CalECPA Compliance

The California Electronic Communications Privacy Act (CalECPA) imposes specific requirements on law enforcement accessing electronic communications. This page explains what CalECPA requires and why it matters.

---

What Is CalECPA?

CalECPA (California Penal Code sections 1546-1546.4) is a state law that went into effect in 2016. It requires:

1. A warrant for most electronic communications
2. Notification to individuals whose data was obtained
3. Specific procedures for delayed notification

California has stronger electronic privacy protections than federal law. If you're working in California, CalECPA applies to your digital evidence requests.

---

Why CalECPA Exists

Before CalECPA, the legal framework for electronic evidence was a patchwork. The federal Electronic Communications Privacy Act (ECPA) was written in 1986—before smartphones, social media, or cloud storage existed.

CalECPA reflects modern realities:

• Electronic communications reveal intimate details of people's lives
• Location data can track movements with precision
• Third-party storage (cloud services) shouldn't eliminate privacy expectations
• People deserve to know when government accessed their data

Whether you agree with every provision or not, CalECPA is the law. Compliance isn't optional.

---

What CalECPA Requires

Warrant Requirement

Most electronic communication content and metadata requires a warrant, including:

• Email content
• Text messages
• Social media messages
• Location data
• Device contents
• Stored files

Some exceptions exist for emergencies, but the default is warrant required.

Notification Requirement

Here's what many investigators find challenging: you must notify the individual whose data you obtained.

The notification must include:

• Nature of the investigation
• Type of information sought (emails, texts, location data, etc.)
• Law enforcement agency name
• Offense under investigation
• Copy of the warrant

Delayed Notification

You can request a 90-day delay of notification in your warrant application. Courts grant delays when notification would:

• Endanger life or physical safety
• Cause flight from prosecution
• Destroy evidence
• Intimidate witnesses
• Seriously jeopardize the investigation

The delay can be extended, but you must return to court for each extension.

---

CalECPA and IronCase

IronCase tracks CalECPA requirements automatically.

What IronCase Tracks

For each digital evidence request requiring CalECPA notification:

• Initial delay granted date
• Delay expiration date
• Extension requests and outcomes
• Current delay status
• Notification deadline
• Notification sent date
• Proof of notification

Alerts

IronCase alerts you before notification deadlines:

Why This Matters

Missing a CalECPA notification deadline can:

• Jeopardize your case
• Create civil liability
• Violate department policy
• Undermine prosecutions

IronCase helps you stay compliant, but you're still responsible for meeting deadlines.

---

Practical Implications

Plan for Notification

When you seek electronic evidence, think ahead:

• Will you need to notify eventually?
• Can you request a delay?
• When will that delay expire?
• What's your plan when it does?

Extension Strategy

If you need more time:

• Start the extension process early
• Document ongoing investigative necessity
• Don't wait until the deadline

Notification Mechanics

When it's time to notify:

• Identify all affected individuals
• Prepare required notification content
• Use appropriate delivery method (certified mail often recommended)
• Document that notification occurred

---

Exceptions and Edge Cases

Emergency Access

If delay would risk:

• Imminent danger to life
• Serious damage to property
• Evidence destruction

You may access data without a warrant, but must seek one within 3 days.

Wiretap vs. Stored Communications

CalECPA applies to stored communications. Real-time interception has different (stricter) requirements under wiretap statutes.

Federal vs. State

If you're working with federal agencies, federal rules apply to federal actions. But if you're a state/local agency, CalECPA applies even when working jointly.

---

Summary

CalECPA reflects California's commitment to electronic privacy. The key requirements:

1. Warrant required for most electronic communications
2. Notification required to individuals whose data was obtained
3. Delays possible but require court approval
4. IronCase helps track deadlines and requirements

Compliance protects your cases and respects the law. IronCase makes compliance manageable, but understanding the requirements is your responsibility.