Clarifying Lawful Overseas Use of Data (CLOUD) Act 2018

• Law: Clarifying Lawful Overseas Use of Data Act (Public Law 115-141, Division V)
• Passed: March 2018 — buried on page 2,212 of a 2,232-page omnibus spending bill
• Vote: No standalone vote. Passed as a rider — Senate 65–32, House 256–167 on the omnibus package
• Signed by: President Trump

Your private emails, messages, photos, and files are now accessible to foreign law enforcement — governments that may have poor human rights records, no independent judiciary, and no interest in your constitutional rights — without a US warrant. That is what the CLOUD Act does. And Congress never held a single hearing on it. Not one. They buried it on page 2,212 of a must-pass spending bill, gave lawmakers less than 12 hours to read 2,232 pages, and passed it before sunrise.

This is not a law that was debated, studied, and voted on. It is a law that was hidden.

How It Passed

The CLOUD Act was not introduced through the normal legislative process. There were no public hearings. No committee markups in either the House or the Senate. No floor debate on its merits. No standalone vote.

Instead, the text was attached to the Consolidated Appropriations Act of 2018 — the annual omnibus spending bill that funds the entire federal government. Congress received the 2,232-page bill after 8 PM on the night before the vote. They voted by the next morning. It is mathematically impossible that any member of Congress read this bill before voting on it.

The Electronic Frontier Foundation documented exactly what happened: "In the final pages of the bill — meant only to appropriate future government spending — lawmakers snuck in a separate piece of legislation that was never reviewed or marked up by any committee in either the House or the Senate." That is not the EFF being dramatic. That is a factual description of what occurred.

The CLOUD Act's supporters — primarily the Justice Department and major US tech companies including Google, Apple, Facebook, and Microsoft — had been lobbying for it for months. The tech companies wanted legal clarity about their obligation to respond to foreign government requests. The Justice Department wanted expanded access to data held overseas. They got what they wanted. The public got no input.

The Senate vote of 65–32 and House vote of 256–167 were not votes on the CLOUD Act. They were votes on keeping the government funded. No member of Congress had the option of voting against the CLOUD Act while voting for the spending bill. The two were fused together precisely to prevent accountability.

What It Does To You

The CLOUD Act resolves a legal ambiguity that had been working in your favor. Before it passed, if the US government wanted your data stored on a server in Germany or Ireland, it generally had to go through that country's legal system — a process called a Mutual Legal Assistance Treaty (MLAT) request. That process was slow and inconvenient for the government. The CLOUD Act eliminated that inconvenience by requiring US companies to hand over your data on a US government demand regardless of where it is stored.

But it goes further. The CLOUD Act creates an "executive agreement" framework — bilateral deals between the US executive branch and foreign governments — that grants those foreign governments direct access to data held by US companies. Without a US warrant. Without Senate ratification as a treaty. Without your knowledge or consent.

Here is what that means in practice:

• A country with which the US has a CLOUD Act executive agreement can demand your emails, photos, documents, and communications directly from Google, Apple, or Microsoft — without going through a US court.
• You will not be notified. There is no requirement that you be told your data was handed over.
• The foreign government does not need to meet US constitutional standards — no Fourth Amendment protections, no warrant requirement, no probable cause.
• The executive branch makes these agreements alone. The Senate — which the Constitution gives the authority to ratify treaties — has no role. This is a constitutional end-run built into the statute.

Countries that have signed or are pursuing CLOUD Act executive agreements include the United Kingdom, Australia, and others. The US has been in negotiations with additional countries. Each new agreement extends the reach of foreign law enforcement into Americans' private data.

Rights It Strips

Your Fourth Amendment right against unreasonable searches. The Fourth Amendment requires the government to obtain a warrant supported by probable cause before accessing your private communications. The CLOUD Act allows foreign governments — not bound by the Fourth Amendment — to access that same data without meeting that standard.

Your right to know your data was searched. There is no notice requirement. A foreign government can demand and receive your private communications and you may never know it happened.

