# What Is ECPA? The Three Parts Explained | Kodex

Source: https://www.kodexglobal.com/glossary/ecpa

> ECPA governs US government access to communications through three titles. Learn what each covers and which applies to a given data request.

Compliance & Regulation

## Electronic Communications Privacy Act (ECPA)

ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data.

Also known as
ECPA

ECPA is best understood as an umbrella rather than a single rule. Asking “what does ECPA require” is usually the wrong question; the right one is which of its three titles applies.

### The three titles

Title I: the Wiretap Act. Governs intercepting communications in transit. The standard is the highest in the statute: probable cause, plus a showing that other investigative techniques have been tried and failed or would be futile, plus ongoing judicial supervision and minimisation requirements. Live interception of content is treated as the most serious intrusion available.

Title II: the Stored Communications Act. Governs access to communications and records at rest with a provider, through the tiered system where subpoenas reach basic subscriber information, 2703(d) orders reach transactional records, and warrants reach content.

Title III: the Pen Register Act. Governs prospective collection of addressing information, under a certification standard rather than a factual showing.

Wiretap ActStored Communications Act

Data state In transit At rest

Reaches content Yes Yes, with a warrant

Standard Probable cause plus necessity Tiered by data type

Ongoing obligation Yes, with supervision No, one-time production

Frequency for providers Rare Routine

### Why the architecture creaks

ECPA was written when email was downloaded from a server and deleted, cloud storage was not a consumer product, and a mobile phone did not generate a continuous location record. Several of its distinctions have aged poorly. The best-known is the 180-day rule, under which older stored messages were treated as abandoned and available on a lower standard, a distinction that made sense when storage was scarce and makes none now. Major providers have long required warrants for content regardless, and courts have supported that position.

### What it means for a company receiving requests

- Identify the title first. It determines the standard, the obligation type, and whether you are producing once or operating a capability.

- Do not rely on the 180-day distinction. Requiring a warrant for content regardless of age is the mainstream provider position and the defensible one.

- Expect the Stored Communications Act to be the operative title in almost all routine work.

FAQ

### Frequently asked questions

What is the difference between the Wiretap Act and the Stored Communications Act?

Timing. The Wiretap Act governs interception of a communication while it is in transit, and sets a very high bar because live interception is the most intrusive form of surveillance. The Stored Communications Act governs access to communications already at rest with a provider, under the lower tiered standards.

Which part of ECPA applies to a typical data request?

The Stored Communications Act, in nearly every case. Most requests a company receives concern data already stored: subscriber records, logs, message content at rest. Wiretap and pen/trap orders are comparatively rare and impose ongoing rather than one-time obligations.

Has ECPA been updated for modern services?

Only partially. The CLOUD Act amended it in 2018 to address cross-border access, and court decisions have reshaped parts of its application. The core architecture is still the 1986 design, and distinctions it draws map awkwardly onto services that did not exist when it was written.

Glossary

### Related terms

#### Stored Communications Act (SCA)

The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach.

#### Pen Register and Trap and Trace

A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause.

#### CLOUD Act

The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law.

See how Kodex supports compliant handling of legal process.
Learn more