What is the CLOUD Act?
The CLOUD Act is a U.S. federal law that clarifies how law enforcement can access data stored overseas by American tech companies.
Enacted on March 23, 2018, as part of the Consolidated Appropriations Act, it amends the 1986 Stored Communications Act to require U.S.-based providers to disclose data they control—regardless of server location—upon a warrant or subpoena. It also enables bilateral executive agreements with foreign governments, allowing reciprocal data access for serious crimes while imposing safeguards like privacy protections and challenge mechanisms for providers.
The law arose from cases like the FBI's 2013 attempt to access Microsoft emails stored in Ireland, addressing cloud computing gaps in prior statutes. Providers can now formally contest requests conflicting with foreign laws, but critics note risks to privacy for U.S. persons' data abroad.
