🚔 Police Data Request Portals: How They Work and How They Are Abused

What is a law enforcement request portal?

It is a login site where verified police and government staff send legal demands to one company and get the results back. Without them, requests arrive by fax or email, which are slower and easier to forge. SEARCH, a US justice-technology nonprofit, lists more than 20 of them in its investigative toolbar SEARCH investigative toolbar (read 5 Nov 2026).

These pages are not for the public. If you want your own data, use the company’s download tool instead; our account directory links to many of them.

What legal process gets what data?

In the US the Stored Communications Act sets the rules 18 U.S.C. § 2703, Cornell LII. Google publishes a plain summary of what it needs for each kind of data Google, How Google handles government requests (read 5 Nov 2026):

The scale is large. Meta received 374,516 government requests worldwide in the first half of 2025. It supplied some data for 78.7% of them and logged about 46,400 emergency requests Voronoi, from Meta’s transparency report (H1 2025).

Will I be told if police request my data?

Often, but not always. Google emails the account holder before disclosing, unless a court order forbids it or there is an emergency. It tells you later when the gag ends or the emergency passes Google, How Google handles government requests (read 5 Nov 2026). In one case reported in February 2026, Meta told users of a DHS subpoena about three weeks after it arrived. It gave them 10 days to show they were challenging it in court Engadget, on the New York Times report (14 Feb 2026).

If you get such a notice, act within the deadline. Ask a lawyer about a motion to quash, or contact the EFF or the ACLU.

How do criminals pose as police?

• Hacked police email. In 2021 Apple and Meta gave customer data to hackers who sent forged emergency requests from compromised police accounts. Discord was also fooled Krebs on Security (31 Mar 2022). Senator Wyden opened an inquiry Bloomberg (Apr 2022).
• Doxxing for profit. Two members of the ViLE group broke into a foreign police officer’s email and sent fake emergency requests to social media firms. They also used a stolen police password to enter a federal database U.S. Attorney, E.D.N.Y. (14 Mar 2023). They used the data to extort victims and were sentenced to 27 and 25 months Cybernews, on the sentences.
• Stalkers. In 2023 Verizon gave a woman’s address and call logs to a man posing as police, from a ProtonMail address. He then drove to the house he believed was hers, carrying a knife 404 Media (8 Dec 2023).
• A trade in access. In November 2024 the FBI warned that crime forums sell police email logins and coaching for as little as $100 The Register, on the FBI notice (11 Nov 2024).

The EFF notes that stalkers, abusers, bounty hunters and debt collectors all use the trick. It wants companies to publish and enforce stricter checks EFF (Jan 2024).

How do real officials misuse real requests?

• Personal grudges. Former Brooklyn prosecutor Tara Lenich forged judges’ signatures on wiretap orders and fake warrants. She used them to read the texts of a detective and a colleague NBC News.
• Targeting speech. DHS sent hundreds of administrative subpoenas to Google, Meta, Reddit and Discord for the identities of accounts that criticised ICE. Google, Meta and Reddit complied with some Engadget, on the New York Times report (14 Feb 2026). Google gave ICE a student journalist’s addresses, IP logs and linked card and bank numbers, under a gag order TechCrunch (10 Feb 2026).
• Dragnets. Geofence warrants ask for every phone near a place and time. In June 2026 the Supreme Court ruled 6–3 that such a request is a Fourth Amendment search SCOTUSblog (29 Jun 2026). Our ICE surveillance tracker follows similar tools.
• Lawful, but contested. In Nebraska, Meta handed over a mother’s and daughter’s messages under a warrant in an abortion-related case. The mother was sentenced to two years CTV News (Sep 2023). The request was legal; critics argue the data should not have existed in readable form.

Misuse of police databases follows the same pattern. Our ALPR misuse file lists officers who searched plate readers to track partners.

How can I protect my data?

• Keep less. Turn off location history and set chats, searches and email to auto-delete. A company cannot hand over what it does not hold.
• Use end-to-end encryption. With Signal or WhatsApp, the company cannot read message content. It can still share account details and metadata.
• Watch your inbox. A legal-process notice from a platform is real mail worth reading. Check it by signing in to the site directly, not by clicking the email.
• If you run a company: call the agency back on a number you find yourself. The FBI also advises checking that the legal codes fit the country, and looking for doctored logos The Register, on the FBI notice (11 Nov 2024). A bill requiring digital signatures on court orders was introduced in 2021 but has not passed Sen. Wyden’s office.

Agencies can also skip legal process by buying data instead; see the data broker loophole. For the law around investigating people yourself, read is OSINT legal?