How law enforcement gets your Twitter data is governed by the Stored Communications Act (SCA), part of the federal Electronic Communications Privacy Act.1Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA) The legal instrument an agency needs depends on what they’re after: a search warrant backed by probable cause for the content of your messages and posts, a court order for detailed account activity, or a subpoena for basic subscriber information. Each tier reflects a judgment by the drafters that some categories of data deserve stronger privacy protection than others, and X (formerly Twitter) applies that framework when responding to government requests.
What X Actually Stores About You
The SCA splits your data into two categories, and the split determines what the government has to do to get it.
Non-content data is the account-level information that identifies you and tracks how you use the service: your name, email address, phone number, account creation date, login and logout IP addresses, session durations, and payment information.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records For investigators, this is the data that links a pseudonymous handle to a real person or establishes when and where someone logged in.
Content data is the substance of what you say and share. Direct Messages, non-public posts, saved drafts, uploaded photos and videos, and metadata like message recipients, timestamps, and location tags all fall here. The SCA treats content as far more sensitive than subscriber records, and the legal bar is correspondingly higher.1Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
One detail worth knowing: deleting a Direct Message removes it from your view, but that does not necessarily purge it from the platform’s servers. Security researchers have recovered deleted DMs dating back years. If your account becomes the subject of a request, data you thought was gone may still be retrievable.
The Three Legal Standards for Getting Your Data
Law enforcement cannot just ask the platform for whatever they want. The legal instrument has to match the type of data.
Search Warrant for Message Content
Reading your Direct Messages, viewing non-public posts, or accessing your uploaded media requires a search warrant issued by a judge and supported by probable cause. The judge has to find a reasonable basis to believe the specific data contains evidence of a crime.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Probable cause is the highest legal standard the government must meet for stored electronic data.
The statute technically distinguishes between content stored for 180 days or less (which requires a warrant) and content stored longer (which could in theory be obtained with a court order or subpoena plus notice). In practice that distinction has largely collapsed. The Supreme Court’s 2018 decision in Carpenter v. United States reinforced that digital records held by third parties can still carry strong Fourth Amendment protection, and the Court explicitly said law enforcement should “get a warrant” for sensitive records.3Supreme Court of the United States. Carpenter v United States, 585 US 296 (2018) Major platforms, including X, generally require warrants for all content regardless of age.
Court Order for Detailed Account Activity
Non-content records that go beyond basic identity sit in a middle tier. Login history, session times, message recipient logs, and similar transactional records require a court order under 18 U.S.C. § 2703(d). To get one, law enforcement must present “specific and articulable facts” showing reasonable grounds to believe the records are relevant and material to an ongoing criminal investigation.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records That sits between a subpoena and a full warrant. More than a hunch, less than probable cause.
Subpoena for Basic Subscriber Information
The lowest tier covers basic identifying information: name, address, phone connection records, length of service, payment method, and any subscriber number or temporarily assigned network address. A federal or state administrative subpoena, or a grand jury subpoena, is enough.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Administrative subpoenas do not require a judge’s advance approval. Certain federal officials, including the Attorney General investigating healthcare fraud or child exploitation, can issue them directly.4Office of the Law Revision Counsel. 18 USC 3486 – Administrative Subpoenas Grand jury subpoenas come from a sitting grand jury during an active criminal investigation.
Preservation Requests: Freezing Your Data Before Any Warrant Arrives
Before an agency has its warrant or court order in hand, it can ask X to freeze the data in place so nothing gets deleted in the meantime. Under 18 U.S.C. § 2703(f), a government agency can require a provider to preserve all records and evidence tied to a specific account while the agency works to secure formal legal process.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
The platform must retain the preserved data for 90 days. A renewed request extends that by another 90 days.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records A preservation request does not give the government access to anything. It simply prevents routine deletion. The government still needs the appropriate warrant, court order, or subpoena to actually obtain the records.
Emergency Disclosure Requests: No Court Involvement
Not every situation allows time to get a warrant. When someone’s life is at risk, law enforcement can submit an Emergency Disclosure Request (EDR), and the platform can hand over data immediately without any court involvement. The legal basis is 18 U.S.C. § 2702, which permits (but does not require) a provider to voluntarily disclose both content and non-content data if it has a good-faith belief that an emergency involving danger of death or serious physical injury requires disclosure without delay.5Office of the Law Revision Counsel. 18 US Code 2702 – Voluntary Disclosure of Customer Communications or Records
The word that matters is “voluntarily.” Unlike a warrant, an EDR does not compel the platform to do anything. X’s legal team evaluates whether the claimed emergency is credible before deciding to disclose. In genuine emergencies, this typically means sharing location data or recent communications needed to locate an endangered person.
