“In enacting the [Electronic Communications Privacy Act of 1986 (ECPA)], Congress concluded that customers may not retain a “reasonable expectation of privacy” in information sent to network providers…[I]f the contents of an unopened message are kept beyond six months or stored on behalf of the customer after the e-mail has been received or opened, it should be treated the same as a business record in the hands of a third party, such as an accountant or attorney. In that case, the government may subpoena the records from the third party without running afoul of either the Fourth or Fifth Amendment.”
ECPA, the law governing access to email and cloud stored data, was passed at a time when the cost of online storage was so high it seemed unthinkable that anyone would store data there indefinitely, so anything left on networked storage for longer than 180 days was considered abandoned and required only an administrative subpoena to access. But in the time since it became law, the price of online storage went down and many people started to rely on free cloud based email solutions like Gmail or Yahoo! Mail as digital storage lockers.
There have been numerous efforts to update ECPA to be more in line with current consumer behavior and the Fourth Amendment, which protects against unwarranted searches and seizures, but none as of yet have succeeded. The most recent attempt to update the law to clearly require a probable cause warrant hit a major milestone in April when S.B. 607, a standalone fix, was approved by the Senate Judiciary Committee. Rep. Matt Salmon (R-AZ) introduced a companion bill to the House on Tuesday, although a similar proposal was already introduced by Reps. Zoe Lofgren (D-CA), Ted Poe (R-TX) and Suzan DelBene (D-WA) earlier this year.
But while the law has not yet been updated, the courts and tech companies are adapting to the way consumers use these services in the modern era. In the 2010 case United States v. Warshak, a Sixth Circuit Court of Appeals panel including two Republican-appointed judges ruled email providers cannot be compelled to turn over the content of messages without a probable cause warrant regardless of how long it has been stored in the cloud, but that ruling only applies to the four states in the Sixth Circuits’ jurisdiction. Earlier this year a number of tech companies including Google, Microsoft, Facebook, and Yahoo announced they go beyond ECPA and require warrants for email content data on Fourth Amendment grounds.