Apple iCloud Preservation and Emergency Requests: Police Template

Apple iCloud preservation and emergency requests for police: Apple's own rules, 90-day period, exigent form, mistakes to avoid, and two templates.

Apple publishes more detail about preservation and emergency requests than most platforms, and the details are strict. Apple's Legal Process Guidelines for the United States set out exactly where a preservation request goes, which identifiers it needs, how long Apple keeps the preserved data, and what a law enforcement officer must complete for an emergency. This guide pulls those two routes out of the guidelines, adds what the federal statute says, and gives you a template for each. For the full process for obtaining iCloud records, see our Apple law enforcement portal and iCloud data request guide.

Quick answer

Who can use it: government and law enforcement personnel only. Apple states the mailboxes are for those personnel and that email must come from a valid official government or law enforcement address. Victims and the public cannot use these routes.
Preservation: email [email protected] from an official address, citing 18 U.S.C. § 2703(f). Apple preserves a one-time pull of existing data for 90 days, extendable once for 90 more days on a renewed request.
Emergency: complete Apple's Emergency Government & Law Enforcement Information Request form and email it from an official address to [email protected] with "Emergency Request" in the subject line.
After hours: for an emergency inquiry before 8:00 am or after 5:00 pm Pacific time, Apple's guidelines give its Global Security Operations Center number as (408) 974-2095.

Who can use these routes

Apple's guidelines are written for government and law enforcement agencies. The law enforcement portal page states that requests may only be made by a law enforcement agent or emergency responder authorised to gather evidence in an official investigation, or to investigate an emergency involving imminent danger of serious physical injury or death. If you are a victim or a relative, you cannot use these channels. Apple directs other questions about customer information to its privacy contact page, and the right step is a police report; see our cybercrime help hub for your country.

Portal or email

Apple operates a Law Enforcement Portal at lep.apple.com, with sign-in for existing users and an access request for new ones, and says it is launching an online portal for officers to submit requests and obtain data. The US guidelines we read still direct preservation requests to [email protected] and emergency requests to [email protected], and the portal page does not say whether either can be filed there. Follow the email routes unless your portal account instructs otherwise. Apple replies to the requesting officer's official law enforcement email address.

Preservation requests: what Apple publishes

Channel: requests to preserve information under 18 U.S.C. § 2703(f) should be sent directly from an official government or law enforcement email address to [email protected].
Required identifiers: the relevant Apple ID or account email address, or the customer's full name and phone number, and/or full name and physical address.
What is preserved: a one-time data pull of the requested existing customer data available at the time of the request.
How long: 90 days, after which the preservation is automatically removed from the storage server. It can be extended for one additional 90-day period on a renewed request.
Repeat requests: an attempt to serve more than two preservation requests for the same account results in the second request being treated as an extension of the original, not a separate preservation of new data. Requests to start a new preservation must be submitted separately and not combined with requests to extend an existing one.

What it does not cover. Because the preservation is a one-time pull, activity after the request date is not captured. For iCloud, Apple's guidelines say connection logs and mail logs are retained up to 25 days and that Apple does not retain deleted content once it is cleared from its servers, so delay can mean loss. They also say Apple does not receive or retain encryption keys for a customer's end-to-end encrypted data, and that limited iCloud data may be available where a user has enabled Advanced Data Protection.

Notice. Apple's customer notice policy covers account information sought through legal process, with exceptions for non-disclosure orders such as one under 18 U.S.C. § 2705(b), risk of injury or death, and child endangerment cases. The guidelines do not say separately whether a preservation request alone triggers notice.

What the statute says

Section 2703(f)(1) requires a provider, "upon the request of a governmental entity," to "take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process." Section 2703(f)(2) says the records "shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity." Apple's 90 days plus one 90-day extension matches the statute; the one-time pull and the two-request rule are Apple's own published practice. Neither § 2702 nor § 2703 has been amended since 2018: the wording quoted here is unchanged in the US Code as published by the Office of the Law Revision Counsel, current through Public Law 119-124 (15 October 2026).

Emergency requests: what Apple publishes

Apple's US guidelines say that under 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4) Apple is permitted, but not required, to voluntarily disclose information, including contents of communications and customer records, to a federal, state or local governmental entity if it believes in good faith that an emergency involving imminent danger of death or serious physical injury to any person requires disclosure without delay. The statute's own text reads "danger of death or serious physical injury"; Apple's guidelines add "imminent" to their description. Apple's form and its guidelines for agencies outside the US describe emergencies more broadly as imminent and serious threats to the life or safety of individuals, the security of a State, or the security of critical infrastructure.

What to send. Apple's form states that it will not process a request on an emergency basis unless the circumstances fit that definition and the form is fully completed by the requesting officer and sent from the officer's official email address to [email protected] with the subject line "Emergency Request". The form asks for agency and officer details, a supervisor's contact details, the officer's confirmation, the case number, when and where the emergency arose and when you became aware of it, an overview of the emergency, the supporting identifiers (for example device serial or IMEI, Apple ID, email, phone number, address or name) and the information requested. Apple asks that the information requested be as narrow as possible, noting that the more requested, the longer it will take.

Supervisor check. Apple says a supervisor may be contacted to confirm the request was legitimate, and that the officer should provide the supervisor's contact details.

