Records, Preservation or Future Logging: Which Request?
A request for records already held, a preservation demand and a future collection order are three operations. Read which one the document authorises first.
A headline says a VPN provider was ordered to hand over records, and the comment thread concludes that every VPN must now be logging. The document behind the headline may have asked for records that already existed, or asked the provider to keep what it has while further process is obtained, or authorised collection of specified attributes going forward. Those are three different operations with three different limits. Read which one the document performs before you draw a conclusion.
Three operations that get called a subpoena
The word in the headline is usually a category error rather than a lie. A request for existing records, a preservation demand and an authorisation for prospective collection all arrive as legal paperwork, and they are not interchangeable. Each one names a different action, a different time range and a different set of recipients. Reading which one applies takes a minute and prevents most of the bad conclusions.
| Operation | What it asks for | What it does not do |
|---|---|---|
| Records request | Information already held by the provider | Create data that was never collected |
| Preservation | Keep existing records while process continues | Disclose them to the requester |
| Prospective collection | Capture specified attributes going forward | Read the contents of communications |
That table is a reading aid, not a legal taxonomy, and the specific instrument matters. A service's classification, its jurisdiction and the information named in the document all change the analysis, which is why the useful question is always "which operation, over what period, for which categories".
What already exists is a different question
For a United States example, 18 USC 2703 provides different routes for communications and for customer records, and subsection (c)(2) identifies certain subscriber information obtainable with specified process. It does not say that every kind of information is available through the same instrument.
That distinction is the one a privacy policy cannot answer for you. A statement about browsing-history retention may say nothing about an account record, a payment record or a support ticket, because those are different categories with different retention.
So read the policy as a list of categories rather than as a single promise. Ask which records exist, for how long, and under whose control, and treat "we keep no logs" as a claim about one category until the provider says otherwise. Then ask which category the request actually names. The mismatch between those two answers is where most public arguments about VPN logging go wrong.
Preservation is not disclosure
Preservation asks a provider to keep evidence already in its possession while further process is obtained. It does not hand that evidence to anyone, and it does not create a new stream of records. The distinction is easy to lose in a summary that says the provider was "ordered to retain data".
For the person reading the news, that means a preservation order is not evidence that a provider changed its collection practices. For the operator receiving one, it means the obligation is about not destroying something, which is a much narrower action than building a pipeline.
Both readings point at the same practical rule: freeze the relevant state and stop changing it until someone qualified has reviewed the request. Deleting in a hurry and collecting in a hurry are both ways to make the situation worse. A written note of what existed at the time the demand arrived is worth more than any later reconstruction.
Future collection has its own authority
Prospective collection is a separate mechanism again. In the United States, pen-register and trap-and-trace orders under 18 USC 3123 address authorisation, specified communications attributes, assistance, time periods and nondisclosure, while the definitions in section 3127 exclude communications contents from those categories.
That exclusion is the part people miss when they conclude that an order authorises reading messages. The category is about attributes, not content, and the statute is specific about what it covers. Whether a particular request fits inside that boundary is a question for a lawyer rather than a blog post.
It also follows that a provider's ordinary no-logs policy is not a legal shield. A policy describes what is collected by default; an obligation describes what must be done under a valid instrument. Those two statements can both be true and still conflict in practice.
What to do when a request arrives
Route the document to the responsible reviewer immediately and preserve it exactly as received, including headers and attachments. Note the deadlines, the confidentiality terms and the categories named, because those three facts drive everything that follows.
Do not assemble a collection or deletion change out of an online summary. Do not notify the affected user before checking whether nondisclosure applies, and do not assume it does without reading the instrument.
If you are choosing a provider rather than operating one, read the data policy next to its transparency report and notice the gaps. An absence of published requests is not proof that demands are technically impossible, and a published policy is not proof that no other category exists.