What Is the California Electronic Communications Privacy Act?

The California Electronic Communications Privacy Act, or CalECPA, requires California state and local law enforcement to obtain a probable-cause warrant before accessing your emails, text messages, location data, metadata, or the contents of your electronic devices. It also gives you the right to be notified when your data is accessed and lets you move to suppress evidence gathered in violation of the law. Signed on October 8, 2015 as Senate Bill 178, it closed gaps in the older federal Electronic Communications Privacy Act by treating nearly all digital information the same way, regardless of age, type, or where it is stored.

What Digital Information CalECPA Protects

CalECPA covers two broad buckets of data. The first is electronic communication information: the content of emails and text messages, plus metadata such as sender, recipients, timestamps, IP addresses, and the location of the sender or recipients at any point during the communication. The second is electronic device information: anything stored on or generated by a device, including its current and prior locations.¹

“Electronic device” is defined broadly as any device that stores, generates, or transmits information in electronic form. Phones, laptops, tablets, and cloud-connected gadgets all qualify. The only explicit carve-out is the magnetic strip on a California driver’s license or identification card. “Service provider” is also defined more broadly than under federal law, pulling in more companies and more categories of data.

Who CalECPA Applies To

CalECPA regulates government entities: any California state or local department, agency, or person acting on their behalf. Local police, sheriff’s deputies, and state investigators all fall under it.

Two important boundaries. First, the law does not restrict private companies from collecting or using your data on their own initiative; separate laws like the California Consumer Privacy Act handle that. Second, CalECPA does not bind federal agencies. If the FBI or DEA is the one seeking your data, they operate under federal law, which is considerably weaker on these protections. The Fourth Amendment still provides a baseline, but CalECPA’s specific warrant and notice rules do not apply to federal investigations.

The Warrant Rule and Its Narrow Exceptions

The core rule is direct. A California government entity cannot compel a service provider to hand over electronic communication information, and cannot access electronic device information, without a warrant based on probable cause.² Officers cannot bypass this by touching the device directly either. Physically interacting with or electronically communicating with a device to extract information requires a warrant.

A few other legal instruments can substitute for a search warrant in limited situations: a wiretap order, a pen register or trap-and-trace order, an order for electronic reader records under Civil Code Section 1798.90, or a subpoena issued under existing state law, but only if the subpoena is not being used to investigate or prosecute a criminal offense.² That subpoena limitation matters: it blocks the government from using civil process as a backdoor into criminal investigations.

The exceptions to the warrant requirement are specific and narrow:

Officers who believe in good faith that someone faces imminent danger of death or serious physical injury can access electronic device information without a warrant.
The authorized possessor of a device can consent to a search, but consent must be given specifically and directly to the government entity, not inferred from a general privacy policy or terms of service.²
The owner of a device reported lost or stolen can consent to a search even without current possession.
Officers who reasonably believe a device is lost, stolen, or abandoned may access it, but only to identify or contact the owner or authorized possessor.
The government can access location or telephone number information from a device to respond to a 911 call from that device.
Devices seized from inmates, or found where inmates have access, may be searched without a warrant.
Devices seized from people on parole, postrelease community supervision, or subject to electronic device search as a condition of probation, mandatory supervision, or pretrial release can be searched without a warrant.²

The emergency exception draws the most litigation. Officers need a genuine, good-faith belief that the emergency exists at the moment they act; after-the-fact rationalizations do not satisfy the statute. And even when officers act under an emergency exception, they still owe the target notice within three court days.

Your Right to Know Your Data Was Accessed

When a government entity executes a warrant or accesses information under the emergency exception, it must notify the person whose data was taken. The notice has to state that the information was compelled or obtained, describe the nature of the investigation with reasonable specificity, and include either a copy of the warrant or a written statement of the emergency facts. For warrants, notice happens at the same time the warrant is executed. For emergency access, notice must come within three court days.³

Investigators can ask a court to delay notification if tipping off the target would risk someone’s safety, cause flight from prosecution, lead to destruction of evidence, allow witness intimidation, or seriously jeopardize the investigation. The court must find reason to believe one of those consequences would actually follow, and any delay is capped at 90 days at a time. Further 90-day extensions are possible, but each requires a fresh court order.³

The practical effect: eventually, everyone whose data California authorities accessed will find out about it. Federal law offers nothing comparable in most situations.

What You Can Do If the Rules Are Broken

CalECPA has real enforcement teeth. If the government obtains electronic information in violation of the act or the Fourth Amendment, any person can move to suppress that evidence in a trial, hearing, or other proceeding. The motion follows the same procedures used for any suppression motion under California Penal Code Section 1538.5.⁴ Federal law generally does not allow suppression for a bare Stored Communications Act violation, so the state-law remedy is meaningful.

Suppression is not the only option. Individuals whose information is targeted by a warrant or legal process that violates the act can petition the court to void or modify the warrant, or to order the destruction of any information obtained unlawfully. Service providers who receive improper legal process can file the same kind of petition. The California Attorney General can also bring a civil action to force a government entity into compliance.⁴

How CalECPA Compares to Federal Privacy Law

The federal Stored Communications Act, part of the 1986 Electronic Communications Privacy Act, only requires a warrant for communications content stored 180 days or less on an electronic communications service. Older content, and most metadata including location data, can be obtained with a lesser court order or even a subpoena. CalECPA eliminates that split. It requires a warrant for all electronic communications content regardless of age, and extends the same warrant requirement to metadata and location data.⁵

Federal law also does not directly address device information, while CalECPA does. And the federal Stored Communications Act provides no statutory suppression remedy, while CalECPA provides a clear one.⁵ For someone living in California, that means police cannot quietly pull your emails from Google, your texts from your carrier, or your location history from your phone company without first convincing a judge there is probable cause, and if they do access your data, you have both a right to notice and a way to fight back.

1
California Legislative Information. California Penal Code 1546
2
California Legislative Information. California Penal Code – Title 12, Chapter 3.6
3
California Legislative Information. California Penal Code 1546.2
4
California Legislative Information. California Penal Code 1546.4
5
Berkeley Technology Law Journal. At the Privacy Vanguard: California’s Electronic Communications Privacy Act