Communication Metadata and Government Surveillance Laws

Communication metadata and government surveillance laws draw a sharp line between what you say and everything else about the saying: federal agencies can often reach the records of who you contacted, when, where you were, and for how long, using legal tools far weaker than the probable-cause warrant required to read your messages or listen to your calls. A 2018 Supreme Court decision narrowed that gap for cell phone location data, but most other categories of metadata remain accessible through subpoenas, court orders with a low relevance standard, or administrative demands issued without a judge’s involvement at all.

Content vs. Metadata: Where the Line Sits

Every phone call, text, email, and internet session generates two kinds of information. Content is what you actually said or wrote. Metadata is everything else: the phone numbers on a call, the addresses on an email, the IP addresses used to connect, the timestamps, the duration, and the cell towers your phone pinged along the way. The Fourth Amendment protects content strongly. Metadata, for the most part, it does not.

Some categories sit in a gray area. Email routing information is metadata, but courts have found that a subject line qualifies as content under the Stored Communications Act because it summarizes the substance of the message. Web browsing raises a similar tension: a bare domain name functions like an address, while the full URL path after the domain can reveal what you were actually reading. Courts have not drawn a bright line, so the classification can shift with how the information is being used.

Cell-site location information deserves separate mention because of how much it reveals. Every connection your phone makes to a tower gets logged by the carrier, and over weeks or months those logs reconstruct where you have been in fine detail. That richness is what eventually pushed the Supreme Court to treat this category differently from other metadata.

Why Metadata Gets Weaker Protection: The Third-Party Doctrine

The legal foundation comes from Smith v. Maryland, decided in 1979. Police there asked the phone company to install a pen register recording the numbers a suspect dialed, without getting a warrant. The Supreme Court held this was not a “search” under the Fourth Amendment because the caller had already shared those numbers with the phone company to complete the call.¹

The reasoning is voluntary disclosure. When you hand information to a third party to make a service work, you give up your reasonable expectation of privacy in that information. The same logic reaches billing records, connection logs, and subscriber details across nearly every service you use. The words spoken on a call are protected; the record that the call happened belongs to the company and sits available to the government through easier legal channels.

Access Standards Under the Stored Communications Act

The main statute governing government access to stored metadata is the Stored Communications Act, codified at 18 U.S.C. § 2703. It creates a tiered system with different levels of legal process for different categories of records.

At the lowest tier, the government can get basic subscriber information — your name, address, phone number, payment method, and session logs — using an administrative subpoena, a grand jury subpoena, or a trial subpoena. An administrative subpoena needs no judge; the agency issues it itself.²

For more detailed records — communication logs, routing data, connection timestamps beyond the basic subscriber category — the government needs a court order under § 2703(d). To get one, a prosecutor must offer “specific and articulable facts showing that there are reasonable grounds to believe” the records are “relevant and material to an ongoing criminal investigation.”³ That standard is easier to meet than probable cause. Records don’t have to prove someone committed a crime; they just have to be relevant to looking into one.

At the top tier, the actual content of stored communications — the text of your emails, files in your cloud storage — requires a warrant. After 2018, historical cell-site location data also falls into this warrant-required tier, even though the statute’s text still references the lower § 2703(d) standard for those records.

Real-Time Collection: Pen Registers and Trap and Trace

Pulling stored historical records is one thing. Real-time collection of addressing information as communications happen falls under a separate authority, 18 U.S.C. §§ 3121–3127. A pen register captures outgoing addressing data. A trap and trace device captures incoming data. Neither one records content.⁴

Getting a court order for these devices is nearly automatic. A government attorney certifies that the information is relevant to an ongoing criminal investigation, and the statute says the court “shall” issue the order, leaving the judge essentially no discretion to refuse.⁵ Compare that to a wiretap, which requires probable cause that a specific crime is being committed plus a showing that normal investigative techniques have failed or would be too dangerous. The gap between those two standards is large, and it exists because the law still treats addressing information as fundamentally less private than content.

