Text messages are legally private in a narrow, practical sense: federal law protects them from outside interception and generally requires the government to get a warrant before reading the contents stored with your carrier. But that protection has real holes. Your carrier holds metadata for years. Border agents can search your phone with little or no suspicion. Your employer may have full access to a company device. Cloud backups can be handed over on a court order. And the person on the other end of the conversation can share everything you sent them, whenever they want.
The Federal Protections You Actually Have
Three layers of federal law form the backbone of text message privacy. The Fourth Amendment prohibits unreasonable searches by the government, and courts have extended it to electronic communications. Two statutes do the detailed work.
The Stored Communications Act, part of Chapter 121 of Title 18, restricts who can access electronic communications held by a service provider. It bars providers from voluntarily handing message contents to the government and sets out the legal process officials must use to compel disclosure.1Office of the Law Revision Counsel. 18 USC Ch. 121 – Stored Wire and Electronic Communications and Transactional Records Access Someone who knowingly breaks into a system to grab stored communications without authorization faces federal criminal penalties.2Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
The federal Wiretap Act covers messages in transit rather than at rest. It is a crime to intentionally intercept an electronic communication, or to disclose the contents of one you know was illegally intercepted.3Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Federal law uses a one-party consent standard: interception is legal if at least one participant consents. About a dozen states require all parties to consent.
The Supreme Court reinforced these statutes at the constitutional level in Riley v. California, holding that police generally cannot search the digital information on a cell phone seized during an arrest without first getting a warrant.4Justia. Riley v. California, 573 U.S. 373 (2014)
When Law Enforcement Can Read Your Texts
Police can access your text messages, but the standard depends on what they want and where they get it from. Content gets the strongest protection. Account information gets much less.
To obtain the actual content of texts from a service provider, the government generally needs a search warrant backed by probable cause. The Stored Communications Act draws a bright line: messages stored for 180 days or less require a warrant.5Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
Not everything tied to your account needs a warrant, though. An administrative subpoena is enough to get basic subscriber information: your name, address, phone number, payment method, and length of service. None of that is message content. For more detailed non-content records, like connection logs and session durations, the government can obtain a court order by showing specific and articulable facts that the records are relevant to a criminal investigation. That is a lower bar than probable cause.
An older principle called the third-party doctrine says you generally forfeit your privacy interest in information you voluntarily give to a third party, like a phone company. The Supreme Court narrowed that doctrine in Carpenter v. United States, holding that the government needs a warrant to obtain historical cell-site location records from a carrier because the time-stamped location history they create reveals an intimate picture of someone’s life.6Supreme Court of the United States. Carpenter v. United States, 585 U.S. 296 (2018) Carpenter addressed location data, not text content, but it signaled a willingness to limit the doctrine where digital records get too revealing.
In genuine emergencies involving an immediate threat to life or safety, officers can act without a warrant. The exception is narrow, and the government bears the burden of justifying the warrantless search by fully explaining the specific facts known at the time.7FBI: Legal Digest. The Emergency Aid Exception to the Fourth Amendment’s Warrant Requirement
At the Border, Most of Those Protections Disappear
The privacy rules described above largely stop at international borders. U.S. Customs and Border Protection has the authority to search electronic devices, including text messages, when you enter or leave the country. This applies to all travelers regardless of citizenship, and CBP’s position is that you are obligated to present the device in a condition that allows examination.8U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry
Courts distinguish between a manual search, where an officer scrolls through your phone by hand, and a forensic search using specialized software to extract data. Every federal circuit to consider the question has allowed manual border searches without any individualized suspicion. Forensic searches get more scrutiny in some circuits. The Fourth and Ninth Circuits require at least reasonable suspicion. The Eleventh Circuit has allowed forensic searches with no suspicion at all. CBP’s own internal policy requires supervisory approval and reasonable suspicion for advanced forensic searches, even where the courts in that region might not require it.
If you refuse, CBP may not charge you criminally, but they can detain and seize the device.
The Person You Texted Can Share Everything
This is where most people’s assumptions about text privacy fall apart. Under federal law, a participant in a conversation can generally share what was said without violating the Wiretap Act, because the one-party consent rule treats a party’s own access as consented to.3Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Once you send a text, the recipient has a copy on their device, and no federal law stops them from screenshotting, forwarding, or reading it aloud.
Group chats amplify this. The more people in a conversation, the more copies of every message exist and the harder it becomes to claim a reasonable expectation that the contents would stay private. Context still matters, and a small, clearly confidential group may retain some expectation that a casual public chat does not, but the rule of thumb is simple: if you would not want a message read aloud in court, do not send it. The law protects your texts from outside interception. It does not protect them from the person on the other end.
