Can the police read your messages? WhatsApp, texts, Facebook, iCloud: what the courts can obtain from your accounts

Can the police read the WhatsApp messages of a person under investigation, their texts, their Facebook messages, open their iCloud backup or their Gmail account? Since 18 August 2026, the European e-Evidence Regulation lets a French judge order Meta, Apple or Google directly, without mutual legal assistance and without the person being told, to hand over the stored data of an account within ten days. The document reaches the case file with an Irish letterhead. This page describes what the courts can obtain from the accounts of a person under investigation, who can order it, how the person finds out, how to challenge the order, and how the defence has exculpatory data frozen.

WhatsApp messages, texts, Facebook, iCloud backups: what the courts can obtain

The e-Evidence Regulation does not give the judge general access to a person’s accounts. It allows the judge to order a service provider, messaging service, social network or online storage, to produce what the provider stores, divided into four categories whose full regime is set out in our page on the European Production Order (EPOC). Two regimes follow for the person under investigation.

Subscriber data, meaning the declared identity, the address, billing details, and IP addresses requested for the sole purpose of identifying the user, can be obtained for any offence, on an order issued by a public prosecutor, without any authority of the provider’s State being informed; the Court of Justice has long accepted that access to such identification data is not reserved to serious crime (CJEU, Grand Chamber, 2 October 2018, Ministerio Fiscal, C-207/16). Traffic data, the equivalent of call records for an online account, meaning correspondents, dates, durations and the location of the device, and content data, meaning text, voice, images and video, require a judge, an offence punishable by at least three years’ imprisonment or one of the offences the Regulation lists, and, unless exempted, a notification to the authority of the provider’s State. An IP address requested for a purpose other than identification, for instance to reconstruct movements, is traffic data: the purpose stated in the order governs the regime.

Three limits follow from the Regulation itself. It covers only data stored at the time the provider receives the certificate: no interception, no later data, no messages the service does not keep. Data are produced encrypted or not, with no obligation to decrypt: an end-to-end encrypted messaging service such as WhatsApp or Signal yields only metadata and unreadable content, whereas messages stored in clear by the provider, an Instagram conversation, a Gmail mailbox, an iCloud or Google Drive backup not encrypted by the user, are produced readable. Text messages, for their part, are not kept by operators: only the phone keeps them. Finally, the order presupposes criminal proceedings opened for a specific offence. It is not to be confused with the search or seizure of a mobile phone, which follows other rules and does allow the device itself to be analysed, texts included.

One precaution is called for. The person who learns that proceedings concern them and who, at that moment, deletes messages or removes backups is not protecting themselves: they expose themselves to the offence of obstructing the establishment of the truth, punishable by three years’ imprisonment and a fine of 45,000 euros.

Who can order access to an account’s data: prosecutor or judge, and for which offences

The defence’s first check reads the issuing authority together with the category of data. For traffic and content data, only a judge, a court or an investigating judge may issue the order or validate it; a public prosecutor never may. The Regulation here follows the case law of the Court of Justice of the European Union, which excludes the public prosecutor’s office from the prior review of access to traffic and location data and reserves such access to serious crime (CJEU, Grand Chamber, 2 March 2021, Prokuratuur, C-746/18; 30 April 2024, C-178/22).

The second check concerns the seriousness threshold. What counts is the penalty incurred under the classification adopted on the day of issue, and a later reclassification to an offence punishable by less than three years does not retroactively validate access to the content of messages. The exemption from the threshold for fraud involving means of payment, sexual abuse of children and attacks against information systems requires that the offence be committed by means of an information system.

