Does the US CLOUD Act apply to data stored in the EU?
Yes, when the company that holds the data is subject to US jurisdiction. The US CLOUD Act requires providers to disclose data within their “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. § 2713). The location of the server does not decide whether US law enforcement can demand the data. Control over the data does.
What the CLOUD Act is
The Clarifying Lawful Overseas Use of Data Act became law on 23 March 2018. It amended the Stored Communications Act after a dispute over Microsoft’s refusal to hand over emails stored in Ireland, which the US Supreme Court then dismissed as moot. The act has two parts:
- Section 2713 makes US warrants, subpoenas and court orders for stored data apply to data held abroad.
- Executive agreements under 18 U.S.C. § 2523 let partner countries request data directly from US providers, and give providers a statutory route to object when a US order conflicts with that partner’s law.
The CLOUD Act is a criminal law enforcement tool. Foreign intelligence collection runs under a different law, Section 702 of the Foreign Intelligence Surveillance Act (FISA), which was central to the Schrems II judgment and to the debate over whether EU companies can use US cloud providers.
Who it applies to
The act applies to providers of electronic communication services and remote computing services that US courts have jurisdiction over. The US Department of Justice’s CLOUD Act white paper (April 2019) makes three points that matter for EU customers:
- Jurisdiction is not tied to nationality. “U.S. jurisdiction is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons.” A non-US company with enough business directed into the United States can be subject to it.
- Subsidiaries are a question of control. For data held by a non-US subsidiary of a US company, “whether a company exercises sufficient control over data held by a subsidiary is a fact-dependent inquiry.” An EU subsidiary of a US group is not automatically outside the act’s reach.
- The act is encryption neutral. It “does not create any new authority for law enforcement to compel service providers to decrypt communications.” A provider that holds only ciphertext can disclose only ciphertext.
Can a provider refuse?
A provider can file a motion to quash or modify a request within 14 days if the customer is not a US person and disclosure would create “a material risk that the provider would violate the laws of a qualifying foreign government” (18 U.S.C. § 2703(h)). A qualifying foreign government is one with an executive agreement in force.
As of November 2026, the Department of Justice lists agreements with the United Kingdom and Australia only. EU-US negotiations began in September 2019 and resumed in March 2023 without an agreement. EU member states are therefore not qualifying foreign governments, and the statutory motion is not available on the grounds of EU law. Providers can still raise common-law comity arguments, but the court decides.
How it collides with the GDPR
Article 48 of the GDPR states that a third-country court order or administrative decision requiring a controller or processor to disclose personal data “may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty”. A provider served with a CLOUD Act warrant for EU personal data can face a breach of US law if it refuses and a breach of the GDPR if it complies. The European Data Protection Board and the European Data Protection Supervisor made this point in their joint response on the CLOUD Act in July 2019.
Providers confirm the conflict in public. In a French Senate inquiry on 10 June 2025, the rapporteur asked Microsoft France’s director of public and legal affairs whether he could guarantee under oath that French citizens’ data would never be transmitted to US authorities without French consent. He answered: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit” (“No, I cannot guarantee it, but, again, it has never happened yet”), according to the Senate record.
What reduces exposure and what does not
| Measure | Effect on CLOUD Act exposure |
|---|---|
| EU region of a US provider | None. Location is irrelevant under § 2713. |
| EU subsidiary of a US provider | Unclear. Depends on how much control the US parent has over the data. |
| Provider with no US presence or US parent | Removes direct reach, as long as its sub-processors are also outside US jurisdiction. |
| Encryption with keys held outside the provider | The provider can be compelled to disclose only ciphertext. |
| Confidential computing | Reduces the operator’s ability to read data in memory while it is processed. |
| Contract terms to challenge requests and notify you | Procedural protection. They do not change what US law requires. |
None of these measures is a legal opinion on a specific setup. Teams usually combine an operator outside US jurisdiction for sensitive systems with customer-held keys, and map every sub-processor in the chain. The difference between storing data in the EU and keeping it under EU law is explained in data sovereignty vs data residency, and what is a sovereign cloud covers how providers address it.
How Cloudfleet addresses it
Cloudfleet hosts control planes on Google Cloud, and its Security and data protection page states that this infrastructure provider can receive requests under laws such as the US CLOUD Act. With Confidential Control Plane on Enterprise clusters, the keys that encrypt cluster data stay in your own HSM or cloud KMS, so the infrastructure provider holds no key that can decrypt it. Cloudfleet challenges unclear or overly broad requests and notifies you before disclosing anything, unless the law prohibits it.