clock menu more-arrow no yes

Filed under:

Here are the policies for police access to your favorite smartphone apps like Facebook, Instagram, WhatsApp, Uber and Lyft

Find out how easily police can request and access personal information from the most popular smartphone apps.

FILE - In this Tuesday, May 21, 2019 file photo, a member of the media tries out new Huawei Honor 20 series of phones following their global launch in London.
FILE - In this Tuesday, May 21, 2019 file photo, a member of the media tries out new Huawei Honor 20 series of phones following their global launch in London. Facebook has stopped letting its apps come pre-installed on smartphones sold by Huawei to comply with U.S. restrictions, dealing a fresh blow to the Chinese tech giant. The social network said Friday, June 7 it suspended providing software for Huawei to put on its devices while it reviews recently introduced U.S. sanctions. (AP Photo/Alastair Grant, file)
AP

SALT LAKE CITY — Tech companies collect troves of data from their users. That data, which includes messages, purchase history and location information, can be useful for police investigating crimes.

But many people are unaware that they are agreeing to let a tech company share their personal information with police when they download a new app.

Tech companies have different policies when it comes to working with law enforcement. Some require police to obtain a warrant to access content like private messages and photos. Other information might be accessible with a subpoena, which does not require police to show probable cause for suspicion.

Here's what the privacy policies for some of the most common smartphone apps have to say about police access.

Read more: How police might access your Lyft, Tinder and Google accounts in a criminal investigation

**

Instagram | Facebook | Snapchat | Google | WhatsApp | Lyft | Uber | GrubHub | DoorDash | Venmo | Netflix | Hulu | Pinterest | Apple | Amazon | Spotify | Samsung

Note: The following text can be found on each of these social media companies' websites, which we've also linked to below.

Instagram

We disclose account records solely in accordance with our terms of service and applicable law, including the federal Stored Communications Act (“SCA”), 18 U.S.C. Sections 2701-2712. Under the SCA:

a valid subpoena issued in connection with an official criminal investigation is required to compel the disclosure of basic subscriber records (defined in 18 U.S.C. Section 2703(c)(2)), which may include: name, length of service, credit card information, email address(es), and any recent login/logout IP address(es), if available.

a court order issued under 18 U.S.C. Section 2703(d) is required to compel the disclosure of certain records or other information pertaining to the account, not including contents of communications, which may include message headers and IP addresses, in addition to the basic subscriber records identified above.

a search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include messages, photos, comments, and location information.

In responding to a matter involving imminent harm to a child or risk of death or serious physical injury to any person and requiring disclosure of information without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System at facebook.com/records.

Facebook

We disclose account records solely in accordance with our terms of service and applicable law, including the federal Stored Communications Act ("SCA"), 18 U.S.C. Sections 2701-2712. Under U.S. law:

A valid subpoena issued in connection with an official criminal investigation is required to compel the disclosure of basic subscriber records (defined in 18 U.S.C. Section 2703(c)(2)), which may include: name, length of service, credit card information, email address(es), and a recent login/logout IP address(es), if available.

A court order issued under 18 U.S.C. Section 2703(d) is required to compel the disclosure of certain records or other information pertaining to the account, not including contents of communications, which may include message headers and IP addresses, in addition to the basic subscriber records identified above.

A search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include messages, photos, videos, timeline posts, and location information.

We interpret the national security letter provision as applied to Facebook to require the production of only 2 categories of information: name and length of service.

In responding to a matter involving imminent harm to a child or risk of death or serious physical injury to any person and requiring disclosure of information without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System. Note: We will not review or respond to requests submitted by non-law enforcement officials. Users aware of an emergency situation should immediately and directly contact local law enforcement officials.

Snapchat

We may share information about you if we reasonably believe that disclosing the information is needed to:

comply with any valid legal process, governmental request, or applicable law, rule, or regulation. investigate, remedy, or enforce potential Terms of Service violations. protect the rights, property, and safety of us, our users, or others. detect and resolve any fraud or security concerns.