Senate treaty ratification authority. The Constitution's Article II gives the Senate the power to ratify international agreements that affect Americans' rights. The CLOUD Act executive agreement mechanism bypasses this entirely — the executive branch creates binding international data-sharing arrangements without Senate approval. This is not a technicality. It is the executive branch claiming authority the Constitution gives to the legislature.

The protection of foreign privacy law. When US companies store your data in countries with strong data-protection laws — the European Union's GDPR, for example — those laws were designed to protect your privacy. The CLOUD Act makes those protections irrelevant when the US government wants your data. The foreign country's courts and laws are simply overridden.

Documented Abuses

The CLOUD Act's executive agreement framework has been implemented with minimal public transparency. The agreements themselves are not fully public. The number of foreign government requests made under them is not comprehensively reported. The identities of Americans whose data was accessed are not disclosed.

What is documented:

The UK-US CLOUD Act agreement, finalized in 2022, allows UK law enforcement to directly demand data from US companies without a US warrant. The UK does not have the same constitutional protections Americans have. UK law allows broader surveillance authorities and lower evidentiary standards.

The EFF and other civil liberties organizations have repeatedly documented that the CLOUD Act's challenge mechanism — which allows companies to contest demands that would violate foreign law — has a narrow standard that rarely results in successful challenges. Companies are not required to notify users before complying.

Legal scholars at institutions including Stanford, Georgetown, and the Brennan Center for Justice have written extensively on the constitutional problems with the executive agreement framework. The consensus: these agreements function as treaties for purposes of international law but are being executed without the Senate ratification that the Constitution requires.

The Justice Department has used CLOUD Act authorities to demand data in an unknown number of cases since 2018. None of those cases require public reporting. The full scope of use is not publicly known.

Who Pushed This

The CLOUD Act had two constituencies whose interests happened to align:

The Justice Department — which had been frustrated by the MLAT process since the rise of cloud storage. The DOJ wanted faster access to overseas data and had been lobbying for legislation to compel it for years. The CLOUD Act delivered everything the DOJ wanted.

Major US tech companies — Google, Apple, Facebook, and Microsoft all supported the CLOUD Act publicly. Their motivation was legal clarity: they were caught between US government demands and foreign privacy laws, and they wanted a legal framework that told them what they had to do. The CLOUD Act gave them that clarity at the cost of user privacy.

The companies that pushed this are the same companies that hold your private communications. They supported a law that makes it easier for foreign governments to access your data — not because they were forced to, but because they lobbied for it.

No public interest organization supported the CLOUD Act. The EFF opposed it. Privacy advocates opposed it. Constitutional scholars warned about it. They were not in the room when the decision was made.

The decision was made by the Justice Department and the tech industry, then buried in page 2,212 of a spending bill so that no debate could happen.

Key Votes

There was no standalone vote on the CLOUD Act. That is the point. The omnibus vote numbers:

• Senate: 65–32 on the omnibus (not on the CLOUD Act specifically)
• House: 256–167 on the omnibus

Members who voted against the omnibus did not necessarily do so because of the CLOUD Act — most objected to spending levels or other riders. Members who voted for the omnibus did not necessarily know the CLOUD Act was in it — the bill was 2,232 pages and they had less than 12 hours.

The accountability screen here is different: look for members who have publicly criticized the use of omnibus riders to pass major surveillance legislation without standalone debate. Members who have opposed omnibus "rider" tactics on principle have the cleanest records.

Why This Matters for We The Citizens

The CLOUD Act is a masterclass in how the surveillance state expands without debate. It did not happen with a dramatic Senate floor speech or a visible vote. It happened at midnight, on page 2,212 of a must-pass spending bill, with the tech industry's fingerprints on it and the Justice Department's blessing.

The method matters as much as the law itself. Every time Congress buries a major expansion of government power in an omnibus bill, they are explicitly choosing to avoid accountability. They are choosing to pass something they know would not survive public scrutiny. They are treating the constitutional debate process as an obstacle to be avoided rather than a safeguard to be respected.

Any politician who defends omnibus legislation as "how things get done" is telling you they prefer to expand government power without your knowledge or consent. That is not governance. That is a system designed to serve the people who are in the room — the Justice Department, the tech companies — while the public never gets a vote.

See also: Bad Laws Overview