What Is the ECPA? Electronic Communications Privacy Act
Independently fact-checked against primary sources (last audited August 24, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 24, 2026. · 5 primary sources cited on this page. How we verify our legal content
The ECPA is the Electronic Communications Privacy Act of 1986, Pub. L. 99-508, the federal law that sets baseline rules for intercepting phone calls, emails, and other electronic communications in the United States. It has three titles: the Wiretap Act, the Stored Communications Act, and the pen register statute.
Information last verified on 2026-07-08. This article has not yet been reviewed by a licensed lawyer.
What does ECPA stand for?
ECPA stands for the Electronic Communications Privacy Act of 1986, Pub. L. 99-508. Congress passed it to extend the older 1968 Wiretap Act, which had covered wire and oral communications like phone calls, to the newer world of email, pagers, and computer-to-computer data transmission. It did that by amending the existing Wiretap Act and adding two entirely new sets of rules, the Stored Communications Act and the pen register statute, so that "ECPA" today refers to a package of three related but distinct laws codified at 18 U.S.C. §§ 2510-2523, 2701-2713, and 3121-3127.
What does the ECPA actually do?
ECPA is not a single rule. It has three titles, and knowing which one applies to a given fact pattern is the key to using it correctly.
- Title I, the Wiretap Act (18 U.S.C. §§ 2510-2523). Prohibits intentionally intercepting a wire, oral, or electronic communication while it is being transmitted, in real time. This is the part of ECPA people usually mean when they ask "is it legal to record this conversation."
- Title II, the Stored Communications Act (18 U.S.C. §§ 2701-2713). Prohibits intentionally accessing a stored communication, such as an email sitting in an inbox or a voicemail, without authorization. It also sets the process the government must follow to compel a provider to disclose stored content. See our Stored Communications Act Explained for the full depth on this title.
- Title III, pen register and trap-and-trace (18 U.S.C. §§ 3121-3127). Regulates devices or processes that capture dialing, routing, addressing, or signaling metadata about a communication, not its content. Installing one without a court order is a federal crime under 18 U.S.C. § 3121.
Who has to follow the ECPA?
ECPA binds everyone: private individuals, businesses, communications providers, and the government, though each faces different rules under it. A private individual recording their own conversation is governed by the one-party consent rule in 18 U.S.C. § 2511(2)(d). A communications provider, an email host or a phone carrier, gets a narrower exception under 18 U.S.C. § 2511(2)(a)(i) to monitor its own network for abuse, fraud, or service delivery, but cannot sell communication content to third parties under that exception. Government investigators face the strictest rules of all: intercepting a live communication requires a Title III super-warrant under 18 U.S.C. §§ 2516-2518, while compelling a provider to hand over stored data follows the tiered warrant, court-order, and subpoena framework set out in 18 U.S.C. § 2703.
The ECPA's most important rule: one-party consent
For most everyday recording questions, the rule that matters is 18 U.S.C. § 2511(2)(d): a participant in a phone call, in-person conversation, or video call may record it without telling the other participants, unless the recording is made for the purpose of committing a crime or a tort. That is a federal floor, not a ceiling, so it applies everywhere in the United States unless a stricter state law displaces it for in-state recordings. Roughly 12 states, including California under its Invasion of Privacy Act, require the consent of every party instead. The full penalty structure, the tortious-purpose exception, and how the federal floor interacts with those stricter state laws are covered in depth in Federal Wiretap Act and ECPA: The Complete Guide (2026).
Is the ECPA the same as HIPAA or GDPR?
No. ECPA is a US federal statute about intercepting and accessing communications; it predates HIPAA (health-information privacy, 1996) and the EU's GDPR (data protection, 2018) and addresses a narrower problem. HIPAA governs how covered health entities handle protected health information. GDPR is a European data-protection regulation with no direct US analogue. ECPA does not regulate general data collection; it targets interception of communications in transit and unauthorized access to communications already in storage.
Disclaimer
This article provides general legal information about the Electronic Communications Privacy Act of 1986, Pub. L. 99-508, as verified on 2026-07-08. It does not constitute legal advice and does not create an attorney-client relationship. Readers should consult a lawyer licensed in their jurisdiction before recording a conversation or accessing stored communications.
Related articles
- Federal recording laws: the complete hub
- Federal Wiretap Act and ECPA: The Complete Guide (2026)
- Stored Communications Act Explained
- One-party consent states: full list and rules
Last updated: 2026-07-08. Statutes cited reflect their in-force version as of 2026-07-08.
