Somebody at a company you have never spoken to can hand over a list of everything you did on your account, and the first rule worth knowing is that there are three different levels of legal process, they get very different things, and only one of them requires a judge to find probable cause.
The federal law that governs this is the Stored Communications Act. The two sections that do the work are 18 U.S.C. 2703 and 18 U.S.C. 2705. What follows is what the current text of those sections actually says.
The short answer
A plain subpoena, with no judge involved, reaches your name, your address, your session times, how long you have had the account, your assigned network address, and the credit card or bank account you paid with. A court order under a lower standard than probable cause reaches more. Only a warrant reaches the contents of what you wrote. And for the records level, the government is not required to tell you any of it happened.
Level one: a subpoena, and no judge
Section 2703(c)(2) is a short list, and it is worth reading closely because it is the part most people would not guess. On a subpoena alone, a provider must hand over your name, your address, your local and long distance connection records or records of session times and durations, the length of service including the start date and the types of service you used, your telephone or instrument number or other subscriber number including any temporarily assigned network address, and the means and source of payment including any credit card or bank account number.
Read that last item again. A subpoena that never passed in front of a judge reaches the card you paid with.
None of that is the contents of your messages. It is everything around them, which in practice is often more useful to an investigator than the messages themselves, because it establishes who you are, when you were online, and what address you were using.
Level two: a court order on a lower standard
Section 2703(d) is the middle tier and its standard is the thing to understand. A court issues one of these orders when the government offers specific and articulable facts showing that there are reasonable grounds to believe the records sought are relevant and material to an ongoing criminal investigation.
That is a real standard and a judge does apply it. It is also a good deal lower than the probable cause a search warrant requires. Relevant and material to an investigation is a much easier thing to show than probable cause to believe a crime was committed.
The same subsection gives the provider a right the customer does not have. A provider can move promptly to quash or modify the order if the records are unusually voluminous or compliance would otherwise be an undue burden.
Level three: a warrant, for contents
For the actual contents of communications, section 2703(a) requires a warrant for anything held in electronic storage for one hundred and eighty days or less. For material held longer, or held by what the statute calls a remote computing service, section 2703(b) allows the government to use a warrant without notifying you, or to use a subpoena or a 2703(d) order if it gives you prior notice.
One honest caveat. That one hundred and eighty day line was written in 1986 and it does not match how anybody stores email now. Several major providers publish policies requiring a warrant for content regardless of age, and the courts have not left the original text undisturbed. Treat the statute as the floor rather than the whole picture, and ask a lawyer in your jurisdiction what the current rule is where your case sits.
Why you may never find out
This is the part the know-your-rights pages tend to skip.
For the records level in section 2703(c), the statute says plainly that a governmental entity receiving those records is not required to provide notice to the subscriber. Not delayed notice. No notice.
Where notice is required, section 2705 lets the government postpone it. A court can grant a ninety day delay, and the statute says the court shall grant it if there is reason to believe notice would produce one of five listed harms: endangering someone’s life or physical safety, flight from prosecution, destruction of or tampering with evidence, intimidation of potential witnesses, or otherwise seriously jeopardizing an investigation or unduly delaying a trial.
With a subpoena, no judge is needed for that delay at all. A supervisory official signs a written certification. The statute defines who that is: the investigative agent in charge or assistant agent in charge, or the chief prosecuting attorney or first assistant, at a headquarters or regional office. Extensions of up to ninety days each are available after that.
And section 2705(b) reaches the company. A court can order the provider not to tell you or anyone else that the demand exists, for such period as the court deems appropriate. That is the gag that explains why a company you use every day can receive a demand for your records and say nothing.
The freeze that needs no court at all
Section 2703(f) is one paragraph and many folks have never heard of it.
On the request of a governmental entity, a provider must take all necessary steps to preserve records and other evidence in its possession, pending the issuance of a court order or other process. The retention period is ninety days, extendable by another ninety on a renewed request.
No warrant. No court order. No judicial finding of any kind. A request is enough to have your account contents frozen and held for up to six months while the government decides what process to seek. If you have ever wondered why deleting something after the fact does not help, this is a large part of the answer.
The fourth path, which needs no process at all
Everything above assumes the government uses legal process. Section 2702 describes a route that skips it.
The general rule in section 2702 is that a provider may not hand over your content to anyone, and may not hand your records to a governmental entity. Then come the exceptions, and one of them matters more than the rest. A provider may give the government your content, or your records, if it believes in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay.
No warrant, no subpoena, and no judge. The provider decides in good faith, and hands it over.
There is one accountability mechanism worth knowing about. Section 2702(d) requires the Attorney General to report to both Judiciary Committees every year on how many accounts the Department of Justice received this way, and specifically on the cases where the investigation was then closed without any criminal charges being filed. Congress wrote that reporting requirement because it expected the emergency route to be used on people who turn out not to be charged with anything.
Why this law does not help the defense
This is the part that surprises people who assume a privacy statute cuts both ways.
Read who each section speaks to. Section 2703 is titled required disclosure, and every operative sentence in it begins with the same phrase: a governmental entity may require. Section 2702 then bars a provider from divulging the contents of a communication to any person or entity, with a short list of exceptions, and none of those exceptions is a criminal defendant with a subpoena.
