In 1986, when introducing the Electronic Communications Privacy Act (ECPA), Senator Patrick Leahy observed that the nation's then-existing electronic communications privacy laws were "hopelessly out of date." The Senate Judiciary Committee agreed that the law had "not kept pace with the development of communication and computer technology ... [n]or [had] it kept pace with changes in the structure of the telecommunications industry." Later that year, Congress enacted ECPA, which, at over 25 years old, remains the primary law governing government and private actor access to our stored online communications. It governs, for instance, when the government can demand that Google turn over emails; when social media sites like Facebook must provide private posts; when video-sharing sites like YouTube must provide stored videos; and when cell phone companies must turn over cell location information. In recent years, ECPA has faced increased criticism from both the technology and privacy communities that it has outlived its usefulness in the digital era and does not provide adequate privacy safeguards for individuals' electronic communications. In light of these concerns, various reform bills have been introduced in the past several Congresses, with three major reform bills pending in the 114 th Congress. The Electronic Communications Privacy Act Amendments Act of 2015 ( S. 356 ) and the Email Privacy Act ( H.R. 699 ), almost identical in text, would, among other things, place both ECSs and RCSs under the same legal requirement; eliminate the current 180-day rule found in the Stored Communications Act (SCA) and require a warrant for emails no matter how long they have been stored or whether they have been opened; and eliminate the reliance on the definition of "electronic storage," which has confused the lower courts. Additionally, the Online Communications and Geolocation Privacy Act ( H.R. 656 ) would make similar changes to the SCA. Some federal agencies, most prominently the Securities and Exchange Commission (SEC), which currently rely on their subpoena authority to access electronic communications, have argued that these bills would stymie their ability to conduct investigations as they lack legal authority to obtain a warrant. In response to this concern, both the Email Privacy Act and the ECPA Amendments Act include a rule of construction providing that nothing in these bills should be read to preclude the SEC or any other federal agency from seeking these records directly from a party to the communication, rather than the target's third-party service provider. Finally, there has been ongoing litigation in the lower federal courts as to ECPA's extraterritorial reach. The Law Enforcement Access to DATA Stored Abroad (LEADS) Act would require third-party service providers to disclose the contents of U.S persons' electronic communications held overseas upon issuance of a warrant based on probable cause. This report provides an overview of ECPA reform. It will first outline the background and history of the legal environment prior to ECPA and the problem precipitating ECPA's passage. It will then survey the current legal framework for accessing electronic communications and other non-content information from providers, and describe specific types of data accessible under ECPA. Finally, it will explore the various bills that would amend ECPA, including selected legal issues raised by these measures. Before passage of ECPA in 1986, government access to private electronic communications was governed primarily by the Fourth Amendment and the federal wiretap law. In 1967, the Supreme Court issued two landmark Fourth Amendment cases. In Katz v. United States , the Court held that the Fourth Amendment's prohibition against "unreasonable searches and seizures" entitles individuals to a reasonable expectation of privacy in their private communications. In Berger v. New York , the Court struck down a New York wiretap law that failed to include adequate safeguards for the privacy interests of those whose communications were being "tapped." One year later, in an effort to regulate wiretapping while also giving law enforcement a lawful means for intercepting telephone conversations, Congress enacted the "Wiretap Act" as Title III of the Omnibus Crime Control and Safe Streets Act of 1968. Title III prohibits the unauthorized interception of wire or oral communications, while simultaneously providing a procedure for law enforcement to conduct such interceptions upon judicial approval. However, Title III only covered the "aural" interception of wire or oral communications—the interception of actual sounds—that are interpreted by hearing, and not sight. This left largely unregulated the transfer of digital communications. This legal uncertainty as to whether new digital forms of communication would be covered by Title III or other federal law prompted the introduction of the original version of ECPA in 1985. Foreshadowing arguments made by proponents of ECPA reform today, the Senate Judiciary Committee observed at the time that this gap in coverage could stifle American technological innovation, expose law enforcement to liability, allow the erosion of American privacy rights, and jeopardize the admissibility of probative evidence in criminal prosecutions. One year later Congress enacted ECPA. ECPA contains three main titles. Title I updated the Wiretap Act to include not only the interception of oral and wire communications, but also electronic communications. Title III created new rules regulating the use of a pen register, a device that allows users to capture the routing information associated with communications, such as telephone numbers dialed or the to/from address in an email. Title II added Chapter 121 to the United States Code entitled "Stored Wire and Electronic Communications and Transactional Records Access," commonly referred to as the Stored Communications Act (SCA). As technology has developed, law enforcement has relied less frequently on real-time interception authorized under the Wiretap Act, and has instead relied on its authority under the SCA—accessing stored electronic communications, such as emails directly from a service provider. This shift explains why reform of ECPA has centered almost entirely on the SCA. The scope of the SCA is determined largely by the entities to which it applies. First, it does not apply to personal users, but only to providers of an "electronic communication service" (ECS) and a "remote computing service" (RCS). A provider of ECS allows its customers "to send or receive wire or electronic communications." A provider of RCS provides "computer storage or processing services by means of an electronic communication system." Although these definitions can be confusing in the abstract, they make more sense when applied. The SCA has two core components: (1) a broad prohibition against providers voluntarily sharing customers' communications with the government or others, subject to certain enumerated exceptions, and (2) procedures permitting the government to require the disclosure of customers' communications or records. As to the first component, under 18 U.S.C. § 2702(a)(1), a provider of ECS to the public "shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage." The importance of the definition of "electronic storage" will be discussed below. Section 2702(a)(2) states that a provider of RCS to the public shall not knowingly disclose the contents of a communication which is carried or maintained by that service. There are two other conditions that must be met in order for a communication to remain protected under subsection (a)(2). First, the communication must be maintained "on behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service." Second, the communication must be maintained "solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing." Although there appears to be little case law interpreting this second condition, it would appear that an RCS which is permitted to access the contents of a communication for purposes other than storage or computer processing—for example, advertising—would not be subject to the prohibition on disclosing the contents of communications. In essence, it acts as an additional exception to nondisclosure. Section 2702(a)(3) prohibits a provider of ECS or RCS to the public from disclosing a "record or other information pertaining to a subscriber to or customer of such service (not including the contents of a communication covered by paragraph (1) or (2)) to any governmental entity." Note that this rule, which concerns non-content or "metadata," does not apply to nongovernmental, private entities. This permits companies to share non-content information with other private entities, insofar as the SCA is concerned. There may be other federal or state laws, however, which prohibit disclosure of particular classes of information. Section 2702(b) provides exceptions to the permissible disclosure of the content of communications covered by the prohibitions in subsection (a), including: to an addressee or intended recipient of a communication, as authorized under Section 2703; as may be necessary incident to the rendition of the service or the protection of the rights of property of the provider of that service; or to a governmental entity, if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of communications relating to the emergency. Section 2702(c) provides similar exceptions for the disclosure of non-content information, including as authorized under Section 2703; with the lawful consent of the customer or subscriber; and to any person other than a governmental entity. The second major component of the SCA is the rules concerning required disclosure of customer communications and records. Section 2703 sets up a tiered system with different standards that apply depending on whether an ECS or RCS is holding the record, whether the data sought is content or non-content, whether the email has been opened, and whether advanced notice has been given to the customer.