CLOUD Act (Clarifying Lawful Overseas Use of Data Act)

Origin and scope

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) was passed by the US Congress in March 2018. It amends the Stored Communications Act of 1986 to clarify that any company under US jurisdiction must produce data it controls regardless of where the data is stored.

Who is affected?

• Companies incorporated in the United States (Microsoft, Google, Amazon, Meta, OpenAI, Anthropic, etc.).
• European subsidiaries of US groups.
• Foreign companies with substantial US presence (establishment, commercial services, employees).

In practice: a US SaaS hosting its servers in Europe (e.g. AWS eu-central-1 Frankfurt) remains fully subject to the CLOUD Act. Physical server location is not an exonerating factor.

Conflict with GDPR

Article 48 GDPR prohibits transfers to a foreign authority based on a judicial or administrative decision not recognised by an international agreement (e.g. an MLAT). The CLOUD Act therefore creates a structural legal contradiction: complying with one may breach the other. The CJEU confirmed this tension in the Schrems II judgment (2020).

Concrete risks for European users

• Possible data seizure without notice to the customer or European supervisory authority.
• Gag orders preventing the SaaS from notifying the user.
• Limited legal remedies — proceedings take place before US courts.

GEO/AEO vendors and the CLOUD Act

• Profound, AthenaHQ, Scrunch, Otterly: US companies, subject to the CLOUD Act de jure.
• AI Labs Audit: French SAS, French capital, OVH France hosting — not subject to the CLOUD Act.

Recommendation for regulated sectors

For banking/insurance, healthcare, defence, public sector and energy: choose an EU-incorporated, EU-hosted vendor. See European digital sovereignty and GDPR and AI compliance.