The CLOUD Act is a US law of 23 March 2018. It requires an online service provider subject to US law to disclose, under a lawful request, the data in its possession, custody or control, even when that data is stored outside the United States. So data that a US provider, or its subsidiary, hosts in Paris or anywhere else in Europe can be targeted; this normally takes a warrant from a US judge, in a criminal investigation.
Checked against the official texts on 23 October 2026. This isn’t legal advice: for your company, the question goes to your data protection officer (DPO) or your lawyer. Quotes from French sources are translated.
What does the CLOUD Act say?
The Clarifying Lawful Overseas Use of Data Act was passed on 23 March 2018 (Pub. L. 115-141, Division V). It grew out of a court case: Microsoft had refused to hand over to US prosecutors emails stored in Ireland.
Its core provision, codified at 18 U.S.C. § 2713, says in substance: a provider of “electronic communication service” or “remote computing service” must preserve or disclose the content of a communication and the records of a customer that are “within such provider’s possession, custody, or control”, “regardless of whether such communication, record, or other information is located within or outside of the United States”.
Two points to note:
- It isn’t open access. For the content of a communication, the Stored Communications Act normally requires a warrant issued by a judge, as part of a criminal investigation (18 U.S.C. § 2703).
- The provider’s room to push back is limited. Within 14 days, it can ask for a request to be quashed if complying would force it to break a foreign country’s law, but only if that country has signed an agreement with the United States (§ 2703(h)). The United Kingdom (in force since 2022) and Australia (since 2024) have one. France doesn’t, and no agreement between the European Union and the United States had been announced as of 23 October 2026.
Who does it apply to?
Providers subject to US law: email, online storage, hosting, AI services. The law targets what the company controls, not the country where the server sits. So a subsidiary of a US group, in France or elsewhere in Europe, doesn’t in principle escape a request made to its parent company.
Microsoft France admitted as much before the French Senate on 10 June 2025. Could its representative guarantee, under oath, that French citizens’ data would never be passed to US authorities without the French authorities’ agreement? The reply from its director of public and legal affairs: “No, I cannot guarantee it, but, once again, it has never happened” (Senate record, in French).
What about European providers? A provider with no headquarters or business in the United States isn’t, in principle, subject to US courts. One with a US subsidiary may be, depending on its ties to the country: each provider has to answer that question for itself.
CLOUD Act vs GDPR: the conflict
Under Article 48 of the GDPR, a judgment of a court or a decision of an authority in a non-EU country requiring personal data to be transferred or disclosed can only be recognised or enforced if it is based on an international agreement, such as a mutual legal assistance treaty.
In July 2019, the EU’s two data protection bodies (the European Data Protection Board and the European Data Protection Supervisor) analysed the CLOUD Act at the European Parliament’s request. Their conclusion: “unless a US CLOUD Act warrant is recognised or made enforceable on the basis of an international agreement, the lawfulness of such transfers of personal data cannot be ascertained”, except in rare cases where someone’s vital interests are at stake (joint response to the LIBE Committee, 12 July 2019).
A US provider operating in Europe can therefore find itself caught between two opposite obligations: hand the data over under US law, refuse under EU law.
FISA 702: the other law people mix up
The CLOUD Act is for criminal investigations. Section 702 of FISA (the Foreign Intelligence Surveillance Act) is for intelligence: it lets US agencies monitor non-US persons located outside the United States, through the providers, without an individual warrant. It was mainly this section that the Court of Justice of the EU targeted when it struck down the Privacy Shield, the data transfer framework of the time, in the Schrems II judgment of 16 July 2020 (Case C-311/18).
Renewed in April 2024 for two years, Section 702 wasn’t reauthorised by Congress in spring 2026. According to the Brennan Center (updated 17 September 2026), surveillance continues on the basis of the annual authorisations approved in March 2026, until around March 2027.
What about the Data Privacy Framework?
The EU-US Data Privacy Framework is the European Commission’s decision of 10 July 2023 that allows personal data to be transferred to US companies on its list (Decision 2023/1795). The EU General Court upheld it on 3 September 2025, in the Latombe case (Court press release). An appeal was lodged with the Court of Justice on 31 October 2025 (Case C-703/25 P): as of 23 October 2026, no ruling had been published. The two previous frameworks fell the same way.
Above all, it covers transfers, not CLOUD Act requests: the redress mechanism set up for it, the Data Protection Review Court, handles complaints about US intelligence, not warrants issued by a judge in a criminal investigation. And it rests on US commitments (a presidential executive order of October 2022): if they change, the Commission can review its decision.
Europe has its own tool too
The EU regulation on electronic evidence (Regulation 2023/1543), applicable since 18 August 2026, lets a judge in a Member State order a provider that offers its services in the EU to produce data in a criminal case, wherever that data is stored. The logic is the same: the law follows the provider, not the server.
What your company can do
- Map your providers: email, storage, AI. Note the country of the parent company, not just the country of the data centre.
- Read the contract (the DPA, or data processing agreement): the clause on government requests tells you whether the provider commits to warning you and to challenging an abusive request. OpenAI’s plans are reviewed from this angle in ChatGPT for business.
- Encrypt with your own keys where you can: a provider that can’t read your data can only hand over unreadable data.
- For your most sensitive data, choose a provider subject only to European law. That’s the recommendation of the CNIL, France’s data protection authority, which points out that data held by a provider subject to non-European law “may be exposed to a risk of having to disclose data to the public authorities of that country” (CNIL, in French, 19 July 2024). In France, the SecNumCloud qualification from the ANSSI, the national cybersecurity agency, includes this criterion.
- Talk to your DPO: the transfer rules are summarised in AI and GDPR.
Common misconceptions
- “Hosted in Europe, so protected.” Not if the provider is subject to US law: control is what counts.
- “US authorities read everything on a US cloud.” The CLOUD Act requires a procedure, normally a warrant: the risk is real, but it has a legal framework.
- “A French AI solves the problem.” Not if it runs on a US host: see French AI: who makes it, where it runs.
More on European AI: the sovereignty resources.
