What the CLOUD Act is.
A US court can order an American provider to hand over what it holds for you, and it makes no difference that the servers are in Europe. The order follows the company, not the data.
The text
The Act added a single section to the American law on stored communications, and that section is one sentence long.
“A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”
The order follows the company, and where the machines stand is not a defence the company can raise.
18 U.S.C. §2713 · in force since 23 March 2018 · checked 2026-09-04
Why the CLOUD Act was written
It settled an argument the American government had been losing. A warrant was served on Microsoft for mail held in Ireland; Microsoft refused on the ground that the warrant did not reach outside the United States, and won on appeal. The Supreme Court took the case and never decided it — Congress passed this Act while the case was pending, which made the question moot, and the judgment below was vacated. The statute is the answer that the court never had to give.
Who has to comply
The duty falls on the provider of electronic communication service or remote computing service. Neither term is defined in the CLOUD Act. The chapter it was added to takes its definitions from elsewhere in the same title, and says so in one line.
“the terms defined in section 2510 of this title have, respectively, the definitions given such terms in that section”
What is not fixed by any definition is the phrase the order actually turns on — whether something is within a provider’s possession, custody or control. That is the open question below, and it is the reason this test reads a supplier chain rather than a letterhead: a European company selling you a European product may rent the machines from an American one, and the American one is a company an American court can address.
A different statute, and a wider wording
European discussion of this subject often reaches for a second definition: in April 2024 Congress widened who counts as a communications provider to take in anyone with access to the equipment used to carry or store communications.
“any other service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications”
Four exceptions follow that sentence — hotels, homes, community centres and restaurants — which is what tells you how wide Congress understood the rest of it to be. Two things about it are usually left out. It belongs to the American foreign-intelligence law and decides who can be served a directive under that law, not who must answer a CLOUD Act order. And it was repealed on 12 June 2026 along with the section holding it, while continuing to reach directives issued before then until those run out.
50 U.S.C. §1881(b)(4)(E), added by Pub. L. 118–49 §25(a) · repealed · checked 2026-09-23
Whether a European data centre helps
A national government answered this one in its own assessment of a product it buys.
“The US CLOUD Act (Clarifying Lawful Overseas Use of Data) was specifically designed to obtain access to data stored in data centres in the EU. This act extends the jurisdiction of North American courts to all data under the control of companies operating in the USA, even if those data are stored in data centres outside the territory of the United States.”
Where the servers stand still matters for other things, and settles nothing here. The full answer to “It's hosted in Europe”
Whether you would be told
When a provider is ordered to hand something over, a court can also forbid it from telling you. It is not automatic and it is not forever — but you would not know it had happened, and you would have no way to ask.
“for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order”
Not automatic. A court must find reason to believe that notifying you would endanger life or physical safety, cause flight from prosecution, lead to destruction of or tampering with evidence, intimidate witnesses, or otherwise seriously jeopardise an investigation or unduly delay a trial. Justice Department policy from October 2017, reinforced in May 2022, directs prosecutors to request no more than a year absent exceptional circumstances — that is policy, not statute, and revocable without any vote. In July 2025 the D.C. Circuit held that a blanket order covering subpoenas not yet issued does not satisfy the individualised finding the section requires.
18 U.S.C. §2705(b) · in force · checked 2026-09-04
Is the Justice Department's one-year duration policy still current in 2026? Confirmed a different, media-specific set of policies was rescinded in April 2025. Found no source stating either that the general duration policy survived or that it fell.
What European law says back
American law says a provider shall comply regardless of where the data sits. European law says a foreign court order is not, by itself, a lawful basis to hand anything over — that is Article 48 of the GDPR, and the European data protection authorities have stated the consequence bluntly: absent an international agreement, providers subject to EU law cannot lawfully base a disclosure to the United States on such a request. Both are real obligations and they cannot both be satisfied. The CLOUD Act does contain an escape hatch — a provider can move to quash where disclosure would break the law of a qualifying foreign government — but a qualifying government is one that has concluded an executive agreement with the United States, the motion covers content only, and it must be filed within fourteen days. Your supplier is the one who has to choose, and whichever way they choose they are breaking a law somewhere.
“In the absence of such framework provided by an international agreement… or another legal basis under the GDPR, service providers subject to EU law cannot legally base the disclosure and transfer of personal data to the US on such requests.”
What the CLOUD Act is not
- Not a collection programme. It compels a named company to produce material a court has ordered. The bulk powers European debate usually means are different statutes and a different executive order, and they run without the company being asked at all.
- Not evidence that anything has happened to your data. Nothing on this site says what any company has done. What can be compelled is knowable from the statute; what was compelled is not knowable from outside the process.
- Not limited to criminal investigations of Americans. The section carries no nationality test and no carve-out for foreign customers of an American company.
The other powers, and what can lawfully be done with material once it is held
What is not settled
In force since 23 March 2018. Its central phrase — data within a provider's 'possession, custody, or control' — is not defined in the CLOUD Act or in the Stored Communications Act, and no controlling appellate decision interpreting it for cloud or infrastructure providers was found. Commentary expects courts to borrow the civil-discovery test, where practical ability to obtain is close to decisive, but that is analysis and not a holding.
How far does 'possession, custody, or control' extend to a company that operates the hardware but is not the customer's counterparty?
Searched for controlling appellate authority interpreting §2713 for cloud and infrastructure providers. United States v. Microsoft, the case that prompted the Act, was mooted by the Act's own passage and vacated.
Checked 2026-09-04
What to ask a supplier
Each of the seven things people say when this comes up has an answer, and a good answer settles the point in one sentence.
Which of your suppliers is inside this?
The test asks which tools your company actually uses, names the companies running the machinery under each one, and says which of them an American court can address. A few minutes, and your answers stay in this tab.
Run it on your own companyNot legal advice. Every statute on this page is quoted from the code and dated, and every source is published with proof of what it said when it was read.