Frequently Asked Questions
What does ECPA stand for?
ECPA stands for the Electronic Communications Privacy Act of 1986, Pub. L. 99-508. It is the federal law that governs intercepting live communications, accessing stored communications, and installing pen register or trap-and-trace devices in the United States.
When was the ECPA passed?
Congress enacted the Electronic Communications Privacy Act on October 21, 1986, as Pub. L. 99-508. It amended the 1968 Wiretap Act and added the Stored Communications Act and the pen register statute as new titles.
Does the ECPA apply to text messages?
Yes, in two different ways depending on timing. A text message intercepted while it is being transmitted falls under the Wiretap Act, 18 U.S.C. 2510-2523. A text message already delivered and sitting on a phone or with a carrier falls under the Stored Communications Act, 18 U.S.C. 2701-2713, if someone accesses it without authorization.
What is the difference between the ECPA and the Wiretap Act?
The Wiretap Act is one part of the ECPA, specifically Title I, codified at 18 U.S.C. 2510-2523. The ECPA as a whole also includes Title II, the Stored Communications Act, and Title III, the pen register and trap-and-trace statute. People often use 'ECPA' and 'Wiretap Act' interchangeably, but the Wiretap Act is narrower.
Does the ECPA apply outside the United States?
The ECPA is a US federal statute and its core prohibitions apply to conduct and communications connected to the United States. Cross-border data requests to US providers are also addressed by the CLOUD Act, enacted in 2018, which amended the Stored Communications Act at 18 U.S.C. 2713 to address preservation and disclosure of data regardless of where it is stored.
What happens if someone violates the ECPA?
It depends on which title. A Wiretap Act violation is a federal felony punishable by up to five years under 18 U.S.C. 2511, plus civil damages with a $10,000 per-violation floor under 18 U.S.C. 2520. A Stored Communications Act violation carries criminal penalties under 18 U.S.C. 2701(b) and a separate civil remedy with a $1,000 floor under 18 U.S.C. 2707.
Updates
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
United States Code Title 18
§ 2510DefinitionsIn forcecited in 126 of our articles
As used in this chapter— “wire communication” means any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception (including the use of such connection in a switching station) furnished or operated by any person engaged in providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce; “oral communication” means any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation, but such term does not include any electronic communication; “State” means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, and any territory or possession of the United States; “intercept” means the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.1 So in original. The period probably should be a semicolon.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 2,382 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):United States v. New York Telephone Co. (1977) held that pen registers fall outside Title III because they do not acquire the contents of a communication as Section 2510(4) and (8) define interception. Forsyth v. Barr (1994) applied the same definitions, treating the defendant officers as law enforcement officers under Section 2510(7).
Opinions citing this section in our collection:
- Forsyth v. Barr (Court of Appeals for the Fifth Circuit 1994, 19 F.3d 1527)✓Neighbors tapped an informant's home line and the overheard charges reached Dallas internal affairs; the Fifth Circuit saw no evidence the police defendants intercepted anything and held they were 2510(7) law enforcement officers, so 2517(1) and (2) allowed their use of it.
- Nixon v. Administrator of General Services (Supreme Court of the United States 1977, 433 U.S. 425)“…of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U. S. C. §§ 2510 et seq. 408 F. Supp., at 363 . We…”
- Gannett Co. v. DePasquale (Supreme Court of the United States 1979, 443 U.S. 368)“…of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U. S. C. § 2510 et seq., be preserved prior to the d…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2511Interception and disclosure of wire, oral, or electronic communications prohibitedIn forcecited in 418 of our articles
Except as otherwise specifically provided in this chapter any person who— intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication when— such device is affixed to, or otherwise transmits a signal through, a wire, cable, or other like connection used in wire communication; or such device transmits communications by radio, or interferes with the transmission of such communication; or such person knows, or has reason to know, that such device or any component thereof has been sent through the mail or transported in interstate or foreign commerce; or such use or endeavor to use (A) takes place on the premises of any business or other commercial establishment the operations of which affect interstate or foreign commerce; or (B) obtains or is for the purpose of obtaining information relating to the operations of any business or other commercial establishment the operations of which affect interstate or foreign…
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 2,045 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Griggs-Ryan v. Smith (1990) applied the Section 2511(2)(d) prior-consent exception, treating a tenant repeatedly told that all incoming calls were taped as having impliedly consented. United States v. United States District Court (1972) read the then-current Section 2511(3) as conferring no presidential surveillance power.