Handling and notice. Apple's government information requests page says its team responds to emergency requests globally on a 24/7 basis, but neither that page nor the guidelines promise a response time. For emergency disclosures, Apple says it provides delayed notice to the customer after 90 days, unless a notice exception applies. Apple's transparency report for July to December 2025 lists 1,143 US emergency requests, with data provided in 856; that is context, not a prediction.

Agencies outside the United States

Apple publishes separate guidelines for government and law enforcement outside the United States. They send a preservation request ahead of an ECPA-compliant request (including one under a Mutual Legal Assistance Treaty or CLOUD Act Agreement) to [email protected], with the same identifiers, 90-day period and one extension, and emergency requests to [email protected]. For emergency inquiries they give the Global Security Operations Center number as 001 408 974-2095 and say the line offers support in multiple languages.

Template: preservation request

Adapt to your agency's format; not legal advice. Send it from your official email address to the mailbox above, as a new request. Do not combine it with an extension.

To: [email protected]
From: [OFFICIAL GOVERNMENT OR LAW ENFORCEMENT EMAIL ADDRESS]
Subject: Preservation Request, 18 U.S.C. 2703(f), [CASE NUMBER]

[AGENCY NAME], [AGENCY ADDRESS]
Requesting officer: [NAME, TITLE/RANK], [OFFICE PHONE]
Agency case number: [CASE NUMBER]
Date: [DATE]

Pursuant to 18 U.S.C. section 2703(f), this agency requests that Apple preserve existing customer data in its possession for the following account, pending the issuance of legal process.

Account identifier (one of the following, as known):
  Apple ID / account email address: [APPLE ID OR EMAIL]
  OR full name and phone number: [FULL NAME], [PHONE NUMBER]
  OR full name and physical address: [FULL NAME], [PHYSICAL ADDRESS]

Data to be preserved: [E.G. iCLOUD CUSTOMER INFORMATION, CONNECTION LOGS, MAIL LOGS, iCLOUD CONTENT, DEVICE REGISTRATION]
Relevant period: [START DATE] to [END DATE]

This is a request to initiate a NEW preservation. [OR: This is a request to EXTEND the preservation made on [DATE], reference [APPLE REFERENCE IF ANY].]

Legal process to follow: [SEARCH WARRANT / COURT ORDER / SUBPOENA], expected [DATE].
Non-disclosure order: [ATTACHED, REFERENCE ____ / NONE]

Please send your response to this official email address.
[NAME, TITLE/RANK]

Template: emergency request

Apple requires its own form. Download Apple's Emergency Government / Law Enforcement Information Request form, complete every field, and use the text below to prepare your answers. Adapt to your agency's format; not legal advice.

To: [email protected]
From: [OFFICIAL GOVERNMENT OR LAW ENFORCEMENT EMAIL ADDRESS]
Subject: Emergency Request
Attachment: completed Apple emergency request form

Agency: [COUNTRY], [CITY/STATE], [AGENCY NAME], [AGENCY PHONE]
Requesting officer: [NAME, TITLE/RANK], [OFFICIAL EMAIL], [OFFICE PHONE], [MOBILE PHONE]
Supervisor: [NAME, TITLE/RANK], [OFFICIAL EMAIL], [OFFICE PHONE]
Requesting officer confirmation (electronic initials on the form): [INITIALS]
Agency case number: [CASE NUMBER]

When did the emergency arise: [DATE/TIME]
Where: [LOCATION]
When you became aware: [DATE/TIME]

Emergency overview: [IMMINENT DANGER OF DEATH OR SERIOUS PHYSICAL INJURY TO WHOM, AND WHY DISCLOSURE IS NEEDED WITHOUT DELAY]

Identifiers supporting the request: [APPLE ID / EMAIL / PHONE NUMBER / DEVICE SERIAL OR IMEI / ADDRESS / NAME]

Information requested (as narrow as possible): [E.G. ACCOUNT HOLDER DETAILS, RECENT CONNECTION LOGS, FIND MY LOCATION DATA IF AVAILABLE]

Optional cover note (not a field on Apple's form): request for voluntary disclosure under 18 U.S.C. sections 2702(b)(8) and 2702(c)(4). [IF APPLICABLE: FORMAL LEGAL PROCESS WILL FOLLOW, TYPE AND EXPECTED DATE].

Common mistakes

Combining a new preservation with an extension. Apple says these must be submitted separately.
Expecting a second preservation request to capture new data. Apple says a second request for the same account is treated as a request to extend the original preservation, not a separate preservation of new data.
Sending a download link instead of the document. For legal process, Apple will not download documents through links in an email, and a link is not valid service. It requires the complete legal process, including attachments, in an uneditable PDF.
Too many identifiers. Apple answers only the first 25 in one legal process.
Incomplete emergency form. Apple says it will not process an emergency request on that basis unless the form is fully completed.
Leaving requests in the email body only. Information not in the signed legal process itself will be disregarded.

Apple law enforcement portal and iCloud data request guide (full process for records)
Overview of platform law enforcement request guides
Police data-request directory and the US investigator handbook

Sources

For other platforms see the police data-request directory, and if you are a victim rather than an investigator, start with the country-by-country cybercrime help hub. This guide summarises public sources as read on 24 October 2026; Apple updates its guidelines as necessary, so confirm the current version before relying on it. It is not legal advice.