. The Fourth Amendment does not regulate private party searches at all; if a burglar breaks into your house, searches your stuff, and sends the police what he finds, it can't violate the Fourth Amendment. Third-party consent doctrine offers a modified version of this rule: it allows third parties to let the police in wherever they have "common authority." The thinking is that the third party who consents to the search is a private party who could conduct a private search himself. So long as the search is limited to the realm of the third party's common authority, the thinking goes, consent by private third parties simply recognizes that private parties have shared rights to control private spaces.

  What's the role of "assumption of the risk" analysis in this inquiry? Nothing direct, I think. "Assumption of the risk" articulates a result, not a rationale. It has no independent meaning. A defendant "assumes the risk" whenever he has no rights to object to a government search; if he has a right to object, then he has not assumed the risk. The question is always why a person must assume the risk, which in turn has to be based on some principle of when a third party can validly consent to a government search. (Some scholars have written of an "assumption of the risk doctrine" in Fourth Amendment law, but I tend to think that this is a rather unsympathetic characterization of a series of cases that most law professors consider insufficiently privacy-protective.)

  One related issue that might shed some light on these topics is understanding when a person has a reasonable expectation of privacy in their shared spaces. The basic rule is that sharing a space with someone does not in any way relinquish a reasonable expectation of privacy there. So long as that space is not open to the world, a person retains full privacy rights in their shared spaces. See, e.g., Mancusi v. DeForte, 392 U.S. 364, 369-70 (1968) (Harlan, J.) (holding that a defendant has a reasonable expectation of privacy in shared workspace).** A "reasonable expectation of privacy" is eliminated in the space only when the space is open to the world. See Maryland v. Macon, 472 U.S. 463, 469 (1985)(O'Connor, J.) (holding that an officer's entry into public areas of a store does not violate a reasonable expectation of privacy). As a result, a defendant will always have a reasonable expectation of privacy in third-party consent cases. The proper issue is when third-party consent makes a search reasonable, not whether the defendant has a "reasonable expectation of privacy" in the space searched.

  ** Privacy in government workplaces presents a very different picture; as explained in detail here, the Court has created a special REP test for government employee space, and no third-party consent doctrine applies there.

  UPDATE: Tom Goldstein and I each have additional thoughts in the comment thread.