What Is the ECPA? Electronic Communications Privacy Act
The ECPA is the Electronic Communications Privacy Act of 1986, Pub. L. 99-508, the federal law that sets baseline rules for intercepting phone calls, emails, and other electronic communications in the United States. It has three titles: the Wiretap Act, the Stored Communications Act, and the pen register statute.
Information last verified on 2026-07-08. This article has not yet been reviewed by a licensed lawyer.
What does ECPA stand for?
ECPA stands for the Electronic Communications Privacy Act of 1986, Pub. L. 99-508. Congress passed it to extend the older 1968 Wiretap Act, which had covered wire and oral communications like phone calls, to the newer world of email, pagers, and computer-to-computer data transmission. It did that by amending the existing Wiretap Act and adding two entirely new sets of rules, the Stored Communications Act and the pen register statute, so that "ECPA" today refers to a package of three related but distinct laws codified at -2523, 2701-2713, and 3121-3127.
What does the ECPA actually do?
ECPA is not a single rule. It has three titles, and knowing which one applies to a given fact pattern is the key to using it correctly.
- Title I, the Wiretap Act (-2523). Prohibits intentionally intercepting a wire, oral, or electronic communication while it is being transmitted, in real time. This is the part of ECPA people usually mean when they ask "is it legal to record this conversation."
- Title II, the Stored Communications Act (-2713). Prohibits intentionally accessing a stored communication, such as an email sitting in an inbox or a voicemail, without authorization. It also sets the process the government must follow to compel a provider to disclose stored content. See our Stored Communications Act Explained for the full depth on this title.
- Title III, pen register and trap-and-trace (-3127). Regulates devices or processes that capture dialing, routing, addressing, or signaling metadata about a communication, not its content. Installing one without a court order is a federal crime under .
Who has to follow the ECPA?
ECPA binds everyone: private individuals, businesses, communications providers, and the government, though each faces different rules under it. A private individual recording their own conversation is governed by the one-party consent rule in (2)(d). A communications provider, an email host or a phone carrier, gets a narrower exception under (2)(a)(i) to monitor its own network for abuse, fraud, or service delivery, but cannot sell communication content to third parties under that exception. Government investigators face the strictest rules of all: intercepting a live communication requires a Title III super-warrant under 18 U.S.C. §§ 2516-2518, while compelling a provider to hand over stored data follows the tiered warrant, court-order, and subpoena framework set out in .
The ECPA's most important rule: one-party consent
For most everyday recording questions, the rule that matters is 18 U.S.C. § 2511(2)(d): a participant in a phone call, in-person conversation, or video call may record it without telling the other participants, unless the recording is made for the purpose of committing a crime or a tort. That is a federal floor, not a ceiling, so it applies everywhere in the United States unless a stricter state law displaces it for in-state recordings. Roughly 12 states, including California under its Invasion of Privacy Act, require the consent of every party instead. The full penalty structure, the tortious-purpose exception, and how the federal floor interacts with those stricter state laws are covered in depth in Federal Wiretap Act and ECPA: The Complete Guide (2026).
Is the ECPA the same as HIPAA or GDPR?
No. ECPA is a US federal statute about intercepting and accessing communications; it predates HIPAA (health-information privacy, 1996) and the EU's GDPR (data protection, 2018) and addresses a narrower problem. HIPAA governs how covered health entities handle protected health information. GDPR is a European data-protection regulation with no direct US analogue. ECPA does not regulate general data collection; it targets interception of communications in transit and unauthorized access to communications already in storage.
Disclaimer
This article provides general legal information about the Electronic Communications Privacy Act of 1986, Pub. L. 99-508, as verified on 2026-07-08. It does not constitute legal advice and does not create an attorney-client relationship. Readers should consult a lawyer licensed in their jurisdiction before recording a conversation or accessing stored communications.
Related articles
- Federal recording laws: the complete hub
- Federal Wiretap Act and ECPA: The Complete Guide (2026)
- Stored Communications Act Explained
- One-party consent states: full list and rules
Last updated: 2026-07-08. Statutes cited reflect their in-force version as of 2026-07-08.
Frequently Asked Questions
What does ECPA stand for?
ECPA stands for the Electronic Communications Privacy Act of 1986, Pub. L. 99-508. It is the federal law that governs intercepting live communications, accessing stored communications, and installing pen register or trap-and-trace devices in the United States.
When was the ECPA passed?
Congress enacted the Electronic Communications Privacy Act on October 21, 1986, as Pub. L. 99-508. It amended the 1968 Wiretap Act and added the Stored Communications Act and the pen register statute as new titles.
Does the ECPA apply to text messages?
Yes, in two different ways depending on timing. A text message intercepted while it is being transmitted falls under the Wiretap Act, 18 U.S.C. 2510-2523. A text message already delivered and sitting on a phone or with a carrier falls under the Stored Communications Act, 18 U.S.C. 2701-2713, if someone accesses it without authorization.
What is the difference between the ECPA and the Wiretap Act?