Google

The government needs legal process—such as a subpoena, court order or search warrant—to force Google to disclose user information. Exceptions can be made in certain emergency cases, though even then the government can't force Google to disclose.

Subpoena

Of the three types of Electronic Communications Privacy Act (ECPA) legal process for stored information, the subpoena has the lowest threshold for a government agency to obtain. In many jurisdictions, including the federal system, there is no requirement that a judge or magistrate review a subpoena before the government can issue it. A government agency can use a subpoena to compel Google to disclose only specific types of information listed in the statute. For example, a valid subpoena for your Gmail address could compel us to disclose the name that you listed when creating the account, and the IP addresses from which you created the account and signed in and signed out (with dates and times). Subpoenas can be used by the government in both criminal and civil cases.

On its face, ECPA seems to allow a government agency to compel a communications provider to disclose the content of certain types of emails and other content with a subpoena or an ECPA court order (described below). But Google requires an ECPA search warrant for contents of Gmail and other services based on the Fourth Amendment to the U.S. Constitution, which prohibits unreasonable search and seizure.

ECPA Court Order

Unlike an ECPA subpoena, obtaining an ECPA court order requires judicial review. To receive an ECPA court order, a government agency must present specific facts to a judge or magistrate demonstrating that the requested information is relevant and material to an ongoing criminal investigation. With such a court order, a government agency can obtain the same information as a subpoena, plus more detailed information about the use of the account. This could include the IP address associated with a particular email sent from that account or used to change the account password (with dates and times), and the non-content portion of email headers such as the "from," "to" and "date" fields. An ECPA court order is available only for criminal investigations.

Search Warrant

The threshold is higher still for an ECPA search warrant. To obtain one, a government agency must make a request to a judge or magistrate and meet a relatively high burden of proof: demonstrating "probable cause" to believe that contraband or certain information related to a crime is presently in the specific place to be searched. A warrant must specify the place to be searched and the things being sought. It can be used to compel the disclosure of the same information as an ECPA subpoena or court order—but also a user's search query information and private content stored in a Google Account, such as Gmail messages, documents, photos and YouTube videos. An ECPA search warrant is available only in criminal investigations.

WhatsApp

We disclose account records solely in accordance with our terms of service and applicable law, including the federal Stored Communications Act ("SCA"), 18 U.S.C. Sections 2701-2712. Under U.S. law:

A valid subpoena issued in connection with an official criminal investigation is required to compel the disclosure of basic subscriber records (defined in 18 U.S.C. Section 2703(c)(2)), which may include (if available): name, service start date, last seen date, IP address and email address.

A court order issued under 18 U.S.C. Section 2703(d) is required to compel the disclosure of certain records or other information pertaining to the account, not including contents of communications, which may include numbers blocking or blocked by the user, in addition to the basic subscriber records identified above.

A search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include "about" information, profile photos, group information and address book, if available. In the ordinary course of providing our service, WhatsApp does not store messages once they are delivered or transaction logs of such delivered messages, and undelivered messages are deleted from our servers after 30 days. WhatsApp offers end-to-end encryption for our services, which is always activated.

We interpret the national security letter provision as applied to WhatsApp to require the production of only two categories of information: name and length of service.

In responding to a matter involving imminent harm to a child or risk of death or serious physical injury to any person and requiring disclosure of information without delay, a law enforcement official may submit a request via the WhatsApp Law Enforcement Online Request System. For expedited processing of such requests, we recommend including the word "EMERGENCY" in the subject line of your message.

Twitter

Private information requires a subpoena or court order.

Non-public information about Twitter users will not be released to law enforcement except in response to appropriate legal process such as a subpoena, court order, or other valid legal process – or in response to a valid emergency request, as described below.

Contents of communications requires a search warrant

Requests for the contents of communications (e.g., Tweets, Direct Messages, photos) require a valid search warrant or equivalent from an agency with proper jurisdiction over Twitter.

In line with our Privacy Policy, we may disclose account information to law enforcement in response to a valid emergency disclosure request.

