Email privacy laws in the United States are a patchwork: the Stored Communications Act controls when the government can read your messages, the CAN-SPAM Act regulates commercial senders, roughly twenty state privacy statutes give you direct rights over the data providers collect, HIPAA and Gramm-Leach-Bliley require encryption in healthcare and finance, and every state has a breach notification law that kicks in when your credentials leak. What protects you depends on who is trying to see the message, why, and where you live.
When the Government Wants Your Stored Email
The Stored Communications Act, 18 U.S.C. §§ 2701–2712, is the federal statute that decides when an email provider can be forced to hand your messages over to law enforcement.1Office of the Law Revision Counsel. 18 U.S.C. Chapter 121 – Stored Wire and Electronic Communications and Transactional Records Access On paper, the statute treats older email as less protected than recent email. Under 18 U.S.C. § 2703, messages stored for 180 days or fewer require a search warrant, while messages stored longer could historically be obtained with a subpoena or court order.2Office of the Law Revision Counsel. 18 U.S.C. 2703 – Required Disclosure of Customer Communications or Records
That split no longer reflects how the law actually works. In United States v. Warshak, the Sixth Circuit held that you keep a reasonable expectation of privacy in your emails regardless of how long they’ve sat on a server, comparing email to phone calls and postal mail and requiring a warrant based on probable cause before a provider can be compelled to disclose message contents.3United States Court of Appeals for the Sixth Circuit. United States v. Warshak Most federal agencies now treat a warrant as the baseline for stored email of any age, even though the older subpoena provision remains on the books.
The SCA also criminalizes unauthorized access by private actors. A first offense committed for commercial advantage or in furtherance of another crime can bring up to five years in prison; a subsequent offense under those same circumstances can bring up to ten. Even without a profit motive, a repeat offender faces up to five years.1Office of the Law Revision Counsel. 18 U.S.C. Chapter 121 – Stored Wire and Electronic Communications and Transactional Records Access
What Commercial Senders Are Allowed to Do
The CAN-SPAM Act, 15 U.S.C. §§ 7701–7713, governs marketing email sent to U.S. recipients. The law does not require you to opt in first. It does require senders to play by clear rules once they message you.
Every commercial email has to carry accurate header information identifying the sender, a clear notice that the message is an advertisement, and a valid physical postal address for the sender.4Office of the Law Revision Counsel. 15 U.S.C. 7704 – Other Protections for Users of Commercial Electronic Mail It must also include a working opt-out mechanism that stays functional for at least 30 days after the message is sent. Once you use it, the sender has 10 business days to stop mailing you.5Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
Fake or deceptively obtained “from” addresses count as materially misleading and are separately unlawful.4Office of the Law Revision Counsel. 15 U.S.C. 7704 – Other Protections for Users of Commercial Electronic Mail The FTC enforces the statute under its unfair-or-deceptive-practices authority, and each noncompliant message is a separate violation carrying a civil penalty of up to $53,088.5Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business Individual recipients do not have a private right to sue under CAN-SPAM, but internet service providers can, with statutory damages available.6Office of the Law Revision Counsel. 15 U.S.C. 7706 – Enforcement Generally
Your Rights Over the Data Providers Collect
Twenty states have passed comprehensive consumer data privacy laws, and the number keeps growing. The rights they grant look similar across jurisdictions: you can ask what a company has collected, get a copy in a portable format, request deletion, and opt out of having your personal data sold or used for targeted advertising. Businesses generally have 45 days to respond to a verified request, with extensions available for complex cases.
California’s Consumer Privacy Act was the first and remains the most aggressive. It covers the email address itself, metadata tied to the account, and any behavioral profile built from your communication habits. If a company ignores a proper request, the state attorney general can bring an enforcement action.
If a provider handles data belonging to people in the European Union, the General Data Protection Regulation applies. GDPR’s “right to be forgotten” lets you demand erasure when the data is no longer needed for its original purpose, when you withdraw consent, or when it was processed unlawfully.7General Data Protection Regulation. Article 17 GDPR – Right to Erasure (Right to Be Forgotten) An organization without a legitimate legal basis for keeping the data has to comply without undue delay.8European Commission. Do We Always Have to Delete Personal Data if a Person Asks
GDPR is also where the largest fines live. Violations of data subject rights can trigger administrative fines of up to €20 million or 4% of the company’s worldwide annual revenue, whichever is higher. Lower-tier violations, like inadequate record-keeping or weak security, can bring up to €10 million or 2% of global revenue.9General Data Protection Regulation. Article 83 GDPR – General Conditions for Imposing Administrative Fines
Email on Your Employer’s System
Your privacy in workplace email is thin. Most companies require employees to acknowledge a policy that says corporate messages may be monitored, and courts treat that acknowledgment as consent. Once consent exists, the employer can review messages for legitimate business reasons like investigating misconduct, checking compliance, or protecting trade secrets.
