18 U.S.C. § 2707
Stored Communications Act: suing over unauthorized access to stored messages
A claim in United States district courts · Last verified August 26, 2026
Someone got into your email, your messages, or your cloud storage without permission. The Stored Communications Act is the federal claim for that — and for a provider that handed your communications to someone it should not have.
It comes with a $1,000 statutory floor, which sounds like a guaranteed minimum and is not: some circuits require you to prove some actual damages before you can collect it.
What the claim is
Two branches.
Unauthorized access. Someone intentionally got into a facility through which an electronic communication service is provided and obtained, altered, or blocked access to communications in electronic storage. The everyday version: a spouse or ex-partner reading your email, a former employee still logged into a company account, a coworker in your messages.
Improper disclosure. A provider disclosed the contents of your communications, or your subscriber records, to someone not entitled to receive them.
The statute is narrower than "internet privacy." It reaches communications in electronic storage held by covered providers — not every piece of data about you that exists online.
Where the right comes from
Express, and it names who may sue:
any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover … such relief as may be appropriate.
Note the state-of-mind requirement built into standing itself: negligent conduct is not actionable.
What a plaintiff has to prove
For an unauthorized-access claim:
- The defendant intentionally accessed, without authorisation or in excess of it, a facility through which an electronic communication service is provided.
- Thereby obtained, altered, or prevented authorized access to a wire or electronic communication in electronic storage.
- With a knowing or intentional state of mind.
Element two does more work than it looks. "Electronic storage" is a defined term, and whether a message that has already been opened and left on a server qualifies has generated substantial litigation. A claim can fail because the communication was in the wrong state at the wrong moment.
How long you have to file
Two years after the claimant first discovered or had a reasonable opportunity to discover the violation.
The discovery rule is written into the statute rather than borrowed, which matters here — covert access is often found long after it happens, and this is one of the few federal privacy claims whose text accounts for that.
What has to happen before you file
Nothing. No exhaustion, no notice, no agency.
Who can be sued — and who cannot
"The person or entity which engaged in that violation" — individuals and organisations alike.
No aiding-and-abetting liability. Courts have held the civil action does not reach someone who helped another person commit the violation. You must sue the one who did it.
That limit matters in the common fact pattern where one person obtains the messages and hands them to another who uses them.
Common defenses
Good-faith reliance — the statutory safe harbour, and it is a complete defence. Reliance on a court warrant or order, a grand jury subpoena, a legislative or statutory authorisation, a qualifying law enforcement request, or a good-faith determination that a statutory exception permitted the conduct is
a complete defense to any civil or criminal action brought under this chapter or any other law.
That protects providers who respond to legal process, and it is why the productive defendant is usually the person who did the accessing rather than the platform.
Consent or authorisation — the central factual fight in domestic and workplace cases. A shared password, a family plan, or a company device policy can all bear on it.
The communication was not in "electronic storage."
No knowing or intentional state of mind.
The two-year bar.
What the claim pays
Actual damages plus any profits the violator made, with a floor: "in no case shall a person entitled to recover receive less than the sum of $1,000."
Punitive damages where the violation was willful or intentional.
Costs and reasonable attorney's fees.
But the floor is contested, and this is the live split. Some courts of appeals hold a plaintiff must prove at least some actual damages before becoming "a person entitled to recover" — reading the floor as a minimum award for those who have proved damages, not as a substitute for proving them. Other courts allow the $1,000 without proof of actual loss.
One caution about how this split gets described: at least two circuits are on the same actual-damages-required side. They are sometimes cited as if opposed. Check the current alignment in your circuit rather than relying on a two-sided summary.
What people get wrong
"I automatically get $1,000 for a violation." Not everywhere. Some circuits require proof of some actual damages first.
"It covers all my data online." No. It reaches communications in electronic storage held by covered providers.
"I can sue the person who used what they were given." Only if they were the one who accessed it. There is no aiding-and-abetting liability.
"The provider is liable for turning over my emails." Not if it relied in good faith on legal process — that is a complete defence.
"The clock runs from the intrusion." It runs from when you discovered it, or reasonably could have.
"Negligent access counts." It does not. The conduct must be knowing or intentional.
Where it came from
The Act was enacted in 1986 as part of the Electronic Communications Privacy Act, at a moment when Congress could see that the constitutional protection for a letter in a drawer did not clearly extend to a message sitting on someone else's computer. Rather than wait for the Fourth Amendment to catch up, it built a statutory regime governing access and disclosure.
Its age is the defining problem. It was written for a world of dial-up services and messages downloaded then deleted from the server — categories that map badly onto cloud storage, webmail kept indefinitely, and messaging platforms. The recurring litigation about what counts as "electronic storage" is a direct consequence.
Two decisions reshaped the constitutional landscape around it — one holding that stored email content attracts Fourth Amendment protection, another recognising a privacy interest in records held by third parties. Both concern government access, not the civil action, and neither changed what a private plaintiff must prove. They are worth knowing as context and not as authority for this claim.
Common questions
Do I automatically recover $1,000 if someone read my email?
Not necessarily. The statute sets a $1,000 floor, but some circuits require you to prove at least some actual damages before becoming entitled to it. Check your circuit.
How long do I have to sue?
Two years from when you first discovered the violation, or had a reasonable opportunity to discover it. The discovery rule is in the statute itself.
Can I sue my ex for reading my messages?
Potentially, if they intentionally accessed an account or service without authorisation and obtained communications in electronic storage. Consent — including a shared password — is the usual defence.
Can I sue the email provider?
Rarely. A provider that relied in good faith on a warrant, subpoena, or other legal authorisation has a complete defence.
Does it cover everything about me stored online?
No. The Act reaches communications in electronic storage held by covered service providers, not all data a company holds about you.