Police asked for a member's data? How the Stored Communications Act applies to forums
Sooner or later, many forum owners get an email or letter from a police department asking for a member's IP address, email or private messages. The federal Stored Communications Act (part of 18 U.S.C. chapter 121) sets rules for what services that offer communications to the public can hand over voluntarily and what the government needs to compel it. Knowing the basics helps you respond correctly instead of guessing.
- Services open to the public generally can't voluntarily give the government member records or message contents, with listed exceptions such as consent and genuine emergencies.
- Basic subscriber info can be compelled with a subpoena; other records need a court order or warrant; contents generally need a warrant.
- A preservation request means keep the data for 90 days (renewable), not hand it over.
What you can't do: volunteer it
Under 18 U.S.C. 2702, Voluntary disclosure of customer communications or records, a provider of an electronic communication service to the public "shall not knowingly divulge" the contents of a communication in electronic storage, and a provider "shall not knowingly divulge a record or other information pertaining to a subscriber... to any governmental entity." Private messages and member records are exactly the kind of data this covers. Whether your specific forum counts as a covered provider is a legal question, so treat requests as if it does until a lawyer tells you otherwise.
The exceptions
The same section lists when disclosure is allowed. For message contents, exceptions include the intended recipient, the originator's or recipient's lawful consent, what's "necessarily incident" to running the service or protecting your rights or property, reports to the National Center for Missing and Exploited Children under section 2258A, and disclosure to a government entity if you believe "in good faith" that "an emergency involving danger of death or serious physical injury to any person requires disclosure without delay." Similar exceptions apply to non-content records, which can also be shared with non-government parties.
What the government needs to compel it
18 U.S.C. 2703, Required disclosure of customer communications or records sets tiers:
| What they want | Typical legal process |
|---|---|
| Basic subscriber info: name, address, session times, length of service, assigned IP address, means and source of payment | Administrative, grand jury or trial subpoena |
| Other non-content records (for example, detailed logs) | Court order under 2703(d), a warrant, or the member's consent |
| Message contents (private messages, drafts) | Generally a warrant; some stored categories can be reached by subpoena or court order with notice to the member |
Preservation requests: under 2703(f), on a government request you must "take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process." Retention is 90 days, extended another 90 days on a renewed request. Preserve means freeze a copy; don't disclose until you get proper process.
A simple response process
- Verify the request. Call the agency back at a number you look up yourself, not the one in the email. Fake "emergency" requests are a known tactic.
- Identify the type: preservation letter, subpoena, court order, warrant or emergency request.
- Preserve the specific account's data (posts, PMs, IP logs) if asked, and log the date.
- Disclose only what the process covers, nothing extra.
- Keep a record of every request and what you provided.
- Write a short policy in your privacy page about how you handle legal requests (see forum privacy basics), and keep log retention reasonable; you can't hand over data you don't keep.
Related: Section 230 for forum owners and DMCA designated agents.
General information, not legal advice. If you receive legal process, talk to a lawyer before you respond.
Published October 29, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.