18 U.S.C. § 2703 tells the government what kind of legal paperwork it needs before a tech company has to hand over your data. The rule is tiered: a probable-cause search warrant for the content of your messages, a court order backed by specific and articulable facts for broader non-content records, and an ordinary subpoena for a short list of basic subscriber details like name, address, and payment method. The tier that applies depends on what the government wants and, in some cases, how long it has been sitting on a provider’s server.
What Kind of Data Is Being Requested
Before anything else, § 2703 sorts the request by two questions: what type of data, and what type of service holds it.
The statute distinguishes an Electronic Communication Service (ECS), which moves messages between people, from a Remote Computing Service (RCS), which provides storage or processing to the public.1Office of the Law Revision Counsel. 18 USC 2510 – Definitions2Legal Information Institute. 18 USC 2711 – Definition: Remote Computing Service Email is the classic ECS example; cloud file storage is a classic RCS. Most modern platforms are both, depending on the item requested. Courts have found that a social media company functions as an ECS when it carries a direct message between users and as an RCS when it stores photos, posts, or retained messages. One court held that Twitter fit both roles at once for that reason. The label is applied to the specific data, not the whole company.
Once the data is sorted, § 2703 divides it into three buckets: the content of communications, broader non-content records, and a narrow list of basic subscriber information. Each bucket has its own legal threshold.
Warrant Required for Content
Content means the substance of a communication: the body of an email, the text of a private message, a stored voicemail. For content held by an ECS for 180 days or less, § 2703 requires a search warrant issued on probable cause under the procedures of Federal Rule of Criminal Procedure 41.3Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records4Legal Information Institute. Federal Rules of Criminal Procedure Rule 41 A judge or magistrate reviews a law enforcement affidavit explaining why the account likely contains evidence of a crime. The warrant has to describe the specific accounts and categories of content sought.
For content that has been in storage longer than 180 days, or for content held by an RCS, the statute as written allows the government to use a warrant, a court order under § 2703(d), or even an administrative subpoena, so long as it also notifies the account holder. That rule dates from 1986, when servers were not treated as long-term homes for private correspondence.
The Sixth Circuit rejected the low-threshold reading in United States v. Warshak, holding that email users have a reasonable expectation of privacy in stored messages regardless of how long they have sat on a server, and that the government therefore needs a probable-cause warrant to compel an ISP to produce email content. The ruling formally binds only the Sixth Circuit, but the Department of Justice adopted a policy of getting warrants for all stored content, and providers generally require one. The 180-day distinction still sits in the statute, but in practice it does not save the government from having to get a warrant.
Court Order for Broader Non-Content Records
Between the content warrant and the subscriber subpoena sits a middle tier for non-content records that go beyond the short basic-subscriber list. Transaction logs, detailed usage patterns, and other account activity records fall here.
To compel these records, the government needs either a warrant or a court order under § 2703(d). To get a 2703(d) order, prosecutors must offer specific and articulable facts showing reasonable grounds to believe the records are relevant and material to an ongoing criminal investigation.3Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records That is lower than probable cause and higher than a hunch. A judge signs off, but the showing is thinner than what a warrant demands.
Subpoena for Basic Subscriber Information
At the bottom of the ladder is a narrow, closed list of records the government can obtain by administrative subpoena, grand jury subpoena, or trial subpoena, with no judge required to approve it in advance.3Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records The list covers:
- Name and address of the subscriber
- Telephone connection records or records of session times and durations
- Length and type of service, including the start date
- Subscriber number or identity, including temporarily assigned IP addresses
- Payment method, such as a credit card or bank account number on file
Anything outside that list drops back into the middle tier and requires a 2703(d) order or a warrant. These records help investigators connect an online account to a real person, but they do not reveal what anyone said.
Location Data Needs a Warrant
Historical cell-site location information (CSLI) is technically a non-content record, since your phone’s ping to a tower does not contain the substance of any conversation. Under the plain text of § 2703, a 2703(d) order would be enough to get it.
In Carpenter v. United States, the Supreme Court held that the government generally needs a warrant to obtain historical CSLI, describing the data as “an all-encompassing record of the holder’s whereabouts.”5Legal Information Institute. Carpenter v. United States The Court declined to apply the third-party doctrine because carrying a phone is not a meaningful choice to broadcast location. The ruling was narrow. It did not address real-time location tracking or tower dumps, and standard exceptions like exigent circumstances still apply. For historical CSLI, though, a 2703(d) order is no longer sufficient.
Preservation Requests Under 2703(f)
Section 2703(f) lets the government tell a provider to preserve records and evidence pending the arrival of a warrant, court order, or other formal process. The provider must retain those records for 90 days, with one 90-day extension available on a renewed request.6Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records
A preservation letter does not compel disclosure. It only stops the provider from deleting data under its usual retention schedule while investigators put together the legal process needed to actually obtain it. Some providers routinely purge older data, so this tool prevents evidence from vanishing before a warrant issues.
When You Get Notified
When the government uses a subpoena or a 2703(d) order to reach content held by an RCS, § 2703 requires prior notice to the subscriber, which gives you a chance to fight the request in court before your data leaves the provider. When the government uses a warrant, no such notice is required.3Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
Under § 2705(a), the government can ask a court to delay that notice for up to 90 days if notification would endanger someone, cause evidence destruction, prompt flight, or seriously jeopardize the investigation. Additional 90-day extensions are available if the justification still holds.7Office of the Law Revision Counsel. 18 USC 2705 – Delayed Notice
Separately, § 2705(b) allows a court to order the provider itself not to tell anyone about the warrant, subpoena, or court order. The statute does not cap the length of these non-disclosure orders. A court may impose them “for such period as the court deems appropriate,” and in practice some have lasted months or years.8Office of the Law Revision Counsel. 18 U.S. Code 2705 – Delayed Notice
Data Stored Overseas
The CLOUD Act, enacted in 2018 and codified at 18 U.S.C. § 2713, resolved a question the original statute never addressed: whether a domestic provider must produce data physically stored abroad. The answer is yes. A provider’s disclosure and preservation duties under the Stored Communications Act apply regardless of where the data sits.9Office of the Law Revision Counsel. 18 USC 2713 – Required Preservation and Disclosure of Communications and Records
A provider can move to quash or modify the process if it reasonably believes the target is not a U.S. person and does not reside in the United States, and that complying would violate the laws of a qualifying foreign government. The court then weighs comity factors including the interests of both governments, the risk of conflicting penalties, the subscriber’s nationality and location, and the importance of the information to the investigation.6Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records The Act also authorizes executive agreements letting each partner country’s law enforcement serve qualifying orders directly on providers in the other country, limited to serious criminal investigations.10U.S. Department of Justice. FAQs Regarding CLOUD Act Executive Agreements
If the Government Uses the Wrong Process
The Stored Communications Act does not contain an exclusionary rule. If the government obtains your emails through a subpoena when a warrant was required, that alone does not get the evidence thrown out at trial. The statute’s remedy is a civil lawsuit under 18 U.S.C. § 2707 for actual damages plus any profits from the violation, with a $1,000 minimum, and punitive damages available for willful or intentional violations.11Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
Suppression stays on the table only when the government’s conduct also violates the Fourth Amendment. That is a higher bar than simply using the wrong tier of § 2703 process, so a statutory violation and a constitutional one are not the same thing. Providers, for their part, have a safe harbor under § 2703(e): a provider that discloses data in good-faith reliance on a warrant, court order, subpoena, or other statutory authorization cannot be successfully sued for it.3Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records