The CLOUD Act explained

Why an EU data centre does not keep your data out of US reach.

The CLOUD Act is a US law from 2018. It allows US authorities to compel a provider subject to US jurisdiction to hand over data in its possession, custody or control, wherever in the world that data is stored. A European data centre run by an American company is therefore not out of reach.

For organisations in Europe, that turns a technical choice, which video platform or which cloud, into a legal one.

Join the free private beta

Free during the beta. For organisations. Nothing to pay.

Who does the CLOUD Act apply to?

To providers that are subject to US jurisdiction: American companies, and in practice also their subsidiaries and companies with sufficient ties to the United States. What matters is who controls the data, not where the server stands.

Why EU data centres are not enough

Many American providers offer an “EU region”. The data is stored in Europe, but the company that controls it remains American, so a US order can still reach it. A European subsidiary does not change that if the parent can be compelled.

And FISA Section 702?

FISA Section 702 allows US intelligence agencies to collect communications of non-US persons from US electronic communication service providers. It is one of the reasons the Court of Justice of the EU struck down Privacy Shield in 2020. Its successor, the EU-US Data Privacy Framework, has been challenged in court too.

What it means for your video platform

Videos often contain personal data: faces, voices, names, sometimes health or student data. Viewer statistics contain more. If your video platform is American, or runs on an American cloud, that data is within reach of US law. A platform with European ownership, law and infrastructure is not. Read what makes video hosting sovereign.

Frequently asked questions

Does the CLOUD Act apply to European companies?

Not to companies without US ties. It applies to providers subject to US jurisdiction, which includes American companies and, in practice, companies controlled from the United States.

Is my data safe in an EU region of an American cloud?

It is stored in Europe, but the company that controls it remains subject to US law, so the CLOUD Act can still reach it.

Sources

US Congress: Clarifying Lawful Overseas Use of Data (CLOUD) Act, 2018
Court of Justice of the EU: case C-311/18 (Schrems II), 16 July 2020

Try Europe’s video platform.

StreamZilla is the all-in-one video platform from the team that put the first live stream on the web, with 32 years of experience. It is in private beta, and joining is free: you get early access, a direct line to the people who build it, and a say in what comes next.