What the CLOUD Act is
The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was signed into US law on 23 March 2018 as part of the Consolidated Appropriations Act, 2018. It amended the Stored Communications Act.
Its core rule (18 U.S.C. § 2713): providers of electronic communication and remote computing services must disclose data within their possession, custody or control when served with a valid US warrant or order – regardless of whether the data is located within or outside the United States.
The law also allows the US government to conclude executive agreements with other states so that their authorities can request data directly from US providers, and gives providers a limited way to challenge orders that conflict with the law of such a partner state.
Why it matters in the EU
The CLOUD Act links access to the provider, not to the server location. Data stored in an EU data centre can therefore be covered if a provider subject to US jurisdiction controls it – for example through a US parent company.
The GDPR addresses this in Article 48: a judgment or decision of a third-country court or authority requiring a transfer of personal data is only recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty. That conflict of laws is one reason why the question "which law applies to my provider?" has become part of digital sovereignty.
What you can check
- Where is the provider based, and where is its parent company?
- Which subprocessors are subject to US jurisdiction, and what data do they see?
- Is content encrypted in a way the provider cannot read (end-to-end), or only at rest?
- How does the provider handle requests from authorities?
Coviqo is operated from Luxembourg and stores content on servers in Germany. The US companies involved – for network protection and payments – are named with what they process on Why a European collaboration platform.
This page is general information, not legal advice.
Frequently asked questions
Does the CLOUD Act apply to European companies?
It applies to providers subject to US jurisdiction. Whether a European company falls under it depends on its ties to the USA, for example a US parent company or a US branch – this has to be assessed case by case.
Does storing data in the EU protect it from the CLOUD Act?
Not on its own. What counts is whether a provider under US jurisdiction has possession, custody or control of the data.