Your best plan is [1]: a) don't be a US citizen/resident, and b) store your data in a country where disclosure of this information is banned by law. Under thes

Your best plan is [1]: a) don't be a US citizen/resident, and b) store your data in a country where disclosure of this information is banned by law. Under these conditions, the provider can (and has incentives to) challenge the order requiring the production of the data. If the order is quashed, the US government would need to get an order from the local government under MLAT for the data. As for your German datacenter question... Under the text of the law, it depends on whether that data is within a US electronic communications or remote computing service provider's "possession, custody, or control." In theory, a service provider might contract out the management of these aspects of its operations, but it would be hard to imagine a service provider feeling comfortable moving the data outside of its control. [1] See p 2205 of bill text for the CLOUD act part. http://docs.house.gov/billsthisweek/20180319/BILLS-115SAHR1625-RCP115-66.pdf http://docs.house.gov/billsthisweek/20180319/BILLS-115SAHR16...