What Is a 2703(d) Order Under the Stored Communications Act?

A 2703(d) order is a court order under the Stored Communications Act that requires an internet, email, phone, or cloud provider to hand over certain records about a subscriber’s account and activity. To get one, prosecutors must show a judge “specific and articulable facts” that the records are relevant and material to an ongoing criminal investigation. That standard sits below the probable cause required for a search warrant but above what a grand jury subpoena demands.¹ The authority comes from 18 U.S.C. § 2703(d), part of the Electronic Communications Privacy Act of 1986.²

The Standard the Government Must Meet

The government does not have to show that a crime has been committed or that evidence of a crime will be found in the records. It files an application with a court of competent jurisdiction laying out specific facts that give reasonable grounds to believe the requested data is relevant and material to an active criminal investigation.³ The judge looks for a logical connection between the data and the suspected conduct. Notice to the target is not required before the order issues, and most targets never find out at all.

One boundary matters here. A 2703(d) order is only available in criminal investigations. Private parties in a civil dispute cannot use it to obtain a competitor’s account records or email metadata; they have to use ordinary civil discovery.¹

What Records the Order Reaches

A 2703(d) order reaches non-content records. Investigators can see the envelope, not the letter inside. The statute lists the categories a provider must disclose:¹

Subscriber name, address, and phone number
Session times and durations, and local or long-distance telephone records
Length and start date of service, and types of services used
IP addresses and temporarily assigned network addresses
Means and source of payment, including credit card and bank account numbers

With those records, an investigator can see who a person emailed and when, or which IP address logged into an account at 2:00 a.m. They cannot see what the email said or which files were opened. Reading the body of an email, the text of a message, or a file stored in a cloud drive takes a warrant supported by probable cause.¹

Location Data Now Requires a Warrant

For years, the government used 2703(d) orders to obtain historical cell-site location information, the records showing which cell towers a phone connected to over days or weeks. In 2018, the Supreme Court held in Carpenter v. United States that the government generally needs a warrant supported by probable cause to obtain that data. The Court found that cell-site records create a detailed record of a person’s movements and that users have a reasonable expectation of privacy in that record, even though the data is held by a phone carrier.⁴

Carpenter did not eliminate 2703(d) orders. It carved out historical location data and left the lower standard intact for subscriber records, IP logs, session times, and other non-location metadata. The Court also acknowledged that exceptions like exigent circumstances could still support a warrantless request for location records. But for a routine investigation seeking historical CSLI, law enforcement must now use a warrant, not a 2703(d) order. Confusing the two standards can lead to suppression of evidence.

Which Companies Have to Comply

The Stored Communications Act reaches two kinds of businesses: providers of electronic communication services and providers of remote computing services. The first category covers services that let users send or receive electronic communications, such as email providers, phone carriers, and messaging platforms. The second covers public providers of computer storage or processing, such as cloud storage and web hosting companies.⁵

Together those categories sweep in nearly every commercial entity that handles user data, from major internet service providers down to niche hosting companies. A provider that complies with a valid court order, warrant, or subpoena is shielded from civil liability, so a customer cannot sue the provider for turning over records under a lawful order.¹

Whether You Find Out Your Records Were Pulled

Under 18 U.S.C. § 2705, the government can ask the court to delay notifying the subscriber for up to 90 days.⁶ A court must grant the delay if it finds reason to believe notice would:

Endanger someone’s life or physical safety
Cause the suspect to flee prosecution
Lead to destruction of or tampering with evidence
Result in witness intimidation
Otherwise seriously jeopardize the investigation

The government can extend the delay in additional 90-day increments by showing the same risks persist. When the delay finally expires, the government must serve the subscriber with notice identifying the nature of the investigation, confirming that records were obtained, and explaining the legal authority for the delay.⁶

Separately, § 2705(b) lets the government obtain a nondisclosure order directed at the provider itself, barring the company from telling anyone the order exists. That gag order lasts “for such period as the court deems appropriate,” which gives judges wide discretion.⁶ Some have run for years, and major technology companies have publicly challenged their use on First Amendment grounds.

