The CLOUD Act was Congress’s answer to a specific stalemate. Microsoft had refused a US warrant for email stored in Ireland, arguing the warrant could not reach outside US territory. The case reached the Supreme Court and was mooted when Congress legislated.
What the CLOUD Act settled
The first half of the statute is short and consequential: a US provider must preserve and produce data within its possession, custody, or control, regardless of whether that data is stored inside or outside the United States.
This replaced a territorial test with a control test. Where the bytes physically sit stopped being the question. Whether the provider can reach them became the question.
The bilateral agreement framework
The second half addresses the reverse direction. Foreign governments investigating their own crimes frequently need data held by US providers, and the MLAT route took the better part of a year. The CLOUD Act allows the US to enter executive agreements with qualifying countries, under which their authorities can serve orders on US providers directly.
Qualification is conditional. A partner country must afford robust substantive and procedural protections for privacy and civil liberties, and agreements carry restrictions including that orders may not target US persons or people located in the United States.
| CLOUD Act agreement | MLAT | |
|---|---|---|
| Who serves the provider | The foreign authority directly | Domestic authority, after review |
| Typical timeline | Days to weeks | Many months |
| Government-to-government review of each request | No | Yes |
| Available to any country | No, only qualifying partners | Wherever a treaty exists |
Conflict of laws
Removing the territorial limit created an obvious problem: a US order could require a provider to do something another country’s law forbids. The comity mechanism lets a provider move to quash where the target is neither a US person nor located in the US and compliance would risk violating a qualifying foreign partner’s law. Courts weigh factors including the interests of both governments and the target’s connection to each.
This is narrower relief than it first appears. It applies to qualifying foreign governments, and it does not resolve every tension. The relationship between US orders and the GDPR, in particular, is still argued over rather than settled.
What it means for a company receiving requests
- Storage location is not a defence to a valid US order if you control the data.
- Check whether an order arrives under a CLOUD Act agreement, since that changes who may lawfully serve you and what limits apply.
- Raise genuine conflicts early. The comity route exists, but it requires being invoked rather than discovered afterwards.
- Expect the map to keep changing. New agreements come into force periodically, and each expands who can reach you directly.