Tracker record · Federal · Statute
CLOUD Act
The CLOUD Act (2018) creates two distinct cross-border data-access mechanisms that should not be conflated. First, 18 U.S.C. 2713 requires providers of electronic communication service or remote computing service to preserve and disclose communications and records within their possession, custody, or control regardless of whether the data is located inside or outside the United States. Second, 18 U.S.C. 2523 authorizes executive agreements under which the Attorney General, with the concurrence of the Secretary of State, may certify qualifying foreign governments to issue orders directly to U.S. providers, with corresponding exceptions permitting provider disclosure under 18 U.S.C. 2511(2)(j) and 2702(b)(9) and (c)(7). Section 2713 governs U.S. legal process; section 2523 governs bilateral executive agreements.
Status
- Legal status
- In effect
- Allegation or finding
- Operative law
- Applicability
- U.S. providers of electronic communication service and remote computing service; section 2713 applies to U.S. criminal legal process; section 2523 applies to foreign governments under certified executive agreements
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- 18 U.S.C. 2523
- Primary source
- https://www.law.cornell.edu/uscode/text/18/2713
- Citation
- 18 U.S.C. 2713 (added 2018)
- Source
- 18 U.S.C. 2713
Related guides
- Employee Information and Workplace Monitoring
- Government Data Security, Contractors, and Legal Process
- Tracking Technologies, Advertising, and Personalized Pricing