As US pushes ahead with the Cloud Act, which lets authorities get overseas data, after enacting it about a year ago, many in EU worry about extraterritoriality
Context & Ripple Effects
The Cloud Act proposal from a bipartisan Senate group in February 2018 was designed to let US authorities reach data stored overseas while authorizing the DOJ to sign agreements with countries offering similar due process. It cleared Congress weeks later, attached to the omnibus funding bill despite opposition from privacy activists — though notably with backing from Microsoft and other big tech firms that wanted legal certainty over conflicting warrants.
One year on, implementation is moving ahead and EU concern has crystallized around extraterritoriality: European data held by US providers is reachable by American authorities regardless of where it sits. The later arc matters here — the EU declared an earlier transatlantic data pact illegal in 2020 before the two sides reached a preliminary replacement deal in 2022, so Brussels' sensitivity to US legal reach over European data was already acute.
First-order effects
- DOJ gains a working mechanism to obtain overseas-stored data, and the US cloud providers that backed the Act — Microsoft foremost among them — become the compliance layer executing cross-border requests for EU-held data.
- European governments and regulators now confront a direct conflict between US lawful-access demands and their own data-protection rules, putting EU-hosted workloads on American platforms under legal scrutiny.
Second-order effects
- Cloud providers are pushed toward jurisdictional architecture — segmenting or localizing EU data — because a single global storage design exposes them to demands from both Washington and Brussels simultaneously.
- The EU's countermove is diplomatic and legislative: negotiating its own access framework, as seen in the preliminary EU-US data-storage pact, rather than accepting unilateral US reach as the default.
Third-order effects
- If the pattern holds, global data governance fragments into a web of bilateral lawful-access agreements, with each major bloc asserting extraterritorial claims and forcing multinationals to build compliance per jurisdiction.
- Sovereignty concerns compound the concentration worry already visible in US plans to regulate security practices at Amazon, Microsoft, and Google — pushing both regulators and customers toward treating cloud geography as a policy variable, not just a cost one.
The trend: Data governance is fracturing along jurisdictional lines, as states assert extraterritorial claims over cloud-stored information and force providers to arbitrate between competing legal regimes.