CLOUD Act

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is the 2018 US law that requires providers of electronic communication and remote computing services subject to US jurisdiction to preserve and disclose data in their possession, custody or control in response to lawful US process, regardless of whether the data is stored inside or outside the United States.

It also authorizes executive agreements with foreign governments for reciprocal access.

The disclosure obligation is codified at 18 U.S.C. § 2713: a provider "shall comply with the obligations of this chapter to preserve, backup, or disclose" data "regardless of whether such communication, record, or other information is located within or outside of the United States" (Cornell LII, 18 U.S.C. § 2713). The act was enacted on 23 March 2018 as part of the Consolidated Appropriations Act, and the Department of Justice maintains a resource page on it and on the executive agreements with the UK and Australia (US Department of Justice, CLOUD Act resources).

The act matters to European ad tech buyers because it makes the operator's nationality, not the server's location, the question. A US-headquartered cloud, DSP, SSP or clean-room vendor holding an EU retailer's loyalty data in an EU region is within reach of § 2713; GDPR Article 48 says the EU does not recognise such orders absent an international agreement, which leaves the vendor between two laws and the customer uncertain (EUR-Lex, Regulation (EU) 2016/679). The responses are the sovereign-cloud structures, encryption with customer-held keys, and operating the stack under an EU-controlled entity; the trade-offs are discussed in EU sovereign ad tech stack.

Example: a US-based clean-room vendor hosts an EU grocer's hashed loyalty table in Dublin; a US court orders the vendor to produce it; the vendor's possession is what § 2713 reaches, so the grocer's residency choice does not protect the table. Had the match run in the grocer's own environment and only aggregates left, there would be nothing in the vendor's possession.

Related: data sovereignty, data residency, clean room, GLBA.

Source: 18 U.S.C. § 2713; US Department of Justice CLOUD Act resources; Regulation (EU) 2016/679, Article 48.

1. Cornell LII, 18 U.S.C. § 2713
2. US Department of Justice, CLOUD Act resources
3. EUR-Lex, Regulation (EU) 2016/679