What Your Employer Can See
Whether your employer can read your texts turns almost entirely on who owns the phone and what policies you agreed to.
On a company phone, assume they can see everything. Most organizations include a provision in employment agreements or IT policies stating that employees have no expectation of privacy on company equipment. When that policy exists and you have been informed of it, courts generally give employers wide latitude to monitor communications on devices they own, including text messages, browsing history, and app usage.
If you use your own phone for work under a bring-your-own-device arrangement, employer access is more limited. Employers typically need your explicit consent to monitor a personal device, and that consent is usually baked into the BYOD policy you sign at enrollment. Read those agreements. Many BYOD policies give the employer the right to remotely wipe the entire device if it is lost or stolen or when you leave the company, and a remote wipe deletes everything, including personal photos and messages. If you never signed a waiver authorizing that, you may have grounds to challenge it, but proving damages after the fact is hard.
The safest approach is to keep work and personal communications on separate devices whenever possible, and read any device policy before you sign it.
Carriers, Apps, and the Cloud Backup Problem
The technology behind your messages matters as much as the law.
Standard SMS and MMS
Traditional text messages sent through your carrier’s network are not end-to-end encrypted. The carrier can, in theory, access the content while it is in transit or stored on their systems. Carriers retain metadata such as call logs, message timestamps, and cell tower connections for extended periods. According to publicly reported retention schedules, AT&T keeps call detail records for about seven years, T-Mobile for about two years, and Verizon for about one year. Actual message content is retained for a much shorter window. AT&T has been reported to store SMS content for roughly 90 days before deleting it. After that, the content is generally gone from the carrier’s systems.
End-to-End Encrypted Apps
Apps like Signal and WhatsApp encrypt messages on your device and decrypt them only on the recipient’s device. The provider never holds a readable copy of the content, so there is nothing useful to hand over even under a warrant. That is a fundamentally different privacy posture from standard SMS.
The Cloud Backup Loophole
Encrypted messaging users often get tripped up here. If you back up your phone to iCloud or Google Drive using default settings, your messages may be stored in the cloud in a form the provider can access. Apple’s standard iCloud backup encrypts your data on its servers, but Apple holds the encryption key, meaning Apple can decrypt the backup in response to a valid legal request.9Apple Support. iCloud Data Security Overview That backup includes a copy of the key needed to read your Messages data.
Apple offers an opt-in feature called Advanced Data Protection that switches iCloud backups to true end-to-end encryption, where only your trusted devices hold the keys. With that setting enabled, Apple cannot decrypt your backup even if ordered to.9Apple Support. iCloud Data Security Overview The default does not protect you from law enforcement requests directed at Apple.
If Litigation Is Coming, Do Not Delete
Text messages regularly show up as evidence in civil and criminal cases because they create a timestamped written record of what someone said. In civil litigation, the other side can request your texts through standard discovery or subpoena the carrier directly, though carriers hold actual content only briefly, sometimes around 90 days. After that, recovery often depends on a forensic examiner working from the physical device.
Once you reasonably anticipate a lawsuit, you have a legal duty to preserve evidence that could be relevant, and that includes texts. Deleting them, or allowing auto-delete settings to destroy them, is spoliation. Federal Rule of Civil Procedure 37(e) sets up a two-tier system for sanctions when electronically stored information is lost because a party failed to take reasonable preservation steps. If the loss prejudices the other side but was not intentional, the court can order measures to cure it, such as additional discovery or a curative jury instruction. If the court finds you destroyed messages with intent to deprive the other side of the evidence, penalties jump: the judge can instruct the jury to presume the deleted texts were unfavorable to you, or in extreme cases enter a default judgment.
Reasonable preservation means turning off auto-delete features, backing up relevant messages before switching or disposing of a device, and knowing how your phone handles retention. Courts have rejected claims of ignorance about how auto-delete works.
Practical Steps to Keep Your Texts Private
- Use end-to-end encrypted apps. Signal, WhatsApp, and iMessage between Apple devices encrypt content so only you and the recipient can read it.
- Turn on Advanced Data Protection for iCloud so your backups are end-to-end encrypted and Apple cannot decrypt them.
- Check whether your messaging app backs up to Google Drive or iCloud in an unencrypted or provider-accessible format, and adjust the setting.
- Before using a personal phone for work, read the BYOD policy and understand what access and remote-wipe rights you are granting.
- Remember that the law protects your texts from outside interception, but nothing prevents the person you texted from sharing the conversation.
- If a lawsuit is possible, turn off auto-delete, back up your device, and follow any litigation hold instructions you receive.