Federal law backs this up through two exceptions in the Electronic Communications Privacy Act. The consent exception makes monitoring lawful when you’ve agreed to it through a workplace policy. The ordinary course of business exception permits monitoring of company-owned equipment when it serves a legitimate business purpose, happens as part of routine operations, and employees have been notified. Employers who own the servers and devices generally win these disputes.
A harder question comes up when you log into a personal webmail account on a work computer. Monitoring software may capture that activity, but the protections for a personal account are stronger. If you never consented to monitoring of private accounts and the employer isn’t acting within the ordinary course of business, deliberately reading those messages can support claims for invasion of privacy or violations of computer fraud statutes. The working rule: assume the company can see anything you type on its device, but its right to actively pry into your personal accounts is much narrower.
Encryption Requirements in Healthcare and Finance
Two industries face specific rules about encrypting sensitive email.
HIPAA and Health Information
The HIPAA Security Rule at 45 CFR § 164.312(e)(1) requires covered entities and their business associates to implement technical safeguards protecting health information during electronic transmission.10eCFR. 45 CFR 164.312 – Technical Safeguards Encryption is the standard way to meet that requirement, though the rule is written broadly enough to allow equivalent protections.
Civil penalties are tiered by culpability and adjusted for inflation each year. As of 2026, an unknowing violation starts at $145, and a violation caused by willful neglect that goes uncorrected carries a minimum of $73,011 per violation, with a calendar-year cap of $2,190,294.11Federal Register. Annual Civil Monetary Penalties Inflation Adjustment The base statutory tiers in 42 U.S.C. § 1320d-5 run from $100 to $50,000, but enforcers apply the inflation-adjusted numbers.12GovInfo. 42 U.S.C. 1320d-5 – General Penalty for Failure to Comply with Requirements and Standards
Gramm-Leach-Bliley and Financial Data
The Gramm-Leach-Bliley Act requires financial institutions to protect the security and confidentiality of customers’ nonpublic personal information, including account numbers and tax records sent electronically. Under 15 U.S.C. § 6801, each institution has a continuing obligation to maintain administrative, technical, and physical safeguards against unauthorized access to customer records.13Office of the Law Revision Counsel. 15 U.S.C. 6801 – Protection of Nonpublic Personal Information Federal regulators set specific standards for the institutions they oversee, and any firm emailing sensitive customer data in practice needs encryption or an equivalent control to keep the contents unreadable in transit.
What Happens When Your Email Is Breached
All 50 states, the District of Columbia, and U.S. territories require companies to notify individuals when unencrypted personal information is compromised. There is no single federal breach notification law covering most industries, so the specifics depend on where the affected people live. The pattern is consistent even if the details vary.
Notification is generally triggered when an unauthorized person acquires personal information that includes an email address combined with a password, security question, or other credentials that would allow access to the account. Timelines usually fall between 30 and 60 days from discovery, sometimes shorter when large numbers of residents are affected. In several states, breaches touching more than 500 residents also require a separate report to the state attorney general.
The notice itself is regulated too. Most statutes require it to describe the type of information involved, the approximate date of the breach, and the steps the company is taking. Many require information about credit monitoring or identity theft prevention resources.
Penalties for late or missing notice vary. Some state privacy laws allow affected consumers to recover statutory damages of $100 to $750 per person per incident, without proof of actual financial loss. Class actions and attorney general investigations often produce settlements well above those minimums.
When Email Has to Be Preserved for Litigation
Once a lawsuit is filed or reasonably anticipated, every party has a duty to preserve relevant evidence, and email is nearly always in scope. That covers the messages, attachments, and metadata like timestamps and routing information. Federal courts treat email as electronically stored information under the Federal Rules of Civil Procedure, and the duty to preserve begins as soon as litigation becomes foreseeable.
Organizations usually meet that duty with a litigation hold, a written directive telling employees to stop deleting relevant messages and to suspend automated retention policies that would destroy them. The hold has to be specific enough to identify which custodians and document types are covered, but it doesn’t require preserving every message ever sent. Scope is guided by what is reasonably relevant to the claims and defenses at issue. Rule 26 requires each party to disclose documents and electronically stored information it may use to support its claims or defenses.14Legal Information Institute. Federal Rules of Civil Procedure Rule 26
Rule 37(e) governs what happens when electronically stored information is lost because a party failed to take reasonable steps to preserve it and the data can’t be recovered elsewhere. If the loss merely prejudices the other side, the court can order curative measures like additional discovery. If the court finds intentional destruction meant to deprive the other side of the evidence, the consequences escalate: the court may instruct the jury to presume the missing emails were unfavorable, or it may dismiss the case or enter a default judgment.15Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions Intentional spoliation of email evidence is one of the fastest ways to lose a case you might otherwise have won.