Government Data Demands and ECPA

ECPA was enacted in 1986 to set limits on the ability of the U.S. government, and state and local governments, to compel the disclosure of data in criminal investigations. Through litigation and legislation, CDT is working to update and strengthen ECPA protections so they protect the ways in which people communicate today.

ECPA should be updated to require a warrant when the government wants to track a person’s location or read their email and text messages. We believe the Fourth Amendment requires these protections and that they should be codified and clarified.

Additionally, people should be given notice when the government compels disclosure of their data or their location from a communications service provider. ECPA should be updated to require that the government give such notice as soon as is possible, without compromising the integrity of an investigation. In addition, the government’s ability to gag a communication service provider so they cannot voluntarily notify their user of government data demands for disclosure of the user’s data should be similarly limited.

Foreign governments’ data demands directed to U.S. communications service providers should be honored only when lawful and consistent with the rights of the targets of those demands. CDT works to ensure that data sharing agreements between the U.S. government and other governments — including CLOUD Act agreements — must account for and protect those rights.