For businesses responding to subpoenas and data requests, a crucial legal distinction is important to understand: what is “content” data versus “non-content” data under the Stored Communications Act (SCA)? Absent an exception to the rule or user consent, the SCA generally prohibits the disclosure of the “content” of electronic communications, Misunderstanding the difference between “content” and “non-content” data when responding to subpoenas and law enforcement requests for user data may lead to compliance errors, violation of privacy regulations, and legal liability.

This article examines the definitions of “content” versus “non-content data” under the SCA, explaining the nuances, providing examples, and outlining why understanding the difference is important for businesses navigating their obligations when legal demands for electronic information arise. 

What is the Stored Communications Act (SCA)?

Congress enacted the Stored Communications Act, 18 U.S.C. 2701, et seq, as Title II of the Electronic Communications Privacy Act (ECPA) of 1986. The two primary purposes of the SCA are: 1) to protect the privacy of stored electronic communications; and 2) outline the lawful procedures for government entities and civil litigants to access this data.

Businesses that provide “Electronic Communication Service (ECS)” and “Remote Computing Service (RCS)” are subject to the Stored Communications Act.  ECS providers store digital communications for others, such as email providers and instant messaging services. RCS providers provide storage to users (e.g., Dropbox, Google Drive), and virtual server hosting (e.g., Microsoft Azure, Amazon S3).

As noted, the SCA prohibits ECS and RCS providers from turning over the content of electronic communications without user consent unless there is an exception under the SCA permitting disclosure.

(For a deeper dive into the SCA, check out this more in-depth article).

Examples of “Content” Data Under the SCA

References to “content” data in the SCA refers to the meaning and substance of a communication. Specifically, under 18 U.S.C. § 2510 (8), “content” is “any wire, oral, or electronic communication that includes any information concerning the substance, purport, or meaning of that communication.”

Relevant court opinions define the “content” of a communication as “the intended message conveyed by the communication, [but] does not include record information regarding the characteristics of the message that is generated in the course of the communication.” In re Zynga Privacy Litigation, 750 F.3d 1098 (9th Cir. 2014).

Characteristics & Examples of Content under the Stored Communication Act:

    • Instant Messages/Chat: The actual text of the conversation, shared links, or files exchanged within the chat.

    • Voicemails/Audio Files: The audible message itself.

    • Private Documents/Files: Files stored in cloud services (e.g., Google Docs, Dropbox files, Salesforce CRM notes) if they contain substantive information of communication or data meant to be private.

    • Photos/Videos: If they are exchanged as a form of communication or contain substantive information that conveys meaning.

    • Passwords Some courts hold that passwords are content under the SCA. See e.g., In re Ex Parte Application of Path Network, Inc.,703 F.Supp.3d 1046 (N.D. Cal. 2023)(Holding that “[p]asswords are undoubtedly a form of information’ [that may relate to] the ‘substance, purport, or meaning of [a] communication’. . . .)

Examples of “Non-Content” Data Under the SCA

In contrast to content, “non-content” data under the SCA relates to account activity without revealing the substance of any communications. It’s often referred to as “metadata” – data about the data. See, e.g. Google v. United States,  Misc. Case No. 23-67 (D. D.C. 2025) (noting that subpoenas may require a service provider to disclose certain basic subscriber information and content such as subscriber name, address, payment information, session times and IP addresses.)

Characteristics & Examples of Non-Content Data Under the SCA:

    • Subscriber Information: Name, physical address, billing address, account number, payment method, date account opened.

    • Time and Date Stamps: When a communication was sent, received, or accessed.

    • Volume of Data: The size of a file, but not its content.

    • Transactional Records: Records of user activity, messaging logs, data transfer volume, and associated network addresses.

The SCA Prohibits Disclosure of the Content of Electronic Communications Without User Consent Except in Limited Circumstances Involving Law Enforcement Requests or Court Order

Understanding the difference between content and non-content data has direct implications for a business’s legal obligations when faced with a law enforcement request for customer data or a civil subpoena for email communications.

As noted, the SCA generally prohibits ECS and RCS providers from voluntarily disclosing the content of stored electronic communications. Understanding what disclosures are permissible under the SCA is complex, as the required legal process varies depending on who is issuing the request and what type of data is being sought. For instance, the government is often entitled to more information than a private civil litigant.

Civil Subpoenas:

Courts issue subpoenas upon the request of parties involved in civil litigation.

    • Disclosure of the Content of Communications Prohibited: Generally, an ECS or RCS provider cannot disclose the content of communications in response to a civil subpoena (e.g., the actual text of an email).

