The Stored Communications Act is the load-bearing statute for US data requests. Almost every question about what an instrument can compel resolves back to it.
The tiered structure
The SCA’s central design is that different categories of data warrant different levels of protection, and each tier is unlocked by a different legal instrument.
| Data tier | Instrument required |
|---|
Basic subscriber information covers identity-level details: name, address, session times and durations, length and type of service, and payment information. Transactional records cover the more detailed picture of how an account was used. Content is what was written or stored.
The prohibition, and its exceptions
The SCA’s default is prohibitive. A covered provider is barred from divulging the contents of communications, subject to enumerated exceptions. The exceptions that matter most operationally:
- Disclosure to the government under proper legal process, per the tiers above.
- Disclosure with the lawful consent of the originator or intended recipient.
- Voluntary emergency disclosure where the provider believes in good faith that an emergency involving danger of death or serious physical injury requires it.
- Disclosure necessarily incident to providing the service or protecting the provider’s rights.
The consent exception is the one that resolves most civil disputes, since a party who wants their own messages can usually authorise their release directly.
What it means for a company receiving requests
- Classify the data before classifying the request. What tier the requested data falls into determines which instruments can compel it.
- Do not let a request’s ask exceed its instrument. A subpoena that demands content is common and does not become valid because it was asked confidently.
- Treat private-party requests differently. Civil subpoenas for content generally cannot be honoured, and the SCA is the reason.
- Document the basis for voluntary disclosures. The emergency exception protects a good-faith belief, so the record of what you believed and why is what the protection rests on.
Where the boundaries are unsettled
Carpenter v. United States (2018) held that acquiring historical cell site location records is a Fourth Amendment search requiring a warrant, notwithstanding that such records had been obtained under the lower 2703(d) standard. The decision did not rewrite the SCA, but it established that constitutional protection can attach to data the statute places in a lower tier. Similar arguments continue over other categories of transactional data, and the safe posture is to treat the statutory tiers as a floor rather than a settled ceiling.