                                 CODE OF VIRGINIA

OBTAINING RECORDS CONCERNING ELECTRONIC COMMUNICATION SERVICE OR REMOTE
COMPUTING SERVICE (§ 19.2-70.3)

A. A provider of electronic communication service or remote computing service,
which, for purposes of subdivisions 2, 3, and 4, includes a foreign corporation
that provides such services, shall disclose a record or other information
pertaining to a subscriber to or customer of such service, excluding the
contents of electronic communications and real-time location data, to an
investigative or law-enforcement officer only pursuant to:

   1. A subpoena issued by a grand jury of a court of the Commonwealth;

   2. A search warrant issued by a magistrate, general district court, or circuit
   court;

   3. A court order issued by a circuit court for such disclosure issued as
   provided in subsection B; or

   4. The consent of the subscriber or customer to such disclosure.

B. A court shall issue an order for disclosure under this section only if the
investigative or law-enforcement officer shows that there is reason to believe
the records or other information sought are relevant and material to an ongoing
criminal investigation, or the investigation of any missing child as defined in
&#xA7; 52-32, any missing senior adult as defined in &#xA7; 52-34.4, an
incapacitated person as defined in &#xA7; 64.2-2000 who meets the definition of
a missing senior adult except for the age requirement, or any critically missing
adult as defined in &#xA7; 15.2-1718.2. Upon issuance of an order for disclosure
under this section, the order and any written application or statement of facts
may be sealed by the court for 90 days for good cause shown upon application of
the attorney for the Commonwealth in an ex parte proceeding. The order and any
written application or statement of facts may be sealed for additional 90-day
periods for good cause shown upon subsequent application of the attorney for the
Commonwealth in an ex parte proceeding. A court issuing an order pursuant to
this section, on a motion made promptly by the service provider, may quash or
modify the order, if the information or records requested are unusually
voluminous in nature or compliance with such order would otherwise cause an
undue burden on such provider.

C. Except as provided in subsection D or E, a provider of electronic
communication service or remote computing service, including a foreign
corporation that provides such services, shall disclose the contents of
electronic communications or real-time location data to an investigative or
law-enforcement officer only pursuant to a search warrant issued by a
magistrate, a juvenile and domestic relations district court, a general district
court, or a circuit court, based upon complaint on oath supported by an
affidavit as required in &#xA7; 19.2-54, or judicial officer or court of any of
the several states of the United States or its territories, or the District of
Columbia when the warrant issued by such officer or such court complies with the
provisions of subsection G. In the case of a search warrant directed to a
foreign corporation, the affidavit shall state that the complainant believes
that the records requested are actually or constructively possessed by a foreign
corporation that provides electronic communication service or remote computing
service within the Commonwealth of Virginia. If satisfied that probable cause
has been established for such belief and as required by Chapter 5 (&#xA7;
19.2-52 et seq.), the magistrate, the juvenile and domestic relations district
court, the general district court, or the circuit court shall issue a warrant
identifying those records to be searched for and commanding the person seeking
such warrant to properly serve the warrant upon the foreign corporation. A
search warrant for real-time location data shall be issued if the magistrate,
the juvenile and domestic relations district court, the general district court,
or the circuit court is satisfied that probable cause has been established that
the real-time location data sought is relevant to a crime that is being
committed or has been committed or that an arrest warrant exists for the person
whose real-time location data is sought.

D. A provider of electronic communication service or remote computing service,
including a foreign corporation that provides such services, shall disclose a
record or other information pertaining to a subscriber to or customer of such
service, including real-time location data but excluding the contents of
electronic communications, to an investigative or law-enforcement officer
pursuant to an administrative subpoena issued pursuant to &#xA7; 19.2-10.2
concerning a violation of &#xA7; 18.2-374.1 or 18.2-374.1:1, former &#xA7;
18.2-374.1:2, or &#xA7; 18.2-374.3 when the information sought is relevant and
material to an ongoing criminal investigation.

