Section 2703(d) Court Orders: Scope, Limits, and Challenges

A Section 2703(d) court order is a federal court order under the Stored Communications Act that lets law enforcement compel an electronic communications or remote computing service provider to hand over certain records about a user’s account. It sits between a subpoena and a search warrant. The government must show more than general relevance, but it does not have to meet the probable cause standard the Fourth Amendment requires for a warrant. In practice, investigators use these orders to pull subscriber identity information, account logs, IP records, and other non-content data from companies like email hosts, cell carriers, and social media platforms.

What the Government Has to Show

The statutory standard is specific and articulable facts showing reasonable grounds to believe the records sought are relevant and material to an ongoing criminal investigation.¹ Every word matters. “Specific and articulable” rules out hunches. The investigator has to explain in factual detail how the target account connects to the criminal conduct and why the requested records would advance the case.

That is a heavier lift than a subpoena, which turns on general relevance to a proceeding. It is a lighter lift than a warrant. The Supreme Court in Carpenter v. United States said the 2703(d) showing “falls well short of the probable cause required for a warrant.”²

Where the order sits on that ladder controls what data it can reach. As the burden on the government rises, so does the sensitivity of the records available.

What Records a 2703(d) Order Can Reach

Non-Content Subscriber and Transactional Records

Most 2703(d) orders target non-content records under 18 U.S.C. § 2703(c). The statute lists the categories:

Name and address of the subscriber.
Local and long distance telephone connection records, or records of session times and durations.
Length of service and the types of services the subscriber used.
Telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address.
Means and source of payment, including any credit card or bank account number.

Those categories come directly from the statute.³ Investigators also routinely use these orders to obtain IP address logs, which can place a suspect at a particular digital location during a relevant window without exposing what the person actually said.

Stored Content, With a Catch

The statute allows a 2703(d) order to reach the content of communications held by a remote computing service, but only if the government gives prior notice to the subscriber.³ To get content without notifying the target, investigators need a full search warrant based on probable cause. Most prosecutors go the warrant route when they want message contents, both to sidestep the notice question and because courts have increasingly questioned whether anything less than a warrant is constitutionally sufficient for reading private communications.

What a 2703(d) Order Cannot Reach: Cell-Site Location Data

In 2018, the Supreme Court cut a significant category out of 2703(d) practice. In Carpenter v. United States, the Court held 5-4 that the government’s acquisition of historical cell-site location information is a Fourth Amendment search and generally requires a warrant supported by probable cause.² The Court stated that a 2703(d) order “is not a permissible mechanism for accessing historical cell-site records.”

Before Carpenter, investigators routinely used 2703(d) orders to obtain historical CSLI from cell carriers. That practice ended. The Court kept the door open for case-specific exceptions like exigent circumstances, and the ruling was deliberately narrow: it addressed historical CSLI and did not decide questions about real-time location data, tower dumps, or other records that might incidentally reveal location.

How the Government Applies for One

A prosecutor or law enforcement officer prepares a written application identifying the target account with precision. The application names the provider and includes unique identifiers, such as a username, email address, phone number, or IP address. Without those identifiers, the provider cannot locate the right records.

The heart of the application is the factual narrative connecting the target account to the crime and explaining why the records are relevant and material. The statute itself does not require the application to be sworn or accompanied by an affidavit, though many courts impose that through local rules or standard practice.

Scope matters. A request covering years of data without factual justification for that duration is likely to be narrowed or refused. Applications should define start and end dates tied to the timeline of the alleged offense. Judges scrutinize breadth, and an unfocused request is the fastest way to get an application sent back.

Who Issues the Order and How It Reaches the Provider

The application goes to a federal magistrate or district judge with competent jurisdiction over the investigation. The judge reviews the factual showing, confirms it satisfies the specific-and-articulable-facts standard, and checks the scope. If everything checks out, the judge signs, and the order becomes a binding command.¹

One useful feature of the Stored Communications Act is its nationwide reach. A judge in one federal district can issue a 2703(d) order that binds a provider headquartered anywhere in the country. Delivery typically runs through dedicated law enforcement portals that major technology companies maintain for legal process, though some providers also accept service by encrypted email or fax to their legal compliance teams.

Providers who comply in good faith are protected. Under 18 U.S.C. § 2703(e), no cause of action lies against a provider or its employees for providing information in accordance with a court order, warrant, subpoena, or statutory authorization.³ That immunity is what keeps the system workable.