Twitter evaluates emergency disclosure requests on a case-by-case basis in compliance with relevant law (e.g., 18 U.S.C. § 2702(b)(8) and Section 8 Irish Data Protection 1988 and 2003). If we receive information that provides us with a good faith belief that there is an exigent emergency involving the danger of death or serious physical injury to a person, we may provide information necessary to prevent that harm, if we have it.

Lyft

We require valid and sufficient legal process before we can disclose business records regarding Users or trips in response to law enforcement requests. We won't be able to provide any information without a valid subpoena, court order, or search warrant. We will require a warrant for requests for content of communications between Users or for prospective location data.

We may produce information in the absence of a subpoena or warrant where an emergency situation exists involving an immediate threat of death or serious bodily harm to a person, as discussed in the emergency request section below. In these events, we require that valid and sufficient legal process be produced within three days of production of the information.

We accept law enforcement requests via email to LER@lyft.com. Our acceptance of legal process does not waive any legal objections Lyft may have and may raise in response to the request.

Uber

We will provide responsive records in accordance with our terms, policies, and applicable law. Some general principles are set forth here, but may not apply in every case.

We require a subpoena issued in connection with an official criminal investigation to compel the disclosure of basic information. A search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel our disclosure of certain communications between people using Uber or GPS location information. Exceptions to these requirements may be available for emergency and exigent requests, where a user has provided consent, or - for requests that do not require a warrant - where other legal or regulatory standards apply.

GrubHub

We and our third party service providers may disclose Personal Information: to third parties such as attorneys, collection agencies, tribunals or law enforcement authorities pursuant to valid requests in connection with alleged violations of our Terms of Use or other alleged contract violations, actual or alleged infringement, actual or suspected harm to persons or property, or alleged violations of laws, rules, or regulations.

DoorDash

For basic information requests, we generally require a subpoena or valid court order issued in connection with an official criminal investigation. For requests around specific communications between people using DoorDash, we generally require a search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures. We may make exceptions to these requirements for emergency and exigent requests (as described below), where a user has provided his or her consent, or where other legal or regulatory standards apply and the request do not require a warrant.

Emergency and exigent requests are situations that involve protecting a customer, Dasher, or third party who has been physically harmed, stopping illegal activity that poses an immediate threat of physical harm, or cases of verifiable time-sensitive investigations. In these situations, requestors must submit an Emergency Request to LERT@DoorDash.com, that describes in detail the nature of the emergency or urgency, including details about the nature of the alleged actual or threatened physical harm or exigency. We review these requests on a case-by-case basis. We may respond with some or all requested information when we have a good faith belief that doing so may protect customers, Dashers, merchants, employees, or other people, or when that information may otherwise assist with an exigent investigation. We may still require law enforcement to obtain appropriate legal process for any initial or additional disclosure. To facilitate our review, law enforcement should provide as much detail about the incident or emergency as possible.

Venmo

We may share your personal information with: Law enforcement, government officials, or other third parties if PayPal is compelled to do so by a subpoena, court order or similar legal procedure, when it is necessary to do so to comply with law, or where the disclosure of personal information is reasonably necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of the Venmo User Agreement, or as otherwise required by law.

Netflix

Netflix and its Service Providers may disclose and otherwise use your personal and other information where we or they reasonably believe such disclosure is needed to (a) satisfy any applicable law, regulation, legal process, or governmental request, (b) enforce applicable terms of use, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address illegal or suspected illegal activities (including payment fraud), security or technical issues, or (d) protect against harm to the rights, property or safety of Netflix, its users or the public, as required or permitted by law.

Hulu

In some instances, we may disclose information from or about you without providing you a choice. For example, we may disclose your information in the following ways: to protect the legal rights of Hulu and our affiliates or partners, and each of our respective equity holders, directors, officers, employees, agents, and business partners; to protect the safety and security of users of the Hulu Services or third parties; to enforce our Terms of Use; to protect against fraud; for risk management purposes; and to comply with or respond to the law or legal process or a request for cooperation by a government entity, whether or not legally required. If you notify us that you believe your legal rights have been violated by Hulu or another user of the Hulu Services, we may provide the information that you provide to us to others to the extent that we believe it is necessary to evaluate and respond to your complaint.