The third check is the least visible. The Regulation allows issue only if a similar order could have been issued in a similar domestic case, and the Court of Justice has already drawn the consequence of that rule for the European Investigation Order: a public prosecutor cannot issue the order where the domestic measure is reserved to a judge (CJEU, 16 December 2021, C-724/19). A French order is therefore measured against the conditions of the French Code of Criminal Procedure: for connection data, a requisition is possible only for an offence punishable by at least three years’ imprisonment, under prior review by a judge that the public prosecutor cannot replace (Crim., 12 July 2022, no 21-83.710); for the content of messages, which a simple requisition has never allowed to be obtained (Crim., 6 November 2013, no 12-87.130), the French reference measure remains to be determined.

The firm, an English-speaking criminal defence and cybercrime practice in Paris, checks on the certificate and the order in the case file the competence of the issuing authority and the seriousness threshold before any challenge. Contact the firm →

How a person under investigation finds out that their data were obtained

Informing the person is the task of the issuing authority, not of the provider, which is bound by confidentiality: neither WhatsApp, nor Apple, nor Google warns its user. The information must be given without undue delay and must state the available remedies, but it may be delayed, restricted or omitted for as long as the investigation requires, the reasons being recorded in the case file and a short justification added to the certificate.

In most proceedings, the person therefore learns of the order only on access to the case file, in police custody, during questioning or through their lawyer, and must look for it there. Three documents are, or should be, in the file: the order itself, which contains the issuing and validating authorities, the identifier concerned, the category of data, the time range, the criminal provisions, the grounds of necessity and proportionality and a summary description of the case; the EPOC transmitted to the provider, which contains neither those grounds nor that description; and, where applicable, the form by which the provider asked for clarification. No French statute yet fixes the form of the order in French proceedings: it is identified by its content.

The reading then turns to what is not there. A French order concerning a person residing in France for facts committed in France is notified to no foreign authority: no one other than the French judge has examined the order, and the only review that can still take place is the one the defence brings about.

Challenging a European Production Order (EPOC): remedies, nullity and prejudice

The remedy is exercised before a court of the issuing State, and concerns the legality of the measure, its necessity and its proportionality. The Court of Justice already required this for the European Investigation Order: a State that provides no remedy against the issue of a cross-border investigative measure breaches EU law (CJEU, 11 November 2021, Gavanozov II, C-852/19).

An order issued by a French judge is therefore challenged in France, by an application for nullity before the investigating chamber during the judicial investigation, or by a plea of nullity before the criminal court, raised before any defence on the merits. An order issued by a judge of another Member State against a person residing in France is challenged in that State, and the French court has a hold only on the evaluation of the data if they are transmitted to it: the Regulation then requires it to guarantee the rights of the defence, and the Court of Justice has held, for the neighbouring instrument that is the European Investigation Order, that a court must disregard decisive evidence the person is not in a position to discuss effectively (CJEU, Grand Chamber, 30 April 2024, EncroChat, C-670/22). The Criminal Chamber likewise requires that the documents allowing the lawfulness of evidence taken from another set of proceedings to be checked be added to the case file (Crim., 5 March 2024, no 23-84.192).

In France, the nullity of digital evidence follows the general framework of criminal procedure: an interest, standing and prejudice. The Criminal Chamber of the Court of Cassation has set that framework for connection data, the call records obtained by requisition, and it carries over to the European Production Order.

In practice, an order for content or traffic data issued or validated by a public prosecutor, or lacking grounds of necessity and proportionality, causes prejudice in itself, as the Criminal Chamber holds of an unreasoned geolocation order (Crim., 15 November 2022, no 22-80.641). In other cases, the defence shows that access ought to have been refused: a time range or category of data exceeding the needs of the investigation, a threshold not met, a measure unavailable under French law. It must also have standing, that is, be the holder or user of the account concerned. Proof of prejudice is prepared from the reading of the case file, by matching line by line the category of data, the time range, the classification, the penalty incurred and the authority: it is on the seriousness of the facts and on the duration and scope of the access that the Criminal Chamber focuses its review (Crim., 25 October 2022, no 21-87.397; 8 October 2024, no 24-81.047).

