# What Is the Stored Communications Act (SCA)? | Kodex Source: https://www.kodexglobal.com/glossary/stored-communications-act > The Stored Communications Act sets the tiers governing US data disclosure. Learn what each tier reaches and which legal process is required. Compliance & Regulation ## Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Also known as SCA, 18 U.S.C. 2701 The Stored Communications Act is the load-bearing statute for US data requests. Almost every question about what an instrument can compel resolves back to it. ### The tiered structure The SCA’s central design is that different categories of data warrant different levels of protection, and each tier is unlocked by a different legal instrument. Data tierInstrument required Basic subscriber information covers identity-level details: name, address, session times and durations, length and type of service, and payment information. Transactional records cover the more detailed picture of how an account was used. Content is what was written or stored. ### The prohibition, and its exceptions The SCA’s default is prohibitive. A covered provider is barred from divulging the contents of communications, subject to enumerated exceptions. The exceptions that matter most operationally: - Disclosure to the government under proper legal process, per the tiers above. - Disclosure with the lawful consent of the originator or intended recipient. - Voluntary emergency disclosure where the provider believes in good faith that an emergency involving danger of death or serious physical injury requires it. - Disclosure necessarily incident to providing the service or protecting the provider’s rights. The consent exception is the one that resolves most civil disputes, since a party who wants their own messages can usually authorise their release directly. ### What it means for a company receiving requests - Classify the data before classifying the request. What tier the requested data falls into determines which instruments can compel it. - Do not let a request’s ask exceed its instrument. A subpoena that demands content is common and does not become valid because it was asked confidently. - Treat private-party requests differently. Civil subpoenas for content generally cannot be honoured, and the SCA is the reason. - Document the basis for voluntary disclosures. The emergency exception protects a good-faith belief, so the record of what you believed and why is what the protection rests on. ### Where the boundaries are unsettled Carpenter v. United States (2018) held that acquiring historical cell site location records is a Fourth Amendment search requiring a warrant, notwithstanding that such records had been obtained under the lower 2703(d) standard. The decision did not rewrite the SCA, but it established that constitutional protection can attach to data the statute places in a lower tier. Similar arguments continue over other categories of transactional data, and the safe posture is to treat the statutory tiers as a floor rather than a settled ceiling. FAQ ### Frequently asked questions Does the SCA apply to companies outside the United States? It applies to providers of electronic communication service and remote computing service to the US public, which can capture foreign-headquartered companies serving US users. Whether it reaches a particular company is a legal question that turns on its services and user base, and one worth settling with counsel rather than assuming. Can a private litigant subpoena user content from a provider? Generally no. The SCA prohibits providers from disclosing content to private parties, and civil subpoenas do not override that prohibition. This surprises litigants regularly. The usual route is to obtain the content from the account holder themselves, who can consent to disclosure. Why is the SCA considered outdated? It was enacted in 1986, when stored email worked very differently and cloud storage did not exist. Distinctions the statute draws (such as treating messages over 180 days old differently) map poorly onto modern services, and courts and providers have spent decades working around assumptions the technology invalidated. Glossary ### Related terms #### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. #### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. #### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. #### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. See how Kodex supports compliant handling of legal process. Learn more