By the Subsentio Compliance Team. Reviewed for accuracy against the Stored Communications Act (18 U.S.C. 2701 et seq.) and current carrier transparency reporting.
TL;DR: In February 2026, the three largest wireless carriers were called before a Senate subcommittee to explain how they handled subpoenas for the phone records of members of Congress. The lesson for every provider was not about politics. It was about process. A phone records subpoena is a routine legal demand, but handling it correctly means validating the order, producing only what the law authorizes, notifying the customer when you are allowed to, and challenging a gag order that goes too far. Most providers face these far more often than a wiretap, and the ones caught out lack a process built in advance.
The Hearing That Put Records Production on the Front Page
In February 2026, executives from Verizon, AT&T, and T-Mobile sat before a Senate Judiciary subcommittee to answer for how they responded to subpoenas, issued during the Arctic Frost investigation, that sought the toll records of sitting members of Congress. Toll records are call metadata: the numbers, dates, and durations, not the conversation itself. The subpoenas arrived with court-ordered provisions barring the carriers from telling the affected customers.
The politics of that investigation are not the point here. What matters for any provider is what the hearing exposed about process. One carrier's general counsel testified that the subpoenas did not identify the numbers as belonging to members of Congress, and that the company had no process to flag and escalate sensitive requests before responding. That is not a political failing. It is an operational one, and any provider can have it.
A Phone Records Subpoena Is Not a Blank Check
The first thing a provider has to know is what a given demand actually authorizes, because the instrument controls what you may hand over. Under the Stored Communications Act, the government reaches stored customer records through three different instruments, each with a different reach. A subpoena compels only basic, non-content records, the limited categories the statute lists, such as name, address, subscriber number, calling records, and payment records. A court order under the same statute reaches further into non-content transactional data, and can authorize location information. The contents of communications require a search warrant based on probable cause.
This matters because over-producing is its own liability. Carriers carry an independent duty to protect customer call records, so handing over the contents of a message, or data that requires a warrant, is not cooperation. It is a violation. Reading the order to determine exactly what it authorizes, before anything leaves the building, is the single most important step.
What Good Process Looks Like
The carriers were not faulted for complying with valid legal demands. The law in fact shields a provider from liability for producing records in good-faith compliance with a valid order, subpoena, or warrant. They were faulted for not having a process. A defensible one has four parts.
Validate the order. Confirm jurisdiction, scope, dates, and that the instrument matches the data sought. This is not a formality. In its public transparency reporting, Verizon declined to produce records for roughly one in ten demands in a recent six-month period, because some were legally invalid, misdirected to the wrong provider, or sought data the company did not have.
Flag and escalate the sensitive ones. Some requests, by whom they touch or what they seek, need a second set of eyes before anyone responds, and the absence of that step is what turned a routine demand into a public reckoning.
Notify the customer when you can. By default, a provider may tell a customer that their records have been sought. That right disappears only when a court issues a nondisclosure order, and even then the order must be justified and usually time-limited. Providers can, and increasingly do, challenge gag orders that are overbroad or open-ended.
Produce only what is authorized. Complete, accurate, on time, and limited to what the instrument covers.
The Record You Cannot Produce
There is a quieter failure that never makes a hearing. A common reason a provider cannot fill a request is that the records are no longer available by the time the demand arrives, and a record you cannot locate in time is, in practical terms, a record you do not have. The civil suit against Hertz, brought by a man who spent nearly five years in custody before the company located a receipt that supported his innocence, is the extreme version of the same problem: the evidence existed, but could not be produced when it mattered. Retention and retrieval are part of records production, not separate from it.
Why This Reaches Every Provider, Not Just the Giants
It is easy to read a hearing about the three giants and assume it has nothing to do with a regional ISP or a VoIP operator. The opposite is true. Most providers receive a subpoena for stored records long before they ever face a real-time wiretap, and the smaller the compliance team, the more a single mishandled order matters. The scale is real: Verizon alone reported 27,721 warrants in just the first half of 2025, on top of tens of thousands of subpoenas and orders. Each one was handled by a process, or by its absence.
This is also the thread that ties telecom compliance to the wider trust and safety field. As that community gathers at TrustCon in July, the same question sits at the center of both worlds: when a lawful request for records arrives, can you answer it correctly, lawfully, and on time? For a carrier, the answer is a process. For a platform, it is the same.
A Quick Self-Check
Before the next subpoena lands, you can pressure-test your own readiness:
- Do you have a written process to validate an incoming order and confirm what it authorizes?
- Can you flag a sensitive or unusual request for review before responding?
- Do you know when you may notify a customer, and when a gag order bars it?
- Can you locate and produce responsive records, in the right form, on deadline?
If any answer is no, that is the gap to close before it is tested for real.
Frequently Asked Questions
What is a phone records subