The Texas Electronic Communications Privacy Act, found in Chapter 18B of the Code of Criminal Procedure, requires state and local law enforcement to get a warrant backed by probable cause before pulling the content of your emails, texts, direct messages, cloud files, or cell-phone location data from the companies that hold them. It closes loopholes the federal statute still leaves open, gives you the right to be notified when your data is taken, and lets you sue for damages when the rules are broken knowingly.
What the Act Protects
Chapter 18B reaches two kinds of companies. An electronic communications service is any platform that moves your messages, such as an email provider or a messaging app. A remote computing service is any company that stores or processes data for you, which covers cloud storage, online document editors, and backup services. If your data lives on someone else’s server, it almost certainly sits with one or the other.
The strongest protection applies to content: the words of your emails, attachments, photos you sent, direct messages, and documents you saved in a cloud account. Handing that material to a third-party server does not strip away your privacy rights under Texas law. That is a real departure from older federal thinking that treated anything shared with a third party as fair game.
Non-content data, often called metadata, sits in a lower tier. That is information about a communication rather than the communication itself: the recipient’s address, the time a message went out, how long a session lasted, and similar routing details. Content requires a warrant. Non-content records can be reached through weaker legal process, which is worth knowing because an investigator who cannot yet show probable cause can still learn a surprising amount about your digital activity.
When Police Need a Warrant
Article 18B.354 sets the warrant process for stored electronic data. An authorized peace officer applies to a district judge with a sworn affidavit that must show probable cause both that a specific offense was committed and that the data sought is evidence of it or ties a particular person to it.1State of Texas. Texas Code of Criminal Procedure Article 18B.354 – Warrant Issued in This State: Application and Issuance of Warrant Only the data described in the affidavit can be seized, which blocks the open-ended fishing a vague request would allow.
The warrant runs in the name of “The State of Texas” and reaches beyond Texas borders. Under Article 18B.355, it can be served on any provider doing business in Texas even if the company’s servers sit in another state. That matters because most major email and cloud providers are headquartered elsewhere. A valid Texas warrant obligates them to produce the specified data.
The warrant requirement also covers tracking your physical movements through your phone. Article 18B.202 requires a district judge’s order before officers install a mobile tracking device or obtain cell-site location information from a wireless carrier. Cell-site simulators, sometimes called stingrays, mimic a cell tower so nearby phones connect to the device and reveal their location and identity. Texas law requires a court order before this technology is deployed.
The U.S. Supreme Court reinforced the same principle in Carpenter v. United States, holding that the government generally needs a warrant supported by probable cause before compelling a wireless carrier to turn over historical cell-site records.2Justia. Carpenter v. United States Texas already required that level of protection before Carpenter came down.
When They Can Get Your Data Without a Warrant
Not every request for your digital information triggers the warrant rule. Basic subscriber information, connection logs, and payment records can be obtained through subpoenas or court orders rather than a warrant, depending on the record. If an investigator is trying to confirm that an account belongs to you, or to pull login timestamps, probable cause is not the standard they have to meet.
Providers themselves are generally barred from volunteering the content of your communications to a government entity without being served with proper legal process. A cooperative company cannot shortcut the warrant requirement by handing your data over on its own. A pending legislative proposal, SB 816, would add Article 18B.5025 to expressly authorize a provider to disclose data to a government entity when it has a good-faith belief that an immediate life-threatening situation exists and that disclosure is necessary to prevent death or serious bodily injury. That tracks the federal emergency-disclosure provision at 18 U.S.C. § 2702(b)(8).
Being Notified That Your Data Was Taken
When the government obtains your stored data, you are entitled to know. Article 18B.402 requires notice to the subscriber or customer no later than the third day after the government receives confirmation from the provider that the data has been preserved or produced. The short timeline is meant to let you move quickly, whether that means challenging the warrant or getting counsel involved.
Notice can be delayed. A court can postpone notification if the government shows that immediate notice would endanger someone’s life or physical safety, prompt a suspect to flee, lead to the destruction of evidence, intimidate witnesses, or seriously jeopardize an ongoing investigation. Those grounds mirror the federal delayed-notice statute at 18 U.S.C. § 2705, which allows initial delays of up to 90 days with the possibility of 90-day extensions.3Office of the Law Revision Counsel. 18 U.S. Code 2705 – Delayed Notice
Courts can also issue non-disclosure orders directed at the provider itself, prohibiting the company from telling you a warrant or subpoena was served. The delay is supposed to be temporary, but extensions can stretch the silence for months, so you may not learn about the intrusion until well after the investigation has moved on.
How Texas Protection Compares to Federal Law
The federal Stored Communications Act at 18 U.S.C. § 2703 has historically been weaker in one specific way. Under the federal statute, content stored for more than 180 days by an electronic communications service could be obtained with a subpoena or court order rather than a full warrant.4Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Texas eliminated that split. Under Chapter 18B, the age of the content does not matter. A warrant based on probable cause is required whether the email was sent yesterday or five years ago.
Investigations often involve both state and federal authorities, and the stricter Texas rules govern any state officer’s request. A federal agent working independently under the Stored Communications Act could in theory still use the lower federal thresholds for older content, though Carpenter has pushed federal practice closer to the warrant standard that Texas already applies.
If the Rules Were Broken: Suppression and Lawsuits
In a criminal case, the main remedy is suppression. Data obtained without a proper warrant or in violation of the Act’s procedures cannot be used against you at trial. If an investigator bypasses the warrant process and pulls your email content directly from a provider, the emails and anything derived from leads they generated become vulnerable to a suppression motion. Defense attorneys routinely scrutinize whether the warrant application met the probable-cause standard and whether the scope of what was seized stayed within what the affidavit described.
You can also sue. Under Article 18B.551, anyone aggrieved by a knowing or intentional violation of the Act can file a civil action seeking injunctive relief, reasonable attorney’s fees, and the greater of actual damages or $1,000.5State of Texas. Texas Code of Criminal Procedure Article 18B.551 – Cause of Action The $1,000 floor means a violation carries a real financial consequence even without large provable losses. Any profits the violator made from the violation are also recoverable, which can matter in cases involving corporate misuse of stored data.
Two limits are worth knowing. The violation must have been committed knowingly or intentionally; accidental or negligent disclosures do not trigger civil liability. And a two-year statute of limitations runs from the date you first discovered the violation or reasonably should have discovered it. Because delayed-notice orders can keep you in the dark for months, that discovery-based trigger is important. The clock does not start until you actually learn what happened.