Opinions citing this section in our collection:
- Mitchell v. Forsyth (Supreme Court of the United States 1985, 472 U.S. 511)✓The Attorney General authorized a warrantless 1970 national security wiretap that caught the plaintiff's calls; the Court held the since-repealed Section 2511(3) disclaimer left the tap lawful under Title III, and that Mitchell had qualified immunity.
- United States v. United States District Court for the Eastern District of Michigan (Supreme Court of the United States 1972, 407 U.S. 297)✓The Attorney General approved warrantless wiretaps on members of a domestic group accused of bombing a CIA office; the Court read Section 2511(3) as a congressional disclaimer conferring no surveillance power, then held the Fourth Amendment required prior judicial approval.
- Forsyth v. Barr (Court of Appeals for the Fifth Circuit 1994, 19 F.3d 1527)✓Dallas police used, in an internal affairs probe of an officer, calls private parties allegedly intercepted illegally; assuming that was unlawful, the Fifth Circuit held Section 2517(1) and (2) allowed the disclosure and use, defeating the Section 2511(1)(c) and (d) claims.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2520Recovery of civil damages authorizedIn forcecited in 115 of our articles
Except as provided in section 2511(2)(a)(ii), any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate. In an action under this section, appropriate relief includes— such preliminary and other equitable or declaratory relief as may be appropriate; damages under subsection (c) and punitive damages in appropriate cases; and a reasonable attorney’s fee and other litigation costs reasonably incurred.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 860 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Walker v. Darby (1990) held a 2520 plaintiff need not prove the contents of intercepted conversations, only interception and a justified expectation against it. Bartnicki v. Vopper (2001) barred 2520 damages against defendants who took no part in the interception, obtained the tape lawfully, and disclosed a matter of public concern.
Opinions citing this section in our collection:
- Jessie Walker v. Thomas E. Darby, Hugh L. Robinson, Jr., and Kenneth Day (Court of Appeals for the Eleventh Circuit 1990, 911 F.2d 1573)✓A postal letter carrier said three supervisors wired an intercom near his workstation to listen in. Reversing summary judgment, the Eleventh Circuit held a section 2520 plaintiff can show interception without proving the contents of specific conversations.
- Gelbard v. United States (Supreme Court of the United States 1972, 408 U.S. 41)“…disclosure, or use is entitled to recover civil damages, 18 U. S. C. § 2520 . Title III also bars the use as eviden…”
- DirecTV, Inc. v. Hoa Huynh (Court of Appeals for the Ninth Circuit 2007, 503 F.3d 847)“…7 U.S.C. § 605 (e)(4), or alternatively, for violations of 18 U.S.C. § 2520 (a), or alternatively, for violations o…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2701Unlawful access to stored communicationsIn forcecited in 19 of our articles
Except as provided in subsection (c) of this section whoever— intentionally accesses without authorization a facility through which an electronic communication service is provided; or intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section. The punishment for an offense under subsection (a) of this section is— if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State— a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this subparagraph; and a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent offense under this subparagraph; and in any other case— a fine under this title or imprisonment for not more than 1 year or both, in the case of a first offense under this paragraph;…
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 724 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- United States v. Warshak (Court of Appeals for the Sixth Circuit 2010, 631 F.3d 266)“…ied in good faith on the Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701 et seq., a statute that allows the gove…”
- Guest v. Leis (Court of Appeals for the Sixth Circuit 2001, 255 F.3d 325)“…7 *340 In their brief, plaintiffs mention in passing 18 U.S.C. § 2701 , which prohibits intentional unlawful…”
- City of Ontario v. Quon (Supreme Court of the United States 2010, 560 U.S. 746)“…Raising claims under Rev. Stat. §1979, 42 U. S. C. §1983; 18 U. S. C. §2701 et seq., popularly known as the Stored…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2703Required disclosure of customer communications or recordsIn forcecited in 6 of our articles
A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures and, in the case of a court-martial or other proceeding under chapter 47 of title 10 (the Uniform Code of Military Justice), issued under section 846 of that title, in accordance with regulations prescribed by the President) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) of this section.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 776 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Carpenter v. United States (Supreme Court of the United States 2018, 585 U.S. 296)“…s were “relevant and material to an ongoing investigation.” 18 U. S. C. §2703(d). That showing falls well short of th…”