The Non-Disclosure Order That Often Comes With It

Along with a 2703(d) order, the government frequently seeks a non-disclosure order under 18 U.S.C. § 2705(b). This prohibits the provider from telling the subscriber that records have been requested or produced. A court will issue one if it finds reason to believe that notification would endanger a person’s life or physical safety, cause flight from prosecution, lead to destruction of or tampering with evidence, intimidate witnesses, or otherwise seriously jeopardize the investigation.⁴

The statute does not set a fixed duration. It directs the court to set the period “for such period as the court deems appropriate.”⁵ In practice courts commonly set 90 to 180 days, with extensions available. Separately, when the government delays the notice otherwise required under § 2703(b), that delay runs 90 days at a time with possible 90-day extensions. The two mechanisms are distinct and often run in parallel.

For subscribers, the practical effect is that you may never learn your records were turned over until the non-disclosure order expires and the provider chooses to notify you, or until the disclosure surfaces in court. There is no automatic statutory obligation to notify the subscriber after the gag lifts, which means some people never find out at all.

Can a 2703(d) Order Be Challenged?

Provider Motions to Quash or Modify

Section 2703(d) itself gives providers a way to push back. A provider may promptly file a motion to quash or modify the order if the records requested are unusually voluminous or if compliance would create an undue burden.³ Timeliness matters. A provider that sits on the order for weeks before objecting is likely to be denied on that basis alone.

Foreign Law Conflicts

A separate mechanism applies when producing records would conflict with foreign privacy law. Under § 2703(h)(2), a provider can move to quash or modify if it reasonably believes the subscriber is not a U.S. person, does not reside in the United States, and disclosure would create a material risk of violating the laws of a qualifying foreign government. That motion must be filed within 14 days of service.³ The court then conducts a comity analysis, weighing the importance of the information, the severity of any foreign penalties, and the subscriber’s connection to the United States.

What Subscribers Can Do

For the person whose records are being sought, direct challenge is much harder. Non-disclosure orders usually mean the subscriber has no notice the order exists, and by the time they find out, the records have already been produced. Even a subscriber who does learn about the order early faces a difficult path: courts have generally held that the SCA does not give subscribers standing to challenge orders directed at their providers. A provider can raise its own undue-burden defense, but not the subscriber’s personal Fourth Amendment rights.

Data Stored Outside the United States

The Clarifying Lawful Overseas Use of Data Act, enacted in 2018, added 18 U.S.C. § 2713 to settle whether the SCA reaches data on foreign servers. It does. A provider must comply with its SCA obligations to preserve, back up, or disclose records within its possession, custody, or control regardless of whether the data is stored inside or outside the United States.⁶

A federal 2703(d) order can therefore compel a U.S. provider to produce records held on servers overseas. The main safety valve is the § 2703(h)(2) foreign-law challenge described above. Without that kind of conflict, the physical location of the data does not change the provider’s obligation.

If a 2703(d) Order Is Misused

When someone’s stored records are accessed in violation of the SCA, federal law provides a private right of action. Under 18 U.S.C. § 2707, any subscriber or other person aggrieved by a knowing or intentional violation may sue the violator (other than the United States) for relief.⁷ Remedies include actual damages plus any profits the violator earned from the violation, with a statutory floor of $1,000. Courts can also award punitive damages for willful or intentional violations and reasonable attorney’s fees.

The same statute contains a powerful defense. Good faith reliance on a court order, warrant, grand jury subpoena, or statutory authorization is a complete defense to civil and criminal liability under the SCA.⁷ A provider that produces records in response to a facially valid 2703(d) order is effectively judgment-proof, even if the order is later found to have been improperly issued. Civil claims usually target the government actor who obtained the order through misrepresentation or a private party who accessed records without any authorization at all.

On the criminal side, unauthorized access to stored communications carries up to one year in prison for a first offense, rising to five years if the access was for commercial advantage, malicious destruction, or in furtherance of another crime.⁸ Repeat offenders face up to ten years.

1
Office of the Law Revision Counsel. 18 U.S.C. Chapter 121 – Stored Wire and Electronic Communications and Transactional Records Access
2
Legal Information Institute (Cornell Law School). Carpenter v. United States
3
Office of the Law Revision Counsel. 18 U.S.C. 2703 – Required Disclosure of Customer Communications or Records
4
Office of the Law Revision Counsel. 18 U.S.C. 2705 – Delayed Notice
5
Office of the Law Revision Counsel. 18 U.S.C. 2705 – Delayed Notice
6
Office of the Law Revision Counsel. 18 U.S.C. 2713 – Required Preservation and Disclosure of Communications and Records
7
Office of the Law Revision Counsel. 18 U.S.C. 2707 – Civil Action
8
Office of the Law Revision Counsel. 18 U.S.C. 2701 – Unlawful Access to Stored Communications