What is the CLOUD Act?
The CLOUD Act is a US law from 2018 under which US providers may have to disclose data they control, even when that data is stored outside the United States.
The law added a provision to the US Stored Communications Act, 18 U.S.C. § 2713. It applies to providers of electronic communication and remote computing services and covers data in their possession, custody or control.
The law is used in criminal investigations and requires an order under US criminal procedure, such as a warrant reviewed by a judge. It followed a dispute over email that a US provider stored on a server in Ireland.
In 2019 the European Data Protection Board and the European Data Protection Supervisor found that disclosure based only on such an order generally lacks a legal basis under the GDPR. A provider subject to both may therefore have to weigh two laws against each other.
How it works
The law turns on the concept of control. If a provider under US jurisdiction has the data in its possession, custody or control, an order can cover it wherever the server is. In some cases the provider can ask for the order to be modified if disclosure would conflict with another country's law. That option applies to countries with a specific agreement with the United States on the matter.
Why it matters
The law means the storage location alone does not decide which laws apply. That matters when deciding where sensitive data should sit and when an AI service passes questions and document passages on to a provider. It is linked to third-country transfers and is a clear example of extraterritorial law.
What to keep in mind
The law does not give free access. It requires an order reviewed by a judge, and providers often examine such requests closely.
How far control extends to a European subsidiary has not been tested in court. So ask the supplier concrete questions about ownership, sub-suppliers and contracts.
What it means for you
Ask the supplier who owns the company and how it handles a request from an authority in another country.
Common questions
Does the CLOUD Act apply if the servers are in Sweden?
It can. What decides is whether a provider under US jurisdiction has control over the data. The location matters less.
Is the CLOUD Act the same as FISA 702?
No. The CLOUD Act is used in criminal investigations and requires a court order in each case. FISA Section 702 concerns intelligence gathering and rests on annual approvals.
How does the CLOUD Act affect AI services?
A question to an AI service often includes passages from documents. If the service is run by a US company, the same reasoning applies to that data as to cloud storage.
Sources: 18 U.S.C. § 2713 at govinfoEDPB and EDPS on the CLOUD Act
Related terms
Read more
All terms Updated