The Wiretap Act is one part of the ECPA, specifically Title I, codified at 18 U.S.C. 2510-2523. The ECPA as a whole also includes Title II, the Stored Communications Act, and Title III, the pen register and trap-and-trace statute. People often use 'ECPA' and 'Wiretap Act' interchangeably, but the Wiretap Act is narrower.
Does the ECPA apply outside the United States?
The ECPA is a US federal statute and its core prohibitions apply to conduct and communications connected to the United States. Cross-border data requests to US providers are also addressed by the CLOUD Act, enacted in 2018, which amended the Stored Communications Act at 18 U.S.C. 2713 to address preservation and disclosure of data regardless of where it is stored.
What happens if someone violates the ECPA?
It depends on which title. A Wiretap Act violation is a federal felony punishable by up to five years under 18 U.S.C. 2511, plus civil damages with a $10,000 per-violation floor under 18 U.S.C. 2520. A Stored Communications Act violation carries criminal penalties under 18 U.S.C. 2701(b) and a separate civil remedy with a $1,000 floor under 18 U.S.C. 2707.
Updates
Governing law re-checked for recent changes
Governing law re-checked for recent changes
The Law Behind This Article
This article rests on 8 statutory provisions held in our own legal record, each retrieved from the official source. Tap a section to read the operative text.
United States Code Title 18
§ 2510DefinitionsIn forcecited in 120 of our articles
As used in this chapter— “wire communication” means any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception (including the use of such connection in a switching station) furnished or operated by any person engaged in providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce; “oral communication” means any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation, but such term does not include any electronic communication; “State” means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, and any territory or possession of the United States; “intercept” means the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.1 So in original. The period probably should be a semicolon.
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 2,382 court opinionsMost recently applied by a court: 2026
Leading cases: Forsyth v. Barr (Court of Appeals for the Fifth Circuit 1994, 19 F.3d 1527) · Nixon v. Administrator of General Services (Supreme Court of the United States 1977, 433 U.S. 425) · Gannett Co. v. DePasquale (Supreme Court of the United States 1979, 443 U.S. 368)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: US Recording Laws by State (2026): All 50 States Explained, District of Columbia Recording Laws (2026): One-Party Consent Rules, Kentucky Phone Call Recording Laws: What You Need to Know
§ 2511Interception and disclosure of wire, oral, or electronic communications prohibitedIn forcecited in 397 of our articles
Except as otherwise specifically provided in this chapter any person who— intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication when— such device is affixed to, or otherwise transmits a signal through, a wire, cable, or other like connection used in wire communication; or such device transmits communications by radio, or interferes with the transmission of such communication; or such person knows, or has reason to know, that such device or any component thereof has been sent through the mail or transported in interstate or foreign commerce; or such use or endeavor to use (A) takes place on the premises of any business or other commercial establishment the operations of which affect interstate or foreign commerce; or (B) obtains or is for the purpose of obtaining information relating to the operations of any business or other commercial establishment the operations of which affect interstate or foreign…
Official text (excerpt) · as of 2026-08-12 · Read the full section at uscode.house.gov
Cited in 2,045 court opinionsMost recently applied by a court: 2026
Leading cases: Mitchell v. Forsyth (Supreme Court of the United States 1985, 472 U.S. 511) · United States v. United States District Court for the Eastern District of Michigan (Supreme Court of the United States 1972, 407 U.S. 297) · Forsyth v. Barr (Court of Appeals for the Fifth Circuit 1994, 19 F.3d 1527)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Alabama Audio Recording Laws: Consent Rules and Penalties, Alabama Dashcam Laws: Legality, Mounting Rules, and Evidence Use, Alabama Medical Recording Laws: Patient Rights and HIPAA Rules
§ 2520Recovery of civil damages authorizedIn forcecited in 111 of our articles
Except as provided in section 2511(2)(a)(ii), any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate. In an action under this section, appropriate relief includes— such preliminary and other equitable or declaratory relief as may be appropriate; damages under subsection (c) and punitive damages in appropriate cases; and a reasonable attorney’s fee and other litigation costs reasonably incurred.