E. When disclosure of real-time location data or subscriber data is not
prohibited by federal law, an investigative or law-enforcement officer may
obtain real-time location data or subscriber data without a warrant in the
following circumstances:

   1. To respond to the user&#8217;s call for emergency services;

   2. With the informed, affirmative consent of the owner or user of the
   electronic device concerned if (i) the device is in his possession; (ii) the
   owner or user knows or believes that the device is in the possession of an
   employee or agent of the owner or user with the owner&#8217;s or user&#8217;s
   consent; or (iii) the owner or user knows or believes that the device has been
   taken by a third party without the consent of the owner or user;

   3. With the informed, affirmative consent of the legal guardian or next of kin
   of the owner or user, if reasonably available, if the owner or user is
   reasonably believed to be deceased, is reported missing, or is unable to be
   contacted;

   4. To locate a child who is reasonably believed to have been abducted or to be
   missing and endangered;

   5. If the investigative or law-enforcement officer reasonably believes that an
   emergency involving the immediate danger to a person requires the disclosure,
   without delay, of real-time location data concerning a specific person and
   that a warrant cannot be obtained in time to prevent the identified danger; or

   6. If the investigative or law-enforcement officer reasonably believes that
   (i) an individual or group of individuals has made a credible threat via
   electronic communication to commit an act of violence upon the property,
   including the buildings and grounds thereof, of any (a) child day center, as
   defined in &#xA7; 22.1-289.02, including any preschool program offered by a
   publicly funded provider; (b) any preschool or nursery school program
   certified by the Board of Education pursuant to &#xA7; 22.1-289.032; or (c)
   public, private, or religious elementary or secondary school, as defined in
   &#xA7; 22.1-1, and (ii) a warrant cannot be obtained in time to prevent the
   identified danger or identify the source of the threat.
   				No later than three business days after seeking disclosure of real-time
   location data or subscriber data pursuant to this subsection, the
   investigative or law-enforcement officer seeking the information shall file
   with the appropriate court a written statement setting forth the facts giving
   rise to the emergency and the facts as to why the person whose real-time
   location data or subscriber data was sought is believed to be important in
   addressing the emergency. No real-time location data or subscriber data
   obtained pursuant to this subsection shall be admissible in a criminal
   proceeding unless a judge finds that probable cause for the issuance of a
   search warrant existed at the time of the search and such data is otherwise
   admissible, provided that no such data obtained is presented to establish the
   necessary probable cause.

F. In order to comply with the requirements of &#xA7; 19.2-54, any search of the
records of a foreign corporation shall be deemed to have been made in the same
place wherein the search warrant was issued.

G. A Virginia corporation or other entity that provides electronic communication
services or remote computing services to the general public, when properly
served with a search warrant and affidavit in support of the warrant, issued by
a judicial officer or court of any of the several states of the United States or
its territories, or the District of Columbia with jurisdiction over the matter,
to produce a record or other information pertaining to a subscriber to or
customer of such service, including real-time location data, or the contents of
electronic communications, or both, shall produce the record or other
information, including real-time location data, or the contents of electronic
communications as if that warrant had been issued by a Virginia court. The
provisions of this subsection shall only apply to a record or other information,
including real-time location data, or contents of electronic communications
relating to the commission of a criminal offense that is substantially similar
to (i) a violent felony as defined in &#xA7; 17.1-805, (ii) an act of violence
as defined in &#xA7; 19.2-297.1, (iii) any offense for which registration is
required pursuant to &#xA7; 9.1-902, (iv) computer fraud pursuant to &#xA7;
18.2-152.3, or (v) identity theft pursuant to &#xA7; 18.2-186.3. The search
warrant shall be enforced and executed in the Commonwealth as if it were a
search warrant described in subsection C.

H. The provider of electronic communication service or remote computing service
may verify the authenticity of the written reports or records that it discloses
pursuant to this section by providing an affidavit from the custodian of those
written reports or records or from a person to whom said custodian reports
certifying that they are true and complete copies of reports or records and that
they are prepared in the regular course of business. When so authenticated, no
other evidence of authenticity shall be necessary. The written reports and
records, excluding the contents of electronic communications, shall be
considered business records for purposes of the business records exception to
the hearsay rule.

