Phone SeizedWhat is on your phoneWhat lives in the cloud and with your carrier, not the phone
What lives in the cloud and with your carrier, not the phone
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
Limits on them
A rule that constrains them, or a remedy you can use.
In the United States, the Supreme Court said in a footnote (n.3) to Carpenter v. United States: “It is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search.” The opinion also says: “Our decision today is a narrow one. We do not express a view on matters not before us: real-time CSLI or ‘tower dumps’ (a download of information on all the devices that connected to a particular cell site during a particular interval).”
Carpenter v. United States, 585 U.S. 296 (2018), slip op. (majority) and n.3
“Our decision today is a narrow one. We do not express a view on matters not before us: real-time CSLI or—tower dumps—(a download of information on all the devices that connected to a particular cell site during a particular interval).—It is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search.”
Read it at law.cornell.eduquote checked 2026-10-02
US Customs and Border Protection's directive states that passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search, and may not be utilized to access information that is only stored remotely.
CBP Directive No. 3340-049B §5.3.2 (eff. 1 Jan 2026)
“Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely.”
Read it at cbp.govquote checked 2026-09-08
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
Apple's own law enforcement guidelines state that for iOS 8.0 and later, Apple is unable to perform an iOS device data extraction because the data typically sought is encrypted and Apple does not hold the encryption key.
Apple, "Legal Process Guidelines — Government & Law Enforcement within the United States", published October 2025, Apple
“For all devices running iOS 8.0 and later versions, Apple is unable to perform an iOS device data extraction as the data typically sought by law enforcement is encrypted, and Apple does not possess the encryption key.”
Read it at apple.comquote checked 2026-09-08
Apple's own law enforcement guidelines state that content in a customer's iCloud account, as it exists there, may be provided in response to a search warrant issued on probable cause, or the customer's consent.
Apple, "Legal Process Guidelines — Government & Law Enforcement within the United States", published October 2025, Apple
“iCloud content, as it exists in the customer's account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent.”
Read it at apple.comquote checked 2026-09-08
With Advanced Data Protection enabled, the number of iCloud data categories using end-to-end encryption rises to 25, including iCloud Backup, Photos and Notes.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-09-08
“With Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more.”
Read it at support.apple.comquote checked 2026-09-08
Apple states that if you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-10-01
“you can choose to enable Advanced Data Protection to protect the vast majority of your iCloud data—If you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it”
Read it at support.apple.comquote checked 2026-10-01
Apple states that standard data protection is the default setting for an account, that some data categories are end-to-end encrypted under it, and that Apple doesn't have the encryption keys for these categories and can't help you recover this data if you lose access to your account.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), "Standard data protection" paragraph, as fetched 2026-10-01
“Standard data protection is the default setting for your account.—For additional privacy and security, 15 data categories – including Health and passwords in iCloud Keychain – are end-to-end encrypted. Apple doesn't have the encryption keys for these categories, and we can't help you recover this data if you lose access to your account.”
Read it at support.apple.comquote checked 2026-10-01
What Apple says it can and cannot hand over
The cloud state described in What a full extraction contains covers data held by the maker or the carrier rather than on the phone. Apple’s own legal-process guidelines to US law enforcement state: “For all devices running iOS 8.0 and later versions, Apple is unable to perform an iOS device data extraction as the data typically sought by law enforcement is encrypted, and Apple does not possess the encryption key.” That sentence is about the device. Apple’s account-held iCloud content is a separate question, and the same guidelines state: “iCloud content, as it exists in the customer’s account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent.”
For what the sources say about extraction methods on the phone itself, see What an extraction can see.
What Apple says about standard and Advanced Data Protection
Apple’s “iCloud data security overview” describes two settings. Under standard data protection, which it calls “the default setting for your account,” it states: “Apple doesn’t have the encryption keys for these categories, and we can’t help you recover this data if you lose access to your account” — “these categories” being the ones it says are end-to-end encrypted under that setting. For Advanced Data Protection, which the same page says you “can choose to enable,” it states that “the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more,” and that “If you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it.” This site does not combine those statements with the legal-process guidelines quoted above into a claim about what Apple can or cannot hand over under a warrant.
Cell-site location information: a US example
In the United States, the Supreme Court said in a footnote (n.3) to Carpenter v. United States: “It is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search.” The opinion also says: “Our decision today is a narrow one. We do not express a view on matters not before us: real-time CSLI or ‘tower dumps’ (a download of information on all the devices that connected to a particular cell site during a particular interval).” That is a US constitutional holding, not a technical fact about the phone itself; this site has not sourced an equivalent holding for the other jurisdictions it covers.
The US border adds a boundary of its own
US Customs and Border Protection’s own directive says of passcodes and other means of access obtained during a border inspection: “Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely.” See Passcode vs biometrics and Before a border for what else that directive covers.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.