The CLOUD Act (2018): a US warrant can reach your files wherever they sit

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted in March 2018, amended the Stored Communications Act to settle a question the courts had been wrestling with: can US law enforcement compel a US company to hand over data the company stores on servers abroad? The Act's answer is yes. It applies to any electronic-communication or remote-computing service that operates or has a legal presence in the United States — a description that fits Dropbox exactly.

The law was prompted by a multi-year fight in which Microsoft refused an SCA warrant for emails it stored in Ireland; Congress mooted the case by passing the CLOUD Act. For a US-headquartered provider, the practical effect is that the physical location of a data center no longer shields the data inside it. A non-US Dropbox user whose files happen to live on European infrastructure is not, by that fact, beyond the reach of a US warrant served on Dropbox.

The Act preserves certain safeguards — a warrant is still required for the content of communications — and creates a framework for bilateral 'executive agreements' letting partner governments make reciprocal demands. But the core shift is jurisdictional: control by a US entity, not the data's geography, determines reachability.