I. No cause of action shall lie in any court against a provider of a wire or
electronic communication service or remote computing service or such
provider&#8217;s officers, employees, agents, or other specified persons for
providing information, facilities, or assistance in accordance with the terms of
a court order, warrant, administrative subpoena, or subpoena under this section
or the provisions of subsection E.

J. A search warrant or administrative subpoena for the disclosure of real-time
location data pursuant to this section shall require the provider to provide
ongoing disclosure of such data for a reasonable period of time, not to exceed
30 days. A court may, for good cause shown, grant one or more extensions, not to
exceed 30 days each.

K. An investigative or law-enforcement officer shall not use any device to
obtain electronic communications or collect real-time location data from an
electronic device without first obtaining a search warrant authorizing the use
of the device if, in order to obtain the contents of such electronic
communications or such real-time location data from the provider of electronic
communication service or remote computing service, such officer would be
required to obtain a search warrant pursuant to this section. However, an
investigative or law-enforcement officer may use such a device without first
obtaining a search warrant under the circumstances set forth in subsection E.
For purposes of subdivision E 5, the investigative or law-enforcement officer
using such a device shall be considered to be the possessor of the real-time
location data.

L. Upon issuance of any subpoena, search warrant, or order for disclosure issued
under this section, upon written certification by the attorney for the
Commonwealth that there is a reason to believe that the victim is under the age
of 18 and that notification or disclosure of the existence of the subpoena,
search warrant, or order will endanger the life or physical safety of an
individual, or lead to flight from prosecution, the destruction of or tampering
with evidence, the intimidation of potential witnesses, or otherwise seriously
jeopardize an investigation, the court may in an ex parte proceeding order a
provider of electronic communication service or remote computing service not to
disclose for a period of 90 days the existence of the subpoena, search warrant,
or order and written application or statement of facts to another person, other
than an attorney to obtain legal advice. The nondisclosure order may be renewed
for additional 90-day periods for good cause shown upon subsequent application
of the attorney for the Commonwealth in an ex parte proceeding. A court issuing
an order for disclosure pursuant to this section, on a motion made promptly by
the service provider, may quash or modify the order if the information or
records requested are unusually voluminous in nature or compliance with such
order would otherwise cause an undue burden on such provider.

M. For the purposes of this section:
			&#8220;Electronic device&#8221; means a device that enables access to, or use
of, an electronic communication service, remote computing service, or location
information service, including a global positioning service or other mapping,
locational, or directional information service.
			&#8220;Foreign corporation&#8221; means any corporation or other entity,
whose primary place of business is located outside of the boundaries of the
Commonwealth, that makes a contract or engages in a terms of service agreement
with a resident of the Commonwealth to be performed in whole or in part by
either party in the Commonwealth, or a corporation that has been issued a
certificate of authority pursuant to &#xA7; 13.1-759 to transact business in the
Commonwealth. The making of the contract or terms of service agreement or the
issuance of a certificate of authority shall be considered to be the agreement
of the foreign corporation or entity that a search warrant or subpoena, which
has been properly served on it, has the same legal force and effect as if served
personally within the Commonwealth.
			&#8220;Properly served&#8221; means delivery of a search warrant or subpoena
by hand, by United States mail, by commercial delivery service, by facsimile or
by any other manner to any officer of a corporation or its general manager in
the Commonwealth, to any natural person designated by it as agent for the
service of process, or if such corporation has designated a corporate agent, to
any person named in the latest annual report filed pursuant to &#xA7; 13.1-775.
			&#8220;Real-time location data&#8221; means any data or information
concerning the current location of an electronic device that, in whole or in
part, is generated, derived from, or obtained by the operation of the device.
			&#8220;Subscriber data&#8221; means the name, address, telephone number, and
any other information identifying a subscriber of a communications services
provider. &#8220;Subscriber data&#8221; does not include data or personally
identifiable information protected by federal or state law, including viewing
history, billing details, Internet usage patterns or data, and any other data
protected by federal or state law.

HISTORY: 1988, c. 889; 2009, c. 378; 2010, cc. 319, 473, 582, 720, 721; 2011, c.
392; 2014, c. 388; 2015, cc. 43, 634; 2016, cc. 549, 576, 616; 2018, c. 667;
2024, c. 325; 2025, c. 286.