The Three Parts Of ECPA
In 1986, Congress concluded that the wiretap law of 1968 no longer matched how Americans communicated. Email and computer networks had arrived, and the statute knew nothing about them. The Electronic Communications Privacy Act, ECPA, was the answer. Forty years on, it still sets the ground rules for government access to communications held by private companies. The CIPP/US exam tests its three parts by name.
What ECPA covers
ECPA is one statute holding three regimes. Each regime protects a different kind of data with a different legal process. The Bureau of Justice Assistance summary sets them out.
Title I, the Wiretap Act
The first part governs interception of wire, oral and electronic communications in transit. It updated the federal wiretap provisions of 1968, which covered telephone lines and said nothing about computers. Interception demands the most protective process in the statute. A judge issues the order on probable cause, tied to particular listed offences, for a maximum of 30 days. Content moving through a network gets the strongest shield the statute offers.
Title II, the Stored Communications Act
The second part protects communications at rest. The Stored Communications Act covers the contents of files that service providers store. It also covers subscriber records such as names, billing details and IP addresses. Disputes over government access to cloud email run straight through it. Microsoft’s 2016 challenge to the gag orders that stop providers telling users about searches is one example.
Title III, pen registers and trap and trace
The third part covers the devices that record non-content information: numbers dialled, routing and addressing data. Installing one requires a court order, but the standard drops. A government attorney certifies that the information is likely to be relevant to an ongoing criminal investigation. The order then issues. No probable cause showing is needed, because the content of the communication is never captured.
Three questions for three kinds of data
The structure encodes a single idea, that protection follows sensitivity. Content in transit sits at the top, stored content in the middle, metadata at the bottom. For any government-access scenario, ask the same three questions in order. Is the data content or non-content? Is it in transit or at rest? Which title’s process therefore applies?
Congress wrote ECPA for a world where storage was temporary and interception was hard. It has adjusted the statute repeatedly since. The Congressional Research Service overview of ECPA traces those amendments, from the USA PATRIOT Act to the FISA Amendments Act of 2008. Each one moved the balance between privacy and law enforcement access. The Electronic Privacy Information Center tracks the gaps that remain, including the notice questions raised when providers rather than users receive the legal process.
Where ECPA reaches private employers
ECPA also reaches private conduct. The Wiretap Act’s prohibitions bind private parties, and employee monitoring runs into them, subject to exceptions for consent and ordinary business use. The CIPP/US syllabus lists ECPA requirements inside workplace monitoring for exactly this reason. An employer intercepting live communications needs an exception to stand on. An employer running background screening stands in different statutory territory altogether, governed by the FCRA adverse action sequence.
How the CIPP/US exam tests ECPA
The Body of Knowledge is the IAPP’s published outline of exam coverage. It places ECPA in the domain on government and court access to private-sector information, with emails, stored records and pen registers named individually. The blueprint gives this domain a small question count, which makes the questions predictable. Learn the three-part structure, the process each part demands and the transit-versus-storage line.
Statutes from this era keep resurfacing in modern disputes. The Video Privacy Protection Act of 1988 now anchors pixel-tracking class actions. ECPA rewards the same historical awareness: an old framework, applied to technology its drafters never saw.
One study step fits here: the CIPP/US Exam Question Masterclass at 195 euros teaches the question method, including the classify-then-apply items this domain produces.