    • Disclosure of Non-Content Data Permissible: An ECS or RCS provider  may disclose non-content data (e.g., subscriber information, IP addresses) in response to a civil subpoena. See, e.g. Google v. United States,  Misc. Case No. 23-67 (D. D.C. 2025) (Noting that [the  SCA] provides a sliding scale of protections and data requests by subpoena “require a service provider to disclose certain basic subscriber information and content.”)

Governmental Requests (Law Enforcement/Administrative) and Court Orders:

These are issued by government agencies, including law enforcement (e.g., FBI, grand juries, or administrative bodies).

    • For “Content” of Communications:
        • Warrant:  A warrant is required to obtain the content of communications stored by an ECS provider for 180 days or less. This is the highest legal standard, mirroring the requirements for physical searches.

        • Court Order (18 U.S.C. § 2703(d)): For the content of communications stored by an ECS provider older than 180 days, or by an RCS provider (regardless of age), a specific court order issued under 18 U.S.C. § 2703(d) is typically required. This order demands “specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.”

    • For “Non-Content” Data:
        • Government entities can often obtain non-content data (e.g., subscriber name, address, payment information, session times, IP addresses) with a less stringent legal process than that required for civil litigants, such as a grand jury subpoena or administrative subpoena.  See Google v. United States,  Misc. Case No. 23-67 (D. D.C. 2025) (“the Government may by ‘subpoena’ require a service provider to disclose certain basic subscriber information and content.”)

    • Emergency Disclosure: The SCA includes a limited exception for emergency situations. If there is an immediate danger of death or serious physical injury, an ECS or RCS provider may voluntarily disclose content or non-content data if there are reasonable grounds to believe the emergency exists. This is a narrow exception and should be handled with extreme caution and immediate legal review.

User Consent as an Exception

If the subscriber or user of the electronic communication service or remote computing service provides explicit, informed consent to the disclosure, then the provider is generally permitted to release the data.  

Proactive Steps for Stored Communications Act Compliance

Proactive preparation is an organization’s best move when faced with a subpoena for customer information. Developing and documenting internal procedures can save your business from errors stemming from content vs. non-content data disclosures during subpoena compliance.

    • Maintain a Data Retention Policy: Understand what customer data your business collects, where it’s stored (on-premise, cloud, third-party services), who is responsible for it, and for how long it is retained. This knowledge is key to quickly and accurately responding to data requests.

    • Centralized Intake and Tracking: Designate an individual or department (e.g., Legal, Data Security, Compliance) as the sole point of contact for receiving and logging all data requests and subpoenas.

    • Identify Your Organization’s SCA Classification: Clearly determine if your business functions as an ECS provider or an RCS provider (or both). This is step one in understanding your obligations under the Stored Communications Act.

    • Understand Your Terms of Service/Privacy Policy: Regularly review and update your company’s privacy policy and terms of service to ensure they accurately reflect your data handling practices and align with your SCA obligations

    • Determine if Data Type is Properly Requested: Review the subpoena or data request to ascertain whether it is for “content” or “non-content.” Then determine if the nature of the request permits its disclosure under the SCA (i.e. if content of communication is requested, was the request made by warrant or with the informed consent of a participant?).

    • Verify Legal and Service of Process: Examine the subpoena, court order or data request to ensure it meets the SCA’s specific requirements for the type of data requested and the issuing authority.

    • Object to the Request if Necessary: You may have grounds to object to a subpoena or challenge the request (e.g., if it’s overly broad or lacks proper legal basis).

    • Duty to Notify: While required under the SCA in certain situations, but not in others, some state laws, contractual agreements, or even your own privacy policies may impose a duty to notify users when their data is being sought via legal process.

    • Consult Legal Counsel or Other Experts: The SCA is complex, and its application can vary based on specific facts and evolving case law. When in doubt – or whenever a subpoena for digital data is received consult legal help, or other experts to assist with the handing of subpoenas.  Mishandling information subject to the SCA can be significantly more costly than planning ahead.

How to Work With Us or Learn More

Work with our Company: If you would like to discuss our Subpoena Response and Compliance Services and how we can work together to streamline your subpoena response and data request workflows, please reach out here.

Check out our Subpoena Resources Page: Check out our Subpoena Compliance Articles Page to learn more about subpoena compliance, regulations and laws related to data requests like the Stored Communication Act or how to leverage subpoena software.

The post What Is Content Under the Stored Communications Act (SCA)? A Guide for Subpoenas & Data Requests appeared first on Percipient – Legal Services Powered by Technology.