Reading Someone Else’s Email or Cloud Account: What 18 U.S.C. 2701 Says

Section 2701 of Title 18 is the federal provision that covers getting into the stored contents of someone else’s email, messaging or cloud account. This page quotes the text as published by the Cornell Legal Information Institute, read on 2026-10-19, and says plainly where it gives a reading of the words rather than the words themselves. It is not legal advice.

What the statute says

Subsection (a) makes it an offense to do either of two things:

“(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.”

Two conditions have to be met together. The person must have gotten in without permission, or gone past the permission they had, and the access must have reached a communication that was in “electronic storage.”

What “electronic storage” means

The definition sits in 18 U.S.C. 2510(17). It covers “any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof” and “any storage of such communication by an electronic communication service for purposes of backup protection of such communication.” Read plainly, that describes messages held on a provider’s servers while in transit or kept as a backup copy. The text does not say whether every item in a cloud folder qualifies, and this page does not guess.

Penalties written in subsection (b)

• If the act was done for commercial advantage, malicious destruction or damage, private commercial gain, or in furtherance of a criminal or tortious act under federal or state law: a fine or up to 5 years for a first offense, up to 10 years for a later one.
• In any other case: a fine or up to 1 year for a first offense, up to 5 years for an offense after a prior conviction under the section.

Who the statute leaves out

Subsection (c) lists three exceptions. The section does not apply to conduct authorized “(1) by the person or entity providing a wire or electronic communications service; (2) by a user of that service with respect to a communication of or intended for that user; or (3) in section 2703, 2704 or 2518 of this title.” The second exception is the one that matters for ordinary people: a user may authorize access to a communication that is theirs or addressed to them.

What this means for a monitoring product

A tool that logs into another adult’s account with a password the owner never agreed to share is the situation the first clause describes. An account you own, or one whose owner has given you access, sits on the other side of the line the text draws. The statute turns on authorization, so a shared household or a shared bill does not by itself supply it.

What counts as an electronic communication service

Subsection (a) protects a “facility through which an electronic communication service is provided,” so the meaning of that service decides how far the section reaches. Section 2510(15) defines it as “any service which provides to users thereof the ability to send or receive wire or electronic communications.” Email hosts and messaging platforms match that wording on its face. Whether a particular app or storage product is such a service is a question about the product, and the definition alone does not settle it.

If the access leads to a lawsuit

Criminal penalties are only half of the picture. Section 2707 gives a private right to sue. Under subsection (a), “any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, other than the United States.” The state of mind matters here as well: the conduct has to be knowing or intentional.

Subsection (b) lists what a court can award:

• “(1) such preliminary and other equitable or declaratory relief as may be appropriate”;
• “(2) damages under subsection (c)”; and
• “(3) a reasonable attorney’s fee and other litigation costs reasonably incurred.”

Subsection (c) sets the damages at “the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000.” It adds: “If the violation is willful or intentional, the court may assess punitive damages.” Put simply, a successful claimant recovers at least $1,000, the violator’s profits can be added to the loss, and punitive damages are possible on top when the conduct was willful.

Two limits cut the other way. Subsection (e) makes good faith reliance on “a court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory authorization” a “complete defense to any civil or criminal action brought under this chapter or any other law.” Subsection (f) sets a deadline: a civil action “may not be commenced later than two years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation.”

Short questions, answered from the text

Does reading my own email count? Subsection (c)(2) excludes conduct authorized “by a user of that service with respect to a communication of or intended for that user.” Your own messages fall under that wording.

Is the email provider covered by the section? Subsection (c)(1) excludes conduct authorized “by the person or entity providing a wire or electronic communications service.”

Is there a minimum award in a civil case? Yes. Section 2707(c) says a person entitled to recover receives no less than $1,000.

How long does someone have to sue? Two years, counted from the date the claimant first discovered the violation or had a reasonable opportunity to discover it, under section 2707(f).

Sources

• 18 U.S.C. 2701, as published by Cornell LII: law.cornell.edu/uscode/text/18/2701
• 18 U.S.C. 2707, civil action: law.cornell.edu/uscode/text/18/2707
• 18 U.S.C. 2510, definitions: law.cornell.edu/uscode/text/18/2510

According to the statutory notes on the 2701 page, the section was added by Pub. L. 99-508, title II, section 201, on October 21, 1986. It was amended by Pub. L. 103-322 on September 13, 1994, by Pub. L. 104-294 on October 11, 1996, and by Pub. L. 107-296 on November 25, 2002. Pub. L. 115-278 renumbered that 2002 provision on November 16, 2018, without changing the text of 2701. State law may add its own rules. For a specific situation, a licensed attorney in your state is the right source.