ECPA for employers: the Wiretap Act, the Stored Communications Act and consent to disclose

What does ECPA mean for an employer that wants to license its records?

ECPA is two statutes in one: the Wiretap Act, which governs communications captured while they are in transit, and the Stored Communications Act, which governs messages held in storage. An employer that owns its email and chat systems can usually read its own archives under the right policies, but whether it may hand those archives to a third party is a separate question that counsel should answer.

Owners tend to blur "can we access it?" with "can we disclose it?" This page keeps them apart. It also shows where an employer's own policies, notices and contracts decide the outcome, because that is where licensing reviews tend to stall.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How does the Wiretap Act apply to employee communications?

The Wiretap Act prohibits intentionally intercepting wire, oral or electronic communications, and knowingly using or disclosing the contents of an unlawfully intercepted communication. The statute text is at 18 U.S.C. section 2511.

Two features matter to employers:

• One-party consent. Section 2511(2)(d) allows a person who is a party to a communication, or who has a party's prior consent, to intercept it, unless the purpose is a criminal or tortious act. Federal law is therefore one-party consent, although some states require every party to consent.
• Interception versus access. The Act is aimed at capturing a communication as it happens. Reading an email that has already landed in a mailbox is usually analyzed under the stored-communications rules instead, and courts have drawn that line in different places.

The statute also contains exceptions that employers often rely on, such as ordinary-course-of-business and provider exceptions. Their scope depends on how the monitoring tool works and what the notices say, so ask counsel how they fit your setup rather than assuming they apply.

How does the Stored Communications Act differ?

The Stored Communications Act addresses unauthorized access to stored electronic communications and limits when certain service providers may disclose them. The disclosure limits are written for providers that offer communications services to the public, which is a different role from an employer running its own email tenant.

That distinction is why the licensing question usually turns less on the SCA's provider rules and more on three other things: what employees were told, what the applicable state law requires, and what third parties (clients, vendors) were promised in contracts. Check the current text of the Act and its case law with counsel, because the answer for a hosted corporate system can depend on facts such as who administers it.

Access versus disclosure: where the real questions sit

The takeaway: an employer's technical control over a system does not settle whether the contents may be licensed. SourceX scopes that question with the company before anything is delivered, and the company decides what is in or out.

What policies does counsel check before an email or chat archive is licensed?

Counsel generally wants to see written evidence that employees knew their work communications could be accessed and used. The usual document set:

• Electronic communications policy stating that systems are company property and may be monitored, with employee acknowledgments on file
• Employee handbook and offer-letter language about work product and systems use
• Any state-specific notice or consent forms, especially for employees in all-party-consent states
• Client and vendor contracts with confidentiality, data-use or audit clauses
• Privilege log or a rule for removing counsel communications
• A list of personal-account or BYOD channels that must be excluded
• Retention schedule showing what still exists

The electronic communications policy template lists the clauses worth having in place, and the employee privacy notice template for California shows what a state-specific notice covers. For related monitoring questions see keystroke and screen monitoring.

How does de-identification change the picture?

Agreeing redaction and de-identification rules before any work starts reduces what is disclosed: names, contact details, account numbers and similar identifiers can be removed or masked, and some channels can be excluded entirely. That does not by itself make a disclosure lawful, but it narrows the questions counsel must answer. A data map of where communications live is the practical first step.

Illustrative walk-through

Illustrative: a fictional 120-person IT services firm has nine years of email and a team chat archive. Its handbook has a monitoring clause signed at hire, but two offices are in states with stricter rules and the sales team used personal phones for texting clients.

Counsel's likely sequence: confirm the acknowledgments cover every office, exclude personal-device channels, remove legal and HR mailboxes, flag client threads with confidentiality clauses, then decide whether remaining content is licensed after masking names and contact details. None of this needs a partner to see a single message.

What a partner does and does not do

A referral partner makes an introduction and shares basic fit information only. Partners never export, upload or describe confidential records, and they do not give legal opinions on ECPA or anything else. If an owner asks "are we allowed?", the right answer is "your counsel decides, and nothing is binding until you agree terms and sign."

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

When this is a red flag

Pause the conversation, or exclude the material, when:

• The archive is mostly messages with clients or vendors who never agreed to any use.
• Employees were never given a monitoring policy.
• Captured communications came from personal accounts, or from calls recorded without the notices your state requires.
• A court, trustee or assignee controls the systems and has not been involved.

Run a quick preliminary screen with the company fit checker, and read how SourceX referrals work for the full sequence.

Next step

If you advise or sit on the board of a US company with 50+ full-time employees at peak (contractors excluded) and years of archived email and chat, register as a partner and raise the idea with the owner. Companies can also apply directly at sourcex.si/apply.