Pinterest

To compel Pinterest to provide any user’s information, you must obtain a valid subpoena, court order or search warrant (“Law Enforcement Request”). To compel Pinterest to provide any user’s content, you must obtain a valid search warrant. In order to ensure your Law Enforcement Request is narrow and does not seek more information than necessary (potentially at additional cost and time), we ask for the following:

A sufficiently narrow/defined time period

A specific event or action that the subject took

A specific reference

In a situation where there is an emergency involving danger of death or serious physical injury, law enforcement can submit a request for disclosure of user information to Pinterest by submitting a request through our Law Enforcement Request Form (make sure to click “Yes” to the emergency request option and fill out the requested information) or by contacting us at our emergency law enforcement email: lawenforcement@pinterest.com.

Consistent with these law enforcement guidelines, Pinterest requires all requests for user information be limited to specific and known users for lawful purposes. Pinterest has not and does not participate in the collection of bulk user information at the government’s request. Pinterest opposes compelled back doors and supports reforms to limit bulk surveillance requests.

Apple

Apple accepts service of subpoenas, search warrants, and court orders by email from government and law enforcement agencies, provided these are transmitted from the official email address of the government or law enforcement agency concerned. Government and law enforcement personnel submitting a legal request to Apple should transmit it directly from their official government or law enforcement email address to mailbox: lawenforcement@apple.com.

Apple carefully reviews all requests from government, law enforcement, and private parties to ensure that there’s a valid legal basis for each request; and complies with legally valid requests. In instances where Apple determines that there is no valid legal basis or where a request is considered to be unclear, inappropriate or over-broad Apple will challenge or reject the request.

The Electronic Communications Privacy Act (“ECPA”) covers the authorized disclosure of content by Apple. An exception to the requirement that government or law enforcement obtain a search warrant for customer content is provided by ECPA in situations in which the case involves an emergency. Under 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4) Apple is permitted, but not required, to voluntarily disclose information, including contents of communications and customer records, to a federal, state, or local governmental entity if Apple believes in good faith that an emergency involving imminent danger of death or serious physical injury to any person requires such disclosure without delay.

Amazon

Amazon will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.

Amazon distinguishes between content and non-content information. We produce noncontent information only in response to valid and binding subpoenas. We do not produce content information in response to subpoenas. We may produce non-content and content information in response to valid and binding search warrants.

“Non-content” information means subscriber information such as name, address, email address, billing information, date of account creation, and certain purchase history and service usage information.

“Content” information means the content of data files stored in a customer’s account.

Emergencies. Amazon reserves the right to respond immediately to urgent law enforcement requests for information in cases involving a threat to public safety or risk of harm to any person. These requests must be submitted using Amazon’s Emergency Law Enforcement Information Request Form.

Fraudulent and Other Unauthorized Conduct. Amazon reserves the right to assist law enforcement agencies in their investigation of fraudulent and other unauthorized conduct, such as fraudulent use of a payment instrument or a stolen credit card, including by providing certain non-content information without a subpoena.

Spotify

We will share your personal data when we in good faith believe it is necessary for us to do so in order to comply with a legal obligation under applicable law, or respond to valid legal process, such as a search warrant, a court order, or a subpoena.

We also will also share your personal data where we in good faith believe that it is necessary for the purpose of our own, or a third party’s legitimate interest relating to national security, law enforcement, litigation, criminal investigation, protecting the safety of any person, or to prevent death or imminent bodily harm, provided that we deem that such interest is not overridden by your interests or fundamental rights and freedoms requiring the protection of your personal data.

Samsung

We may share personal information we collect through the Services if you ask us to do so or otherwise with your consent. We also may disclose information about you in other circumstances, including (1) if we are required to do so by law or legal process, (2) to law enforcement authorities or other government officials, (3) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity, and (4) in the event we may or do sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

**