Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion. This unit is general education. It is not legal advice.
Mission briefing
Most large online services publish their own rules for requests from the police. Those rules change, often with no notice, so a printed list is wrong within months. This unit gives you a method instead.
Focus: find the company behind the service, find its own page, read that page for ten questions, and write down the date you read it.
Learning objectives
By the end of this unit, you will be able to:
- Find the company behind a service, and the company that answers for a user's region.
- Find a provider's own page for law-enforcement requests.
- Tell an official page from a copy or a summary.
- Read the page for the ten questions.
- Record what you read, and when, in the case file.
Why this matters to you
- Officers and agencies: many requests fail for simple reasons, such as the wrong company or the wrong channel. Ten minutes of reading prevents that.
- Companies and compliance teams: your own published rules should answer these ten questions. Unit P1 (Receiving and Logging Requests; Publishing Your Rules) is the mirror of this unit.
1. Who is the provider, really?
The name on the app is not always the company that holds the data. Work in three steps.
Step 1: name the service. Start from the identifier you hold, such as a profile address or a phone number. Unit X1A (Naming the Account: Identifiers by Kind of Service) shows how to capture it.
Step 2: name the company behind the service. Look at the foot of the service's own site, its terms of service and its privacy policy. Look for "who provides the service to you" or "data controller". Many groups use one company for users in one region and a different company for users elsewhere.
Step 3: check that this is the right kind of provider. A website sits behind several companies: the registrar that sold the domain name, a proxy or DNS service, the host, and the site operator. Each holds different data. A request to a company that never held the data returns nothing.
What matters is which company controls the data, more than where the servers stand.
Dated example. On 7 October 2026, the law-enforcement page of one large social-media group named two companies. One, in Ireland, served users in the European region. The other, in the United States, served users everywhere else.
2. Find the provider's own page
Search for the company name with each of these phrases:
- law enforcement guidelines
- information for law enforcement
- government requests for user data
- legal process guidelines
- transparency report
Also look in these places:
- The footer of the service: "Safety", "Privacy", "Legal", "Transparency".
- The help centre. Search it for "law enforcement".
- The transparency report. Its questions-and-answers page is sometimes the only guideline there is.
- The privacy policy, in the part on disclosure to authorities.
- Local contact pages. Read what each contact is for. A contact for user complaints is often not the address for police requests.
Some providers publish a full manual, some one paragraph, a few nothing. That is also a finding. Write it down.
3. Official page or someone else's?
An official page has three marks:
- It sits on a web address the company owns: the service's own domain, its corporate site or its help centre. Read the address bar, not the title of the search result.
- You can reach it by following links from the service's own site.
- It names the legal entity, and its route ends at the company. A portal run by another firm is genuine only if the provider's own page sends you there.
Treat these as unofficial until you confirm them:
- a law firm's summary;
- a copy on a police forum;
- a directory of provider contacts;
- a PDF hosted on another site;
- an old version in a web archive;
- an answer written by an AI tool;
- any page that tells you to send legal papers to a free email address.
Directories and summaries help you find the official page. They are never the authority.
4. Read the page for ten questions
Answer each question in one line. If the page does not answer, write "not stated".
| # | Question | Why it matters |
|---|---|---|
| 1 | Which entity do I address, for a user in this region and a requester in my country? | The wrong company is a common reason for rejection. |
| 2 | Which channel? Portal, web form, email or post? What must I do to get access? | Many ignore email and post. Portal accounts take time to approve. |
| 3 | Which identifiers will they search on? | "Account not identified" means an empty reply. |
| 4 | What will they give for which legal process, and what do they say to requesters outside their home country? | It decides whether a direct request is worth making. |
| 5 | Preservation: how to ask, how long it lasts, how to extend it. | Data is deleted while slower routes run. |
| 6 | Emergency: the test, the channel, what to state. | An urgent request sent as an emergency is refused. |
| 7 | Will the user be told? How do I ask for secrecy? | Notice can end a covert investigation. |
| 8 | What do they not have? How long do they keep each kind of data? | It saves a pointless request. |
| 9 | Form of the reply: format, time zone, a record for court, any cost. | It decides whether your court can use the reply. |
| 10 | The date on the page. Does a second page agree? | Old and conflicting pages are common. |
Three reading tips:
- Question 5. A preserved copy is often held for about 90 days. Do not rely on memory. Read the provider's page.