- United States v. Warshak (Court of Appeals for the Sixth Circuit 2010, 631 F.3d 266)“…e for 180 days or less “only pursuant to a warrant.” 18 U.S.C. § 2703(a). The government has three options fo…”
- Guest v. Leis (Court of Appeals for the Sixth Circuit 2001, 255 F.3d 325)“…communications and subscriber information, as set forth in 18 U.S.C. § 2703 (a), (b), and (c). Subsection (a) provi…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2707Civil actionIn forcecited in 3 of our articles
Except as provided in section 2703(e), any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate. In a civil action under this section, appropriate relief includes— such preliminary and other equitable or declaratory relief as may be appropriate; damages under subsection (c); and a reasonable attorney’s fee and other litigation costs reasonably incurred. The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000. If the violation is willful or intentional, the court may assess punitive damages.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 274 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Doe v. Chao (Supreme Court of the United States 2004, 540 U.S. 614)“…mmunications Privacy Act of 1986, § 201, 100 Stat. 1866 , 18 U. S. C. § 2707 (c). He contends that legislative histo…”
- Matthew Alexander v. Verizon Wireless Services, LL (Court of Appeals for the Fifth Circuit 2017, 875 F.3d 243)“…inal action brought under [the SCA] or any other law. 18 U.S.C. § 2707(e) (emphasis added). One such statutory…”
- Beaven v. United States Department of Justice (Court of Appeals for the Sixth Circuit 2010, 622 F.3d 540)“…tatutes, the Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2707(a) (granting relief to those “aggrieved…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2713Required preservation and disclosure of communications and recordsIn force
A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 2 court opinions in our collectionLatest citing opinion in our collection: 2018
Opinions citing this section in our collection:
- In re Leopold (Court of Appeals for the D.C. Circuit 2018, 327 F. Supp. 3d 1)“…tion is located within or outside of the United States" 18 U.S.C. § 2713 . The petitioners acknowledge the "con…”
- In Re in the Matter of the Application of Jason Leopold to Unseal Certain Electronic Surveillance Applications and Orders (District Court, District of Columbia 2018)“…is located within or outside of the United States” 18 U.S.C. § 2713. The petitioners acknowledge the “consid…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 3121General prohibition on pen register and trap and trace device use; exceptionIn forcecited in 2 of our articles
Except as provided in this section, no person may install or use a pen register or a trap and trace device without first obtaining a court order under section 3123 of this title or under the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or an order from a foreign government that is subject to an executive agreement that the Attorney General has determined and certified to Congress satisfies section 2523. The prohibition of subsection (a) does not apply with respect to the use of a pen register or a trap and trace device by a provider of electronic or wire communication service— relating to the operation, maintenance, and testing of a wire or electronic communication service or to the protection of the rights or property of such provider, or to the protection of users of that service from abuse of service or unlawful use of service; or to record the fact that a wire or electronic communication was initiated or completed in order to protect such provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful or abusive use of service; or (3) where the consent of the user of…
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 94 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- United States v. Aaron Graham (Court of Appeals for the Fourth Circuit 2016, 824 F.3d 421)“…installing a pen register or “trap and trace” device. See 18 U.S.C. § 3121 (a) (2012). Although Congress could und…”
- In Re the United States for an Order for Prospective Cell Site Location Information on a Certain Cellular Telephone (District Court, S.D. New York 2006, 460 F. Supp. 2d 448)“…of such information pursuant to the combined authority of 18 U.S.C. § 3121 et seq. (the “Pen Registe…”
- In Re US for an Order Aut. Dis. of Prosp. Cell (District Court, E.D. Wisconsin 2006, 412 F. Supp. 2d 947)“…ate a pen/trap order for such disclosure. See 18 U.S.C. §§ 3121 (a), 3127(3), and 3127(4). However, bec…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Electronic Communications Privacy Act of 1986, Pub. L. 99-508(congress.gov).gov
- 18 U.S.C. § 2510: ECPA Title I definitions(uscode.house.gov).gov
- 18 U.S.C. § 2511: Wiretap Act prohibition and one-party consent exception(uscode.house.gov).gov
- 18 U.S.C. § 2701: Stored Communications Act, ECPA Title II(uscode.house.gov).gov
- 18 U.S.C. § 3121: pen register and trap-and-trace prohibition, ECPA Title III(uscode.house.gov).gov