Published since 2012, our biannual report makes public the number of requests we receive and how we respond.
What Dropbox received
Search warrants require a showing of probable cause, must meet specificity requirements regarding the location to be searched and the items to be seized, and must be reviewed and signed by a judge or magistrate. Search warrants may be issued by local, state, or federal governments, and may only be used in criminal cases. In response to valid search warrants, we may produce non-content and content information.
We provided some information in response to 78.6% of the search warrants received.
When Dropbox complies with a search warrant, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice. 11.5% of the search warrants we received were accompanied by court orders for non-disclosure of indefinite duration. These gag orders may prevent us from ever notifying 13.5% of the affected Dropbox users identified in search warrants we received of the fact that law enforcement requested their information.
The numbers above include search warrants directed at Dropbox subsidiaries. In the first half of 2024, we received 1 search warrant directed to DropboxSign/DropboxFax and 1 search warrant directed to DocSend.
What Dropbox received
Unlike a search warrant, a subpoena only allows access to basic subscriber information. Subpoenas do not require judicial review and are typically issued by government attorneys or grand juries. We do not provide content information in response to subpoenas.
We provided some information in response to 80.8% of the subpoenas received.
When Dropbox complies with a subpoena, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice. 9.6% of the subpoenas we received were accompanied by court orders for non-disclosure of indefinite duration. These gag orders may prevent us from ever notifying 8.1% of the affected Dropbox users identified in subpoenas we received of the fact that law enforcement requested their information.
The numbers above include subpoenas directed at Dropbox subsidiaries. In the first half of 2024, we received 1 subpoena directed to Dropbox Sign/Dropbox Fax, 1 subpoena directed to DocSend, and 1 subpoena directed to FormSwift.
What Dropbox received
Court orders are issued by judges and may take a variety of forms, such as a 2703(d) order under the Electronic Communications Privacy Act. We do not provide content information in response to court orders.
We provided some information in response to 52.9% of the court orders we received.
When Dropbox complies with a court order, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice. 1.9% of the court orders we received were accompanied by court orders for non-disclosure of indefinite duration. These gag orders may prevent us from ever notifying 2.1% of the affected Dropbox users identified in court orders of the fact that law enforcement requested their information.
The numbers above include court orders directed at Dropbox subsidiaries. In the first half of 2024, we did not receive any court orders directed at Dropbox subsidiaries.
What Dropbox received
National security process includes National Security Letters (NSLs) and orders issued under the Foreign Intelligence Surveillance Act (FISA). We received between 0 and 249 requests. We’d like to be more specific, but Dropbox is not permitted by the US government to report the exact number received.
A note about national security process
National Security Letters are requests from the Federal Bureau of Investigation for information relevant to a national security investigation. An NSL doesn’t require a court order, but may only request a user’s “name, address, length of service and local and long distance toll billing records”.
Foreign Intelligence Surveillance Act orders are orders issued by the Foreign Intelligence Surveillance Court (FISC) for information relevant to a national security investigation. A FISA order may request a user’s non-content and content information.
What Dropbox received
A preservation request is a government request to preserve user data pending the receipt of formal legal process. When we receive these requests, we will temporarily retain a snapshot of the relevant user data for 90 days, but we do not disclose user data in response to preservation requests. To obtain preserved data, valid legal process is required.
We received 1,282 preservation requests from US law enforcement, affecting 1,352 accounts. We received 101 preservation requests from international law enforcement, affecting 236 accounts.
The numbers above include preservation requests directed at Dropbox subsidiaries. In the first half of 2024, we received 1 preservation request directed to Dropbox Sign/Dropbox Fax, and 1 preservation request directed to DocSend.
What Dropbox received
Dropbox may voluntarily disclose information to law enforcement if we have a good faith belief that someone is at imminent risk of death or serious physical injury and we have information which may help prevent the threat. We require that law enforcement provides a written summary of the emergency and explanation of how the information requested will assist them in preventing the emergency. Every emergency disclosure request is carefully scrutinized on a case by case basis to determine if the standard for disclosure has been met, and if so, any information disclosed is limited to that which would avert or mitigate the emergency. Dropbox receives emergency disclosure requests for user data from law enforcement around the world.
What Dropbox Received
Pen Registers or Trap and Trace orders (“PRTTs”) are court orders that authorize the government to obtain certain non-content information (specifically, dialing, routing, addressing, and signaling information relating to communications) of a specific account on a prospective basis for a period of up to 60 days.
The authorizing statute for PRTTs requires that such orders include a provision that prevents service providers like Dropbox from notifying users of these requests for an indefinite period of time. These gag orders may prevent Dropbox from ever notifying all of the affected Dropbox users identified in PRTT orders of the fact that law enforcement requested their information.
What Dropbox received
Government removal requests include court orders and written requests from law enforcement and government agencies seeking the removal of content from accounts based on the local laws of their respective jurisdictions.
“No action taken” may be due to circumstances where we were not able to review the content because the link provided to us was invalid or the content no longer existed, or where, upon review, the content was found not to violate our Acceptable Use Policy.
AK
8
AL
76
AR
20
AZ
51
CA
200
CO
44
CT
21
DC
65
DE
37
FL
277
GA
26
HI
12
IA
12
ID
17
IL
176
IN
81
KS
15
KY
48
LA
40
MA
28
MD
87
ME
5
MI
16
MN
138
MO
47
MS
24
MT
20
NC
100
ND
13
NE
40
NH
5
NJ
147
NM
17
NV
47
NY
198
OH
152
OK
49
OR
32
PA
84
RI
11
SC
30
SD
17
TN
45
TX
349
UT
20
VA
208
VT
0
WA
35
WI
52
WV
33
WY
5
A note about international requests
International requests include any formal legal process from a non-US government seeking user data. At this time, we accept US and Irish government requests. We may also respond to requests made pursuant to international agreements on legal cooperation in criminal matters, including Mutual Legal Assistance Treaties or letters rogatory. Preservation requests from international law enforcement are reported in the Preservation Request section of this report.
Child sexual exploitation and abuse has no place on Dropbox. This kind of material violates our Terms of Service and Acceptable Use Policy, and we will swiftly disable any accounts found with this content. Dropbox uses a variety of tools, including industry-standard automated detection technology, and human review to find potentially violating content and action it as appropriate. We also encourage our users to report inappropriate content they come across through our reporting tool or by completing this form. When we become aware of instances of apparent CSAM, we disable the account and make a report to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law.
From January through June 2024, we submitted 26,894 CyberTip reports to NCMEC and disabled access to 26,244 distinct accounts and 133,542 individual pieces of violative content under our policies against child sexual abuse and exploitation material.
Our team takes care in enforcing our policies. When a user thinks we made a mistake in our enforcement, they may contact Dropbox support to request a review of that decision. In the first half of 2024, we received 2,099 appeals from accounts disabled under Dropbox’s child sexual exploitation and abuse policy. We reinstated access in 3.6% of those cases.
Dropbox’s Terms of Service and Acceptable Use Policy prohibit publishing, sharing, or storing content that contains or promotes terrorism or violent extremism, including terror or violent extremist propaganda. Dropbox relies on a combination of proactive and reactive tools to detect terrorism or violent extremism content and enforce our policies. These tools include leveraging industry-standard hash matching detection technology, a trusted flagger program, external reports from members of the public and our users, and manual review by highly trained analysts. We strongly encourage those who come across terror or violent extremist content on Dropbox to report it through our reporting tool or by completing this form. When we find terror or violent extremist content that violates our policies, we will disable access to that content and take steps to prevent it from being further shared. When warranted, such as when accounts appear to be used solely for purposes of disseminating terrorist or violent extremist propaganda, we may also disable the associated account.
From January through June 2024, Dropbox disabled access to 1,249 pieces of terror or violent extremist content and disabled 484 accounts. We received 232 public reports of potential terror content and acted on every report.
Users who believe we’ve made a mistake in actioning their accounts can ask us to review that determination by contacting Dropbox support. From January through June 2024, Dropbox received 0 appeals from users who claimed their content or accounts were disabled in error under our terrorism and violent extremism policy.
From January through June 2024, Dropbox received 0 removal orders issued pursuant to EU Regulation 2021/784 (addressing terror content online).
“Account did not exist”: The identifiers provided in the request were not associated with valid Dropbox accounts.
All Writs Act Orders: All Writs Act Orders are issued by United States judges pursuant to the All Writs Act of 1789. The statute gives courts the power to “issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.”
“Content”: Content refers to the content of communications, which includes any information concerning the substance, purport, or meaning of the communication. It includes the files stored in a person’s Dropbox account and the filenames associated with those files. A search warrant is required to compel the production of content. Often, search warrants will also seek basic subscriber information or other non-content records, in addition to the content of communications.
Emergency disclosure requests: Dropbox may voluntarily disclose information to law enforcement if we have a good faith belief that someone is at imminent risk of death or serious physical injury and we have information that may help prevent the threat. We require that law enforcement provides a written summary of the emergency and explanation of how the information requested will assist them in preventing the emergency.
“No information provided”: Common reasons that no information was provided in response to legal process include: (1) the request was a duplicate; (2) Dropbox objected to the request; (3) law enforcement withdrew the request; or (4) the request failed to accurately identify an account.
“Non-content”: Non-content records generally describes any available information other than the content of communications. It includes basic subscriber information, defined in Section 2703 of the Electronic Communications Privacy Act, and other information reflecting usage of an account. Non-content information does not include the files that people store in their Dropbox accounts.
Non-disclosure order: At their discretion, judges can issue court orders preventing or delaying Dropbox from notifying a user of a government request for their information. These orders often cite subsection 2705(b) of the Electronic Communications Privacy Act and can extend for any length of time.
Non-US requests: Non-US requests include any formal legal process from a non-US governmental entity seeking user data. At this time, we accept US and Irish government requests. We may also respond to requests made pursuant to international agreements on legal cooperation in criminal matters, including Mutual Legal Assistance Treaties or letters rogatory.
Preservation: A preservation request is a government request to preserve user data pending the receipt of formal legal process. When we receive these requests, we will temporarily retain a snapshot of the relevant user data for 90 days, but we do not disclose user data in response to preservation requests. To obtain the preserved data, valid legal process is required and those subsequent requests are (and always have been) included in the report.
“Public Report”: A public report refers to a report submitted by Dropbox users or other non-law enforcement sources regarding potential illegal content or content that may violate Dropbox’s Acceptable Use Policy.
User Notice: Our policy is to provide notice to users about requests for their information unless we are prohibited from doing so by law. In limited cases, we may delay notice to the user until after we have complied, and in those cases we note the date we produced user records.
Our tracking and reporting methods may evolve as we continually strive to improve the accuracy and clarity of our report.