The firm files applications for nullity against an order issued by a French court, coordinates the challenge with a colleague in the issuing State where the order is foreign, and assesses before filing whether prejudice can be established. Contact the firm →

Exculpatory data: how the defence has data frozen and produced

The Regulation provides that the issuing of a production or preservation order may also be requested by the suspect, the accused person or their lawyer, within the framework of the defence rights of national law. The order is still issued by the judicial authority, but the defence has a textual basis for having data held by a foreign provider frozen and then produced.

The need is concrete: a geolocation placing the person somewhere other than the scene, a WhatsApp exchange restoring the context of a message the prosecution has isolated, a timestamp contradicting a chronology. Those data exist with the provider and exist only there, and the Regulation creates no obligation to retain them: the first request to make is preservation, available for any offence, including through a public prosecutor, for sixty days extendable by thirty.

Under French law, the route depends on the procedural stage: a written and reasoned request for an investigative act to the investigating judge during the judicial investigation, whose refusal is decided by a reasoned order within one month and may be appealed, including where the request seeks to gather the elements of a future application for nullity (Crim., 9 June 2026, no 25-88.058); a request for acts to the prosecutor during the preliminary investigation, once the file has been disclosed; a supplementary investigation before the trial court. The request names the provider, the account, the category of data and the time range, and says why the data are necessary to establish the truth. It remains subject to the conditions of any order: a person prosecuted for an offence punishable by less than three years will obtain preservation and identification data, not content.

The firm drafts requests for investigative acts seeking the issue of a preservation order and then a production order for exculpatory data, and follows up their execution. Contact the firm →

Frequently asked questions

Can the police read the WhatsApp, text or Facebook messages of a person under investigation?

It depends on what the provider stores. WhatsApp, end-to-end encrypted, can produce only metadata, correspondents, dates and times, and content it cannot read; an Instagram message or a Gmail email, stored in clear, are produced readable; text messages are not kept by the operator. The content also becomes accessible through an unencrypted online backup, or through the analysis of the phone itself after a search or seizure, which follow other rules.

Can deleted messages or texts be obtained through a European Production Order?

No. The Regulation covers only data the provider still stores at the time it receives the certificate. A message deleted at the provider is out of reach by this route; it may survive in a backup, or on the device, which is a matter of phone seizure.

Can an order issued by the judge of another Member State be challenged in France?

No. The remedy is exercised before a court of the issuing State. Residence in France gives the French court no jurisdiction; it intervenes only if the data are transmitted to it, to guarantee the rights of the defence when the evidence is evaluated.

Are connection data obtained on a simple requisition by the prosecutor void?

For traffic and content data, the prosecutor may neither issue nor validate the European order, and the act of an incompetent authority causes prejudice in itself. For subscriber and identification data, the prosecutor is competent, and the challenge concerns necessity, proportionality and the real purpose of the request.

Are iCloud or Google Drive backups protected in the same way as encrypted messages?

No. The provider produces what it stores, with no obligation to decrypt. An end-to-end encrypted messaging service leaves it nothing readable; a backup of that messaging service in iCloud or Google Drive, not encrypted by the user, will be produced in clear.

Is deleting messages after police custody an offence?

Yes, potentially. The Regulation does not penalise a deletion prior to receipt of the certificate, but erasing traces or documents with a view to obstructing the establishment of the truth is a separate offence, punishable by three years’ imprisonment and a fine of 45,000 euros. The question is settled with a lawyer, not by a setting.

The e-Evidence Regulation shifts the obtaining of digital evidence from a requested State to a bound company, and our analysis of digital evidence and the end of the Irish safe haven describes what that shift opens up depending on the position occupied in the proceedings. For the person under investigation, the data leave their accounts without their knowledge and under the sole review of the judge who requested them. The Regulation offsets that shift with a remedy before that same judge and with the defence’s ability to request the issue of an order. The first presupposes prejudice demonstrated document by document; the second presupposes that the data still exist when they are requested.