National Security Letters

National Security Letters bypass court involvement altogether. These are administrative demands the FBI issues on its own, compelling service providers to turn over subscriber information and communication transaction records for national security investigations.⁶

They routinely come with a nondisclosure requirement. If the FBI director or a designee certifies that disclosure could endanger national security, interfere with an investigation, harm diplomatic relations, or put someone in physical danger, the provider cannot tell the customer or anyone else that records were requested. These gag orders can be challenged in court under 18 U.S.C. § 3511, but many providers lack the resources or inclination to do so.⁶

How Carpenter Changed the Rules for Location Data

For nearly four decades, Smith v. Maryland let the government reach metadata without a warrant. In 2018, the Supreme Court carved out a significant exception in Carpenter v. United States.

The FBI had obtained 127 days of historical cell-site records for a robbery suspect using a § 2703(d) order — the “reasonable grounds” standard, well below probable cause. The Court held that was not enough. Accessing historical cell-site location information is a Fourth Amendment search, and the government generally needs a warrant supported by probable cause to get it.⁷

The Court rejected the government’s third-party doctrine argument, pointing to “the world of difference between the limited types of personal information” in earlier cases and the “exhaustive chronicle of location information casually collected by wireless carriers.” Seven days of records was enough to trigger the warrant requirement; the Court left open whether shorter periods might not.⁸

The ruling was narrow on its face. It did not disturb the third-party doctrine for other business records, did not address real-time location tracking or tower dumps (bulk downloads of everyone who connected to a particular tower), and did not question conventional tools like security cameras. Standard warrant exceptions, including emergencies involving an immediate threat to life, still allow warrantless access in urgent situations.⁷

What Carpenter established in principle is that volume and intrusiveness matter. When a category of metadata becomes detailed enough to reconstruct the “privacies of life,” the old assumption that sharing it with a company forfeits all privacy protection no longer holds. How far courts will extend that logic to browsing history, app usage, or financial transactions remains open.

FISA Section 702 and Incidental Collection of Americans’ Metadata

Section 702 of the Foreign Intelligence Surveillance Act, at 50 U.S.C. § 1881a, authorizes the Attorney General and the Director of National Intelligence to jointly approve targeting of non-U.S. persons reasonably believed to be outside the United States, for foreign intelligence purposes.⁹

Section 702 is not supposed to be used against Americans. The statute prohibits targeting anyone known to be in the United States, using a foreign target as a pretext to surveil a specific U.S. person, or intentionally targeting a U.S. person even when they are abroad.⁹ But when a targeted foreigner communicates with someone in the United States, that American’s side of the exchange and its metadata enter the government’s databases. The intelligence community calls this “incidental collection.”¹⁰

Once incidentally collected, analysts can search that data using “U.S. person query terms” — an American’s name, phone number, or email. The Reforming Intelligence and Securing America Act, signed into law in April 2024, imposed new restrictions. FBI personnel now need prior approval from a supervisor or attorney before running U.S. person queries, the FBI must enforce escalating consequences for noncompliant queries with zero tolerance for willful violations, and queries designed solely to find evidence of a crime are prohibited with narrow exceptions.¹¹

The same reauthorization extended Section 702 for only two years, so the authority is set to expire in April 2026 unless Congress acts again. It also expanded the statutory definition of “electronic communication service provider” to reach any entity with access to equipment that transmits or stores communications, broadening the range of companies the government can compel to assist.¹¹

What Happened to Bulk Domestic Phone Records

Under Section 215 of the USA PATRIOT Act, codified at 50 U.S.C. § 1861, the NSA collected metadata on essentially every domestic phone call in the United States starting in 2006, using secret orders from the Foreign Intelligence Surveillance Court. The program became public in 2013.

Congress responded with the USA FREEDOM Act of 2015, which prohibited bulk collection under Section 215 and replaced it with a targeted call detail records program requiring the government to identify a specific person, account, or device connected to international terrorism before requesting records. That reformed authority expired on March 15, 2020, and has not been reauthorized.¹² The statutory text of 50 U.S.C. § 1861 has reverted to a version containing only definitions rather than collection authority.¹³ Section 702, pen register orders, and National Security Letters remain active, so the expiration closed one broad avenue rather than eliminating metadata collection.