- Question 8. Providers say what they cannot give: content encrypted from end to end, items the user deleted, and logs kept for only weeks or months. If the data is gone, look elsewhere: the device, the other party, a backup, another provider.
- Question 10. Compare the guideline with a second page from the same provider, such as its transparency report. If they disagree, note both.
Dated example. On 7 October 2026, one large discussion platform printed a revision date at the top of its guideline: 22 May 2026. On the same day, the guideline of one large social-media group carried no date. It said only that the information "may change at any time". For question 10, write "none shown".
Removal is a different channel. Asking a provider to take content down is not asking for evidence. Removal has its own route and its own law. It produces no records, and a careless removal can destroy what you need. Preserve first.
5. Record what you read
In the case file, note:
- the address of the page;
- the date you read it;
- the page's own "last updated" date, or "none shown";
- where you saved a copy (print the page to PDF).
If your request is later challenged, this record shows what the provider's published rule was on that day (unit K14, Evidence from Abroad and from Providers: Testing the Route).
Keep a request log as well: the provider's reference number, the date sent, the date a preservation expires, and the date to renew it. Where it can, your agency should use one contact point for each provider.
Notes about a provider go out of date. Date every note, and read the page again for each new case.
6. When not to approach the provider
Stop and take advice when:
- the provider is very small, and the suspect may own it or work there;
- the provider is unknown, with no named company and no published rules;
- the page says the user is told about every request, and you have no lawful way to prevent that.
A request may then warn the suspect. A formal route through the authorities of the provider's country may be safer (unit 6A, Cross-Border Routes: Choosing the Right Channel).
7. The provider directory, and its limits
Outside these lessons we keep a provider directory page. For each provider it links to the official guideline page and shows the date we last checked it.
The directory helps you find the page. The provider's own page is the authority. Record the date you read it.
Worked example — "Kestrel Chat" (invented)
Constable Mara Okoye has a fraud complaint. The suspect used a messaging service called Kestrel Chat.
- The company. The terms say that "Kestrel Labs Ltd" serves users in Europe and "Kestrel Inc." serves all other users. Her victim and suspect are outside Europe. She notes Kestrel Inc.
- The page. A search finds a law firm's guide, a forum post with an email address, and a page on Kestrel's own help centre, linked from the footer. She uses the third.
- The ten questions. She notes: Kestrel Inc.; a portal that needs an official email address; the username with the date seen; account records on a direct request, message content only by a formal request; preservation with one extension; a separate emergency form; the user is told unless a court order forbids it; messages are encrypted and not held; times in UTC; page dated four months ago.
- The record. She saves the page as a PDF and writes the address and today's date in the file.
Before she writes the request she knows three things. She must register on the portal. She must not ask for message content. She must deal with user notice first.
Activity — pick the official page
You need the rules of an invented video service, "Lumo". Which result is official, and why?
lumo-police-guide.example-lawfirm.com/how-to-get-lumo-data, titled "Lumo Law Enforcement Guidelines (Official 2026)".help.lumo.example/safety/law-enforcement, titled "Information for authorities". The Lumo home page footer links to it.policeforum.example/threads/lumo-contact, a post that gives a free webmail address "for urgent Lumo requests".
Then answer: which of the ten questions would you read first if your case is covert? Which first if a child is missing?
Conclusion
You can now:
- name the company that answers for a user's region;
- find the provider's own page and tell it from a copy;
- read it for the ten questions and record the date;
- recognise when a direct approach may warn a suspect.
Where this unit sits. It builds on unit 6A, Cross-Border Routes: Choosing the Right Channel, and on unit 5A (Preservation: Freeze First), unit 5B (Asking Well: A Specific, Lawful and Sufficient Request) and unit 5C (Emergency Disclosure: Threat to Life). Next are unit X1A, Naming the Account: Identifiers by Kind of Service, and unit X2, The Direct Request and Police-to-Police Cooperation. Company teams should also take unit P1 (Receiving and Logging Requests; Publishing Your Rules).
Complete the Learning Check for this unit.