Why LinkedIn is challenging an overbroad government demand—and why Congress must make secrecy the exception

Today, the U.S. Court of Appeals for the Fourth Circuit heard oral argument in LinkedIn’s (a Microsoft subsidiary) appeal challenging a government demand for user records and a related secrecy order that is preventing LinkedIn from notifying those users that the government is seeking their data. The appeal asks important, constitutional questions about whether service providers may challenge demands that sweep in records unrelated to an investigation, and when the government may prevent a provider from notifying the user of a request.  

This appeal continues Microsoft’s longstanding work to ensure that secrecy orders remain the exception, not the rule. LinkedIn’s appeal asks courts to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them. 

We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. We respond to lawful legal requests. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process. And, customers deserve to be notified when the government seeks their data, unless the government clearly establishes the need for secrecy under statutory and constitutional standards. 

Those safeguards fulfill basic constitutional rights. The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk, and it also applies when personal and business records are stored online. Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified—but it should be tailored to demonstrated needs and subject to meaningful review.  

This particular case arose after LinkedIn received a court order seeking user records together with a secrecy order preventing LinkedIn from informing anyone about the order. The details remain under seal, including the nature of the information the government seeks and the people who own that information. But the Fourth Circuit partially unsealed LinkedIn’s opening brief in July, allowing the public to understand some of the core issues. LinkedIn argues that the demand is overbroad, the secrecy order is unconstitutional, and the government has violated LinkedIn’s due process by withholding evidence from LinkedIn. 

Three amicus briefs from a broad coalition support LinkedIn’s position. The American Civil Liberties Union and ACLU of Virginia argue that users’ privacy interests must inform whether a demand is reasonable and that providers may be the only practical means of challenging unlawful process because users often receive no notice. The Reporters Committee for Freedom of the Press warns that overbroad demands, delayed notice, and secret evidence can expose confidential sources and chill newsgathering. Amazon, Apple, Google, Meta, and X emphasize that cloud providers are uniquely positioned to identify irrelevant requests and that secrecy orders require case-specific evidence rather than boilerplate assertions. Together, these briefs show why cloud providers must be able to test both the scope of government demands and the need for secrecy. 

Microsoft has a long record of standing up for these principles. In 2014, Microsoft successfully challenged a secrecy order connected to a National Security Letter that prevented notice to an enterprise customer. In 2016, we filed a landmark challenge to the widespread use of indefinite secrecy orders. We’ve successfully challenged individual secrecy orders time and again over the years. Our efforts contributed to updated Justice Department policies, but executive-branch practices can change. Durable protections require the development of case law and legislation. 

The U.S. House of Representatives recently took an important step in that direction. On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers. As we explained when the bill passed, the reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President. 

The House –passed legislation recognizes that privacy and public safety are not opposing values. Clear standards can give investigators the confidentiality they genuinely need while providing courts, providers, and customers with predictable rules. The pending legislation and LinkedIn’s appeal are the latest, complementary chapters in this broader effort. Legislation can establish durable, system-wide rules for notice and accountability. Courts must meanwhile enforce the limits already contained in existing statutes and the Constitution. Neither task requires obstructing legitimate investigations. Rather, both mean the government must seek only relevant information, justify secrecy with specific evidence, and infringe on speech to the least extent possible. 

That is why today’s argument matters beyond a single sealed investigation. People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.

Microsoft and LinkedIn will continue to support lawful investigations while standing up for customer privacy, transparency, and the rule of law. We have appealed to the Fourth Circuit to preserve providers’ ability to challenge overbroad demands and to require the government to meet its constitutional burden before imposing secrecy. And we urge the Senate to complete the work the House began by enacting durable non-disclosure order reform.

Further reading 

• House passes historic reforms to rein in secret surveillance 

• New success in protecting customer rights unsealed today 

• Keeping secrecy the exception, not the rule 

• DOJ acts to curb the overuse of secrecy orders. Now it’s Congress’ turn. 

• DOJ’s newly released recommended practices are a win for cloud and enterprise customers 

• Ensuring secrecy orders are the exception not the rule when the government seeks data owned by our customers 

• The need for legislative reform on secrecy orders 

• Freedom is built on the protection of privacy | Episode 2 

The post Protecting customer privacy means standing up for transparency appeared first on Microsoft On the Issues.