Whether You’ll Ever Know

When the government obtains your metadata from a service provider, you may never find out. Under 18 U.S.C. § 2705, the government can delay notifying you for up to 90 days and can renew the delay in 90-day increments.¹⁴

The government can also ask a court to order the service provider itself to stay silent. A court will issue this gag order on finding that notice could endanger physical safety, cause a suspect to flee, lead to destruction of evidence, intimidate witnesses, or seriously jeopardize an investigation. The statute sets no maximum duration; the court imposes whatever period it considers appropriate.¹⁴ Combined with the parallel nondisclosure regime for National Security Letters, this means metadata collection often happens entirely in the dark, and any notice may arrive long after the investigation has closed.

Geofence Warrants

Traditional surveillance identifies a suspect and then seeks their data. Geofence warrants reverse the order. Law enforcement defines a geographic area and time window — say, a three-block radius around a bank robbery for 30 minutes — and demands records on every device that was present. The technology company, historically Google because of its large store of location data, provides anonymized data, and investigators narrow the pool to identify suspects.

The Fourth Amendment requires warrants to describe the specific person or place to be searched, a requirement called “particularity.” Geofence warrants search everyone in a given area, including people with no connection to any crime. A federal court in the Eastern District of Virginia held in 2022 that mere proximity to suspected criminal activity does not establish probable cause to search a person, and rejected the government’s argument that presence near a crime scene was enough to justify searching everyone’s location data.

In 2023, Google announced it would begin storing location data locally on users’ devices rather than centrally and would shorten default retention. That change makes geofence warrants against Google’s central database much harder or impossible going forward, though the legal questions remain open for other companies that still store location data centrally.

What Encryption Protects and What It Doesn’t

End-to-end encryption protects the content of messages so that only sender and recipient can read them. Metadata often remains visible even when content is encrypted, and how much metadata is available varies dramatically by platform.

Signal collects almost nothing: your phone number and the date you last connected. WhatsApp uses end-to-end encryption for message content but collects significantly more metadata, including contact lists, usage patterns, device identifiers, and location data. The distinction matters because the metadata WhatsApp retains is exactly the sort of information the government can compel through the legal tools above.

The FBI has described “warrant-proof encryption” as a primary barrier to accessing electronic evidence and asks companies to preserve the ability to produce readable content in response to lawful orders.¹⁵ No federal law currently requires companies to build that capability. Encryption protects content effectively; it does nothing for the metadata your provider already collects, and that metadata alone can reveal a great deal about your life.

No Federal Retention Mandate

One detail surprises many people: the United States has no federal law requiring telecommunications companies or internet service providers to retain metadata for any specific period. Retention decisions are left to the companies, which store data for varying lengths of time based on their own business needs. The government can compel access to records that exist but cannot force a company to create records it otherwise wouldn’t keep. If a provider routinely deletes connection logs after 30 days and the government arrives on day 31, the data is gone.

The gap works both ways. Some providers hold data for years because it supports billing, network management, or advertising. Others, particularly privacy-focused services, minimize retention deliberately. The practical reach of government surveillance depends in part on the private data practices of whichever companies you happen to use.

1
Supreme Court of the United States. Smith v. Maryland
2
Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
3
Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records
4
Office of the Law Revision Counsel. 18 USC Chapter 206 – Pen Registers and Trap and Trace Devices
5
Office of the Law Revision Counsel. 18 USC 3123 – Issuance of an Order for a Pen Register or a Trap and Trace Device
6
Office of the Director of National Intelligence. National Security Letter Statutes
7
Justia. Carpenter v. United States
8
Supreme Court of the United States. Carpenter v. United States
9
Office of the Law Revision Counsel. 50 USC 1881a – Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons
10
Intelligence.gov. Incidental Collection in a Targeted Intelligence Program
11
Congress.gov. H.R. 7888 – Reforming Intelligence and Securing America Act
12
Congressional Research Service. Origins and Impact of the Foreign Intelligence Surveillance Act (FISA)
13
Office of the Law Revision Counsel. 50 USC 1861 – Definitions
14
Office of the Law Revision Counsel. 18 U.S. Code 2705 – Delayed Notice
15
Federal Bureau of Investigation. Lawful Access – Myths vs. Reality