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 860 court opinionsMost recently applied by a court: 2026
Leading cases: Jessie Walker v. Thomas E. Darby, Hugh L. Robinson, Jr., and Kenneth Day (Court of Appeals for the Eleventh Circuit 1990, 911 F.2d 1573) · Gelbard v. United States (Supreme Court of the United States 1972, 408 U.S. 41) · DirecTV, Inc. v. Hoa Huynh (Court of Appeals for the Ninth Circuit 2007, 503 F.3d 847)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Alabama Phone Call Recording Laws: What You Need to Know, Alaska Phone Call Recording Laws: Rules for Landline, Cell, and VoIP (2026), Arkansas Audio Recording Laws: One-Party Consent Rules and Penalties (2026)
§ 2701Unlawful access to stored communicationsIn forcecited in 19 of our articles
Except as provided in subsection (c) of this section whoever— intentionally accesses without authorization a facility through which an electronic communication service is provided; or intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section. The punishment for an offense under subsection (a) of this section is— if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State— a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this subparagraph; and a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent offense under this subparagraph; and in any other case— a fine under this title or imprisonment for not more than 1 year or both, in the case of a first offense under this paragraph;…
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 724 court opinionsMost recently applied by a court: 2026
Leading cases: United States v. Warshak (Court of Appeals for the Sixth Circuit 2010, 631 F.3d 266) · Guest v. Leis (Court of Appeals for the Sixth Circuit 2001, 255 F.3d 325) · City of Ontario v. Quon (Supreme Court of the United States 2010, 560 U.S. 746)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Hawaii Audio Recording Laws: One-Party Consent Rules and Penalties, Idaho Audio Recording Laws: One-Party Consent Rules and Penalties (2026), Iowa Audio Recording Laws: One-Party Consent Rules and Penalties (2026)
§ 2703Required disclosure of customer communications or recordsIn forcecited in 6 of our articles
A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures and, in the case of a court-martial or other proceeding under chapter 47 of title 10 (the Uniform Code of Military Justice), issued under section 846 of that title, in accordance with regulations prescribed by the President) by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) of this section.
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 776 court opinionsMost recently applied by a court: 2026
Leading cases: Carpenter v. United States (Supreme Court of the United States 2018, 585 U.S. 296) · United States v. Warshak (Court of Appeals for the Sixth Circuit 2010, 631 F.3d 266) · Guest v. Leis (Court of Appeals for the Sixth Circuit 2001, 255 F.3d 325)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Hawaii Phone Call Recording Laws: One-Party Consent Rules for Calls, Federal Wiretap Act and ECPA: The Complete Guide (2026), Federal Recording Laws: ECPA, SCA, and CIPA Explained
§ 2707Civil actionIn forcecited in 3 of our articles
Except as provided in section 2703(e), any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate. In a civil action under this section, appropriate relief includes— such preliminary and other equitable or declaratory relief as may be appropriate; damages under subsection (c); and a reasonable attorney’s fee and other litigation costs reasonably incurred. The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000. If the violation is willful or intentional, the court may assess punitive damages.
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 274 court opinionsMost recently applied by a court: 2026
Leading cases: Doe v. Chao (Supreme Court of the United States 2004, 540 U.S. 614) · Matthew Alexander v. Verizon Wireless Services, LL (Court of Appeals for the Fifth Circuit 2017, 875 F.3d 243) · Beaven v. United States Department of Justice (Court of Appeals for the Sixth Circuit 2010, 622 F.3d 540)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 2713Required preservation and disclosure of communications and recordsIn force
A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 2 court opinionsMost recently applied by a court: 2018
Leading cases: In re Leopold (Court of Appeals for the D.C. Circuit 2018, 327 F. Supp. 3d 1) · In Re in the Matter of the Application of Jason Leopold to Unseal Certain Electronic Surveillance Applications and Orders (District Court, District of Columbia 2018)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 3121General prohibition on pen register and trap and trace device use; exceptionIn forcecited in 2 of our articles
Except as provided in this section, no person may install or use a pen register or a trap and trace device without first obtaining a court order under section 3123 of this title or under the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or an order from a foreign government that is subject to an executive agreement that the Attorney General has determined and certified to Congress satisfies section 2523. The prohibition of subsection (a) does not apply with respect to the use of a pen register or a trap and trace device by a provider of electronic or wire communication service— relating to the operation, maintenance, and testing of a wire or electronic communication service or to the protection of the rights or property of such provider, or to the protection of users of that service from abuse of service or unlawful use of service; or to record the fact that a wire or electronic communication was initiated or completed in order to protect such provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful or abusive use of service; or (3) where the consent of the user of…
Official text (excerpt) · as of 2026-07-28 · Read the full section at uscode.house.gov
Cited in 94 court opinionsMost recently applied by a court: 2026
Leading cases: United States v. Aaron Graham (Court of Appeals for the Fourth Circuit 2016, 824 F.3d 421) · In Re the United States for an Order for Prospective Cell Site Location Information on a Certain Cellular Telephone (District Court, S.D. New York 2006, 460 F. Supp. 2d 448) · In Re US for an Order Aut. Dis. of Prosp. Cell (District Court, E.D. Wisconsin 2006, 412 F. Supp. 2d 947)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Electronic Communications Privacy Act of 1986, Pub. L. 99-508(congress.gov).gov
- 18 U.S.C. § 2510: ECPA Title I definitions(uscode.house.gov).gov
- 18 U.S.C. § 2511: Wiretap Act prohibition and one-party consent exception(uscode.house.gov).gov
- 18 U.S.C. § 2701: Stored Communications Act, ECPA Title II(uscode.house.gov).gov
- 18 U.S.C. § 3121: pen register and trap-and-trace prohibition, ECPA Title III(uscode.house.gov).gov