So the same statute that limits what the government can take also blocks a defendant from going to the provider directly for the same material. In practice a defendant who needs that content generally has to get it from the government through discovery, or from the account holder’s own consent, rather than from the company.
There is one asymmetry in the records provisions worth noticing alongside it. Section 2702(c)(6) allows a provider to hand your non-content records to any person other than a governmental entity. The statute guards those records against the government specifically, and not against everyone.
What has to happen eventually
Where notice was delayed rather than dispensed with, section 2705(a)(5) requires the government to serve you or mail you a copy of the process when the delay expires, along with a notice that states with reasonable specificity the nature of the inquiry and tells you four things: that your information was supplied to or requested by that authority, the date it happened, that your notice was delayed, which government entity or court authorized the delay, and which provision of the chapter allowed it.
That is a genuinely useful document, and it is the reason a letter that looks like junk mail is worth opening.
If you get a notice
Providers that do give notice usually give a short window before they produce. A few things matter in that window.
Read what level of process it is, because the three tiers above are not interchangeable and the document will say. Note the deadline, which is often measured in days rather than weeks. Do not delete anything, because a preservation request has very likely already frozen it and deleting can create a separate problem far worse than the original one. And talk to a lawyer in the jurisdiction where the process issued, since a motion to quash is filed in that court and the timing is short.
Florida wrote its own version, and it is nearly identical
Everything above is federal law. Florida also has its own statute covering the same ground, and anybody handling a Florida case works with both. It is section 934.23 of the Florida Statutes, titled required disclosure of customer communications or records.
The structure tracks the federal law closely. Contents held one hundred and eighty days or less require a warrant from a judge of a court of competent jurisdiction. Contents held by a remote computing service can come by warrant without notice, or by subpoena or court order with notice, and that notice can be delayed under section 934.25.
The records provision is the one worth reading side by side with the federal version, because Florida made the same choices. On a subpoena, a provider discloses the name, the address, the connection records or records of session times or durations, the length of service including the starting date, the types of service used, the subscriber number including any temporarily assigned network address, and the means and source of payment including any credit card or bank account number.
Florida also copied the two provisions that matter most to somebody who wants to know whether they will ever be told. Section 934.23(4)(c) says an officer who receives those records is not required to provide notice to the subscriber or customer. Section 934.23(7) requires a provider, on request, to preserve records for ninety days, extended by another ninety on a renewed request.
The court order standard is also the same words: specific and articulable facts showing reasonable grounds to believe the records are relevant and material to an ongoing criminal investigation.
One difference in wording is worth noticing. The federal statute speaks of a governmental entity. Florida’s speaks of an investigative or law enforcement officer, and defines a court of competent jurisdiction as one with jurisdiction over the investigation or otherwise authorized by law.
In a Florida case both statutes are usually in play at once, and a demand for the same records will often cite the federal and the state section side by side.
A company that fought this, and what it put on the record
In April 2016 Microsoft sued the United States Department of Justice over exactly this. The company argued that section 2705(b) is unconstitutional under the First Amendment, because it stops a business talking to its own customers about how the government investigates them, and that section 2703 is unconstitutional under the Fourth Amendment to the extent it relieves the government of any obligation to notify a customer whose content it takes by warrant.
The number Microsoft put in its complaint is the one worth remembering. It alleged that federal courts issued more than 3,250 secrecy orders over a twenty month period ending in May 2016, and that nearly two thirds of them had no end date at all. Those are Microsoft’s allegations rather than findings by the court, and the scale is the point.
In February 2017 Judge James Robart of the Western District of Washington ruled on the government’s motion to dismiss and granted it in part while denying it in part. On the part that mattered most, the court held that Microsoft had adequately alleged an injury, and a likelihood of similar injury in future, to have standing to pursue its First Amendment claim. The case is Microsoft Corp. v. United States Department of Justice, 233 F. Supp. 3d 887 (W.D. Wash. 2017).
The clearest description of the mechanism comes from another federal court, quoted in that opinion: the combined effect of the two sections is that the subscriber may never receive notice of a warrant to obtain content information from a remote computing service and the government may seek an order under section 2705(b) that restrains the provider indefinitely from notifying the subscriber.
A court said that plainly, about a statute that is still on the books.
If a demand like this is in your case
Account records are usually the visible part of something larger, and the timing matters more than it looks. If notice was delayed rather than skipped, the government eventually owes you a document naming who authorized the delay and under which provision, which is worth having. If a preservation request went out, the freeze date can predate every other piece of paper in the file. Both are worth finding early rather than after charges are filed. I handle criminal defense in Florida and DUI defense, and I see plenty of cases the State builds out of records somebody else was holding.
This post is general information about federal and Florida law, not legal advice, and it does not create an attorney-client relationship. Government access to stored communications and records is governed by 18 U.S.C. sections 2702, 2703, and 2705, and in Florida by sections 934.23 and 934.25, Florida Statutes. The federal sections were read as of their July 2026 text and the Florida sections as of the 2025 statutes. Microsoft Corp. v. United States Department of Justice, 233 F. Supp. 3d 887 (W.D. Wash. 2017), is cited for the procedural posture described. Statutes change and courts continue to interpret them, so confirm the current rule before relying on any of this. Every case turns on its own record.