Challenging a 2703(d) Order

A provider that receives an order can file a motion to quash or modify it. The statutory grounds are narrow: the records must be unusually voluminous, or compliance must otherwise create an undue burden.¹ Pulling years of session logs for thousands of accounts might qualify. If the court agrees, it can quash the order entirely or narrow what must be produced. A provider can also push back on an order that seeks data it does not have or that improperly demands content when only non-content records were authorized.

The statute gives the motion-to-quash right to the provider, not to the subscriber. Because subscribers usually do not learn about an order until after the records are handed over, a pre-disclosure challenge is rarely practical. In a criminal prosecution, a defendant can move to suppress records obtained through a 2703(d) order by arguing under the Fourth Amendment that a warrant was required, which is what happened in Carpenter. The Stored Communications Act itself contains no exclusionary rule; there is no statutory suppression remedy for a 2703(d) violation.

The statute does not spell out penalties for a provider that refuses to comply. Because the order comes from a court, an uncooperative provider faces the ordinary consequences of defying a court directive, including contempt proceedings.

Reimbursement for Providers

A provider that complies is entitled to reimbursement for the reasonable costs of searching for, assembling, and producing the records, including any resulting disruption to normal operations. The government and the provider negotiate the fee, and if they cannot agree, the court that issued the order sets it. Telephone toll records and directory listings from traditional phone carriers are excluded from automatic reimbursement, though a court can still order payment when a request is unusually large or burdensome.⁷ The reimbursement covers compliance costs, not legal fees for challenging the order.

Civil Remedies When the Statute Is Violated

Under 18 U.S.C. § 2707, any provider, subscriber, or other person harmed by a knowing or intentional violation of the Stored Communications Act can sue. Available relief includes actual damages plus any profits the violator earned, statutory damages of at least $1,000, punitive damages for willful or intentional violations, and reasonable attorney’s fees. A civil action must be filed within two years of the violation or two years after the plaintiff discovers it.⁸

Good faith reliance on a court order, warrant, grand jury subpoena, or statutory authorization is a complete defense to civil and criminal liability under the statute.⁸ If a government officer obtains an order improperly and a provider complies, the provider is protected. The officer may not be.

Data Stored Outside the United States

Before 2018, it was unclear whether a 2703(d) order could reach data that a U.S. company kept on servers in another country. Congress answered that with the Clarifying Lawful Overseas Use of Data Act, which added 18 U.S.C. § 2713 and requires providers to comply with their SCA obligations regardless of whether the data sits inside or outside the United States.⁹

The test is possession, custody, or control. A U.S. provider that controls the data must produce records in response to valid legal process even if the servers are in Dublin or Singapore. The CLOUD Act did not extend U.S. jurisdiction to new companies; it clarified that companies already subject to U.S. jurisdiction cannot avoid an order by placing data abroad. When compliance would conflict with the law of the country where the data is stored, courts apply a multi-factor balancing test weighing international comity against the government’s investigative needs. The CLOUD Act also authorizes executive agreements with qualifying foreign governments, letting those countries request data directly from U.S. providers for serious crimes when the country meets standards for privacy, human rights, and independent judicial oversight.¹⁰

1
Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
2
Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986
3
Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records – Section: Requirements for Court Order
4
Legal Information Institute. Carpenter v United States
5
Office of the Law Revision Counsel. 18 USC 2711 – Definitions for Chapter
6
Office of the Law Revision Counsel. 18 USC 2705 – Delayed Notice
7
Office of the Law Revision Counsel. 18 USC 2706 – Cost Reimbursement
8
Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
9
Office of the Law Revision Counsel. 18 USC 2713 – Required Preservation and Disclosure of Communications and Records
10
Department of Justice. The Purpose and Impact of the CLOUD Act – FAQs