EDR abuse has become a growing concern. Bad actors, including hackers impersonating law enforcement, have submitted fraudulent emergency requests to trick platforms into releasing user data. Law enforcement agencies are expected to follow up an emergency disclosure with formal legal process such as a warrant, which provides after-the-fact judicial oversight. Submitting a false emergency request exposes the person responsible to serious federal criminal liability.
National Security Letters
Separate from the standard SCA framework, the FBI can issue National Security Letters (NSLs) under 18 U.S.C. § 2709 to obtain limited subscriber data for counterterrorism and counterintelligence investigations. An NSL can compel a provider to disclose a user’s name, address, length of service, and toll billing or connection records.6Office of the Law Revision Counsel. 18 US Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records
Two features set NSLs apart. First, they do not require a judge’s approval. The FBI Director or a designated senior official can issue one by certifying in writing that the records are relevant to an authorized national security investigation. Second, NSLs come with a built-in gag order: the platform generally cannot tell the user or anyone else that the FBI sought their records.6Office of the Law Revision Counsel. 18 US Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records NSLs cannot be used to obtain the content of communications. They are limited to identifying information and transactional records.
Foreign Governments Cannot Go Directly to X
Because X is a U.S.-based company, foreign governments cannot directly compel it to hand over user data. They route requests through the U.S. Department of Justice’s Office of International Affairs under a Mutual Legal Assistance Treaty. For content, the foreign government must show dual criminality (the conduct is a crime in both countries) and probable cause. For subscriber and transactional records, the standard mirrors the domestic court-order requirement.7U.S. Department of Justice. Frequently Asked Questions Regarding Legal Assistance in Criminal Matters
The 2018 Clarifying Lawful Overseas Use of Data (CLOUD) Act created a faster alternative. Under 18 U.S.C. § 2523, qualifying foreign governments can enter executive agreements with the United States that let them issue orders directly to U.S.-based providers. As of early 2025, the United States has completed executive agreements with the United Kingdom and Australia, with negotiations ongoing with Canada and the European Union. The CLOUD Act also clarified that U.S. warrants reach data a provider controls regardless of where the data is physically stored.
Will X Tell You Before Handing Over Your Data?
X’s stated policy is to notify affected users about government data requests before disclosing any information, giving the user a window to consult a lawyer or challenge the request in court. In many cases that notification never arrives on time, because the legal process came with a non-disclosure order.
Under 18 U.S.C. § 2705, a court can order the platform to stay silent if notification would endanger someone’s safety, lead to flight from prosecution, result in evidence destruction, intimidate witnesses, or otherwise seriously jeopardize the investigation.8Office of the Law Revision Counsel. 18 USC 2705 – Delayed Notice These orders are common. The platform must comply and release the data without telling the user. Once the order expires or is lifted, the platform will then notify the user that their data was previously disclosed.
Before disclosing anything, X’s legal team reviews whether the request is accompanied by the correct legal instrument, whether it was properly served, and whether it is narrowly tailored rather than a fishing expedition. If a court order is overbroad or unduly burdensome, the platform can ask the issuing court to quash or narrow it.2Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records
What You Can Do If Your Data Is Requested
If you learn that a government agency has requested your data, you can file a motion to quash or modify the subpoena or court order. Common grounds include that the data sought is not relevant to the investigation, that the request is too vague or broad, or that the legal process is otherwise unlawful or unduly burdensome.
The practical difficulty is timing. If the request came with a non-disclosure order, you will not learn about it until after disclosure has already happened. At that point a motion to quash is moot for the data already handed over, though it may still matter for suppressing the evidence in a criminal proceeding.
Do not expect to sue the platform. Under 18 U.S.C. § 2707, good-faith reliance on a court warrant, court order, grand jury subpoena, or statutory authorization is a complete defense against any civil or criminal action.9Office of the Law Revision Counsel. 18 US Code 2707 – Civil Action If X discloses your data in response to what appears to be valid legal process, you generally cannot sue the platform, even if the underlying request later turns out to have been flawed.
One place to push back is location data. X collects location metadata when users enable location services on posts or share geotagged media. After Carpenter v. United States, law enforcement requesting granular location records should be arriving with a warrant supported by probable cause, not a § 2703(d) court order.3Supreme Court of the United States. Carpenter v United States, 585 US 296 (2018) Any request that tries to obtain such data under the lower standard is vulnerable to a suppression challenge in the resulting prosecution.