ECPA is best understood as an umbrella rather than a single rule. Asking “what does ECPA require” is usually the wrong question; the right one is which of its three titles applies.
The three titles
Title I: the Wiretap Act. Governs intercepting communications in transit. The standard is the highest in the statute: probable cause, plus a showing that other investigative techniques have been tried and failed or would be futile, plus ongoing judicial supervision and minimisation requirements. Live interception of content is treated as the most serious intrusion available.
Title II: the Stored Communications Act. Governs access to communications and records at rest with a provider, through the tiered system where subpoenas reach basic subscriber information, 2703(d) orders reach transactional records, and warrants reach content.
Title III: the Pen Register Act. Governs prospective collection of addressing information, under a certification standard rather than a factual showing.
| Wiretap Act | Stored Communications Act | |
|---|---|---|
| Data state | In transit | At rest |
| Reaches content | Yes | Yes, with a warrant |
| Standard | Probable cause plus necessity | Tiered by data type |
| Ongoing obligation | Yes, with supervision | No, one-time production |
| Frequency for providers | Rare | Routine |
Why the architecture creaks
ECPA was written when email was downloaded from a server and deleted, cloud storage was not a consumer product, and a mobile phone did not generate a continuous location record. Several of its distinctions have aged poorly. The best-known is the 180-day rule, under which older stored messages were treated as abandoned and available on a lower standard, a distinction that made sense when storage was scarce and makes none now. Major providers have long required warrants for content regardless, and courts have supported that position.
What it means for a company receiving requests
- Identify the title first. It determines the standard, the obligation type, and whether you are producing once or operating a capability.
- Do not rely on the 180-day distinction. Requiring a warrant for content regardless of age is the mainstream provider position and the defensible one.
- Expect the Stored Communications Act to be the operative title in almost all routine work.