The CLOUD Act explained: what it means for your data

This article is for information only and is not legal advice. Rangee is our product; the texts cited were checked on 2 November 2026.

The CLOUD Act is a US law dated 23 March 2018. It requires online service providers subject to US law to disclose to the authorities the data they control, even when that data is stored outside the United States. It also sets up agreements with partner countries.

People cite it to argue opposite things. For some, it hands all European data to Washington. For others, it only concerns serious criminals. Both readings are wrong. This guide starts from the text itself, the US Department of Justice's FAQ and the European positions, then turns them into practical checks for your tools.

What is the CLOUD Act?

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) was passed on 23 March 2018, as part of the federal spending bill (Pub. L. 115-141). It has two parts: a duty for providers to disclose the data they control, wherever it is, and a framework for bilateral agreements on access to electronic evidence.

The first part fits in one sentence, added to the US Code as Section 2713. A provider of electronic communication or remote computing services must preserve or disclose certain data. That means content, metadata and customer records within its ‘possession, custody, or control’. And it applies ‘regardless of whether’ the data is located in the United States or elsewhere.

The law grew out of a court case. The US government demanded emails that Microsoft stored in a data centre in Ireland. Microsoft refused, arguing that the 1986 law did not reach beyond US territory. The CLOUD Act settled the question: storage location no longer matters, only control does.

The second part lets the United States sign ‘executive agreements’ with countries that respect the rule of law. According to the Department of Justice page, two agreements have been signed: with the United Kingdom in 2019 and Australia in 2021. Talks with the European Union resumed in March 2023 and had not concluded by 1 November 2026.

Which companies does the CLOUD Act cover?

It covers providers of electronic communication and remote computing services that fall under the jurisdiction of US courts. According to the Department of Justice, that includes email providers, phone companies, social networks and cloud storage. Jurisdiction ‘is not limited’ to US companies: it depends on the company's ties with the United States.

In practice there are three cases:

• The provider is American, or the European subsidiary of a US group controls the data. It is covered, wherever the servers are. The Department's FAQ explains that corporate structure does not change the analysis: what counts is the entity with control.
• The provider is European but present in the United States: a subsidiary, offices, business ‘purposefully directed’ at the US market. It may be covered. This is a case-by-case analysis that the Department calls ‘highly fact-dependent’.
• The provider is European with no business aimed at the United States. It is, in principle, outside the CLOUD Act. Its sub-processors may not be.

That last point is the one most often missed. A European app that stores its files with a US hosting company exposes those files: the host holds them, and the host is subject to US law. So the question is not about one provider but about the whole chain.

What does the CLOUD Act allow US authorities to do?

The CLOUD Act lets a US authority investigating a crime require a provider to hand over the data it controls, including data held abroad. For the content of an account, it needs a warrant. According to the Department of Justice, an independent judge signs it on the basis of ‘probable cause’, and it describes the data sought in detail.

A warrant for content, other orders for the rest

A warrant gives access to content: messages, files, databases. Subscriber information, such as name, billing address or login IP addresses, can be obtained through less demanding procedures under the same 1986 law. The CLOUD Act did not create these procedures: it extended their reach to data stored outside the United States.

The customer is not always told. A judge can bar the provider from notifying you, if a warning would put the investigation at risk. The Department's FAQ says such orders are generally limited to one year.

Executive agreements work both ways

An executive agreement lets the authorities of a partner country go straight to a US provider, using their own procedures. The United States gets the same in return. These agreements only cover serious crime and forbid targeting US persons. None exists with any EU country or with the European Union.

The right to challenge, and its limit

A provider can ask a court to quash a warrant within 14 days, under subsection (h) of Section 2703. Two conditions apply. The customer must be neither a US person nor resident in the United States. And disclosure must create a ‘material risk’ of breaking the laws of a ‘qualifying foreign government’.

This is where the text works against Europeans. A ‘qualifying foreign government’ is a country that has signed an executive agreement with the United States. Without an EU-US agreement, a provider cannot use this procedure to protect a European customer. What remains is the traditional ‘comity’ analysis before the judge, with no guaranteed outcome.

What does the CLOUD Act not allow?

The CLOUD Act creates no mass surveillance, no new kind of warrant and no duty to decrypt. The US Department of Justice writes that ‘indiscriminate or bulk’ collection is not permitted under this law. It adds that the law is ‘encryption neutral’. Nor does it apply to every European company.

One point often comes up: the CLOUD Act supposedly does not apply to ‘civil or commercial requests’. That is true of executive agreements, which question 10 of the FAQ limits to serious crime. Section 2713, for its part, applies to requests by US public authorities under the 1986 law.

CLOUD Act, FISA and the Data Privacy Framework: how do they differ?

The CLOUD Act concerns criminal investigations. Section 702 of FISA concerns intelligence on foreigners outside the United States. The Data Privacy Framework, adopted by the European Commission on 10 July 2023, governs transfers of personal data to US companies. Three texts, three different logics.

Section 702 is the broadest of the three. According to NPR, it is used every year to collect the communications of hundreds of thousands of foreigners. Congress let it lapse on 12 June 2026, but collection continues under the annual authorisations already granted by the special court. According to the Brennan Center, those approved in March 2026 remain valid until 17 March 2027. Its renewal is still being debated in Congress.

The Data Privacy Framework is the third transfer framework, after Safe Harbor and Privacy Shield. The Court of Justice struck down the first two, the second in the Schrems II judgment in 2020. The EU General Court upheld it on 3 September 2025 (Latombe, T-553/23). An appeal to the Court of Justice is pending.

This framework does not neutralise the CLOUD Act. It makes lawful a transfer that a company chooses to make, for example to its US supplier. It says nothing about a criminal warrant served on that supplier.

What does EU law say?

Under Article 48 of the GDPR, a decision of a court or authority of a non-EU country is only recognised or enforced if an international agreement supports it. A mutual legal assistance treaty is the typical example. In July 2019, the European data protection authorities drew a restrictive conclusion from this.

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) issued a joint assessment on 10 July 2019, at the European Parliament's request. According to a summary by the law firm Cleary Gottlieb, they found that a provider subject to the GDPR cannot, in principle, transfer data on a US warrant alone. No GDPR legal basis fits, and no Article 49 derogation either.

An official channel does exist: the EU-US mutual legal assistance agreement, in force since 1 February 2010. But a CLOUD Act warrant goes straight to the provider, bypassing it. Both authorities therefore call for a dedicated agreement on electronic evidence, with real safeguards. The US Department of Justice only mentions that these talks resumed in March 2023.

The result is a conflict of laws. A US provider that receives a warrant for European data risks a US penalty if it refuses, and a European one if it complies. So the GDPR does not block the request: it shifts the risk onto the provider. For you, the customer, the GDPR is an argument in a negotiation, not a shield.

Europe also has its own mechanism. Since 18 August 2026, Regulation (EU) 2023/1543 lets a judge or prosecutor in one Member State serve a European Production Order on a provider. It is enough that the provider offers its services in the EU, even if it is established elsewhere. US providers serving the European market are covered too. No provider, European or not, is beyond every order.

Is hosting your data in Europe enough?

No. Server location does not matter for the CLOUD Act. Section 2713 covers data under the provider's control, ‘regardless of whether’ it is stored in the United States. What matters is the law that applies to the company controlling the data, and to each of its sub-processors.

Two ideas are often confused. Data residency is the country where the data is stored. Sovereignty is the law that applies to whoever controls it. A US provider can offer the first without the second. Airtable, for example, offers European data residency on its Enterprise Scale plan only, and remains a Californian company.

Microsoft France admitted as much before the French Senate. On 10 June 2025, its director of public and legal affairs was questioned under oath by the committee of inquiry into public procurement. Could he guarantee that French citizens' data would never be handed over on a US order without the French authorities' consent? His answer, according to the official record, translated from French: ‘No, I cannot guarantee that, but, once again, it has never happened.’

The answer is honest, and it applies to every US provider. It does not say such requests are frequent. It says that no contract, no storage region and no commercial commitment can rule out a legal obligation in the United States.

For the most sensitive data, France has created its own qualification. The SecNumCloud label from ANSSI, the French cybersecurity agency, requires among other things that the provider be European by headquarters and capital. Its director general sums it up, according to Banque des Territoires: the label certifies that only a European provider controls the data. He also points out that it is a cybersecurity qualification, not a complete measure of sovereignty.

What the CLOUD Act means for your data: 6 checks

For a small business, the CLOUD Act does not change day-to-day work, but it does change how you choose your tools. A US request aimed at a small European company remains rare. So the risk is managed like any other: know where the data is, who controls it and what the contract says.

These are the six checks we run ourselves before adopting a tool:

1. The nationality of the provider and its parent company. Read the legal notice and terms of service: which company signs the contract, and who controls it? A European subsidiary of a US group remains exposed.
2. The list of sub-processors. Hosting, backups, email delivery, support and AI all count. Our round-up of free inventory software, for instance, shows where each vendor hosts its data. A European provider that stores data with a US host exposes your data at that host.
3. Where access comes from. Technical support based outside the EU may be able to access the data. Ask who can access it, from where and under what conditions.
4. Encryption and keys. The CLOUD Act does not require decryption. If only you hold the keys, a provider can only hand over unreadable data. That is rare in collaboration tools, which need to read the data to display it.
5. What the contract commits to. The data processing agreement (DPA, required by Article 28 of the GDPR) can commit the provider to notify you where the law allows. It can also commit it to challenge any unfounded request. Such clauses do not override a law, but they show the provider's policy.
6. How sensitive your data really is. An inventory list does not call for the same precautions as a medical record. For health data or sensitive public-sector data, look at offers with a sovereign cloud qualification, such as SecNumCloud in France.

These questions apply to a database, a CRM, a project tool or a messaging app. They also help you read a comparison: in our comparison of Airtable alternatives in Europe, the ‘provider's country’ column matters as much as the price.

What about Rangee?

Rangee is published by a company incorporated under French law. The content of your bases is hosted in a data centre in the European Union, by Hostinger International Limited, a Cypriot company according to its terms of service. The AI model behind smart import runs in the EU.

An honest chain has limits too, and we state them. Payments go through Stripe, a US group: it processes your billing data (name, address, payment method), not the content of your bases. And like any company, we remain subject to French and European orders.

So we do not promise to escape every law: nobody can. We promise what can be checked: a provider under French law, bases hosted in the EU, and named sub-processors that you can check yourself. On cost, our no-code database pricing survey compares Rangee with other tools, European data residency included.

If you want to see what a spreadsheet becomes in a tool hosted in Europe, try Rangee for free: the Free plan never expires, and readers never pay.