Beyond US warrants: cross-border and foreign government data demands

Most discussion of Dropbox and government access focuses on US subpoenas, warrants, and national-security process, which Dropbox details in its transparency reports. But Dropbox serves users worldwide, and its data is therefore subject to a more complicated web of demands: requests from non-US governments, mutual legal-assistance treaty (MLAT) processes, and — since 2018 — the CLOUD Act, which both lets US authorities compel data stored abroad and creates a framework for certain foreign governments to seek data directly from US providers.

Dropbox's public reporting is comparatively thin on the international dimension: the volume, origin, and disposition of foreign-government demands are far less visible than the US figures, and the company holds the keys to decrypt files regardless of which government is asking. For non-US users, this means their files sit under at least two legal regimes — their own country's and the United States' — with limited transparency about how Dropbox handles conflicts between them or demands from authoritarian states.

The entry documents a coverage gap in Dropbox's own transparency: the cross-border reality of who can lawfully reach a global user base's files is materially less disclosed than the domestic US picture, even as the legal mechanisms for cross-border access have expanded.