At Microsoft, we are committed to our customers’ fundamental right to privacy. In a world defined by rapid technological change and geopolitical volatility, this commitment has remained constant. It’s rooted in decades of experience building trusted technologies that our customers rely on every day to manage their data. Many of these organizations depend on the ability to move data across the Atlantic, from the EU to the U.S., in a way that protects their privacy. That’s why we support the European Commission in its defense of the EU-U.S. Data Privacy Framework. And that’s why we have formally intervened in the Latombe v. Commission case before the Court of Justice of the European Union. This case puts at stake two principles that are important for Microsoft – the protection of our customers’ privacy and their ability to do business on both sides of the Atlantic.

To intervene in a case before the Court of Justice, a company must apply for permission. In this case, the Court granted our application, finding that Microsoft has a direct and existing interest in its result. Put simply, the outcome of this case will determine whether Microsoft and its enterprise customers may continue to use the EU-U.S. Data Privacy Framework to transfer data to participating U.S. companies, including vital customers and suppliers. This critical legal bridge promotes stability, beneficial trans-Atlantic ties, economic growth, and prosperity, while upholding strong privacy safeguards. The Latombe case seeks to dismantle it. As an intervener, we can now file legal briefs in support of the European Commission, participate in oral hearings, and share our perspective on the importance of upholding a framework that directly benefits the European economy.

Supporting the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework before the Court of Justice of the European Union

Companies across the globe rely on data flows to manage their people, produce their goods and services, and distribute products to their customers. We understand that data flows trigger questions about differences in legal traditions. They should. And for that reason, the European Commission and the U.S. administration worked diligently, in the decade since the Safe Harbour ruling, to harmonize EU and U.S. law. As a result of that hard work, and as required under the European General Data Protection Regulation (GDPR), the U.S. has now created an independent review court for any complaints regarding U.S. surveillance and implemented other required measures to provide an “adequate” level of data protection that is essentially equivalent to that in the EU.

This equivalence is a key point. The law entitles our customers to privacy on both sides of the Atlantic. This is the principle on which the Data Privacy Framework rests. And our intervention in the Latombe case is just one part of a long history in which we have stood up for that principle in Europe, as well as in the U.S. As far back as 2014, Microsoft challenged the FBI’s secret attempt to use its national security authorities to obtain information about an account that belonged to one of our enterprise customers. After we filed the case, the FBI withdrew its request. In 2016, we sued the U.S. government to challenge its practice of seeking indefinite secrecy orders—i.e., orders that prevented Microsoft from ever notifying its enterprise customers when the government sought their data. As a result of that case, the U.S. Department of Justice changed its policy to place strict limits on the duration of secrecy orders. In the decade since that first constitutional challenge, we’ve launched a series of successful court challenges to ensure that secrecy orders, of any duration, are the exception, not the rule. As a result of our litigation, numerous secrecy orders have been vacated or modified to allow notification to our customers.

We don’t confine our advocacy to courts. We are a steadfast proponent of strong privacy regulation on both sides of the Atlantic. That’s why we are specifically pushing Congress to update the U.S. Electronic Communications Privacy Act to place stricter limits on the use of secrecy orders and ensuring they are subject to meaningful judicial review. This legislative reform is gaining momentum in Congress and will greatly enhance our continued ability to protect our customers’ data.

Stable and trusted data transfers are not an end in themselves. They are a means to enable innovation, economic opportunity, and public services—while upholding the fundamental rights that are at the core of EU and U.S. law. Our intervention in the Latombe case reflects that principled balance and follows a long line of legal actions we have taken to protect our customers.

Looking ahead

At Microsoft, we have long recognized that trust is not a given—it is earned through sustained action, thoughtful design, and a willingness to engage openly with governments, customers, and individuals. Microsoft has consistently advocated for strong, clear, and globally interoperable privacy frameworks, recognizing that trust in technology depends on the strength of the rules that govern it.

Our customers in Europe can rely on us to continuously improve and update our privacy practices as technology and legal standards evolve. In 2018, we were the first major technology company to extend GDPR subject matter rights to all our customers around the world. And recent positive assessments of our privacy compliance by the European Data Protection Supervisor and the Hessian DPA in Germany underscore our continuous commitment to our customers’ fundamental right to privacy.

In support of this work, we’ve updated the Microsoft Privacy Statement to use clearer structure, simplified language, and more precise explanations of our data practices—making it easier to understand what data we collect and how it’s used, without changing our underlying privacy protections or commitments.

The future of technology will be shaped not only by what we build, but by the principles that guide us. By grounding innovation in respect for people and organizations, and strong legal protections, we can help ensure that technology continues to be a force for good.

The post Protecting privacy as a fundamental right while supporting transatlantic data flows appeared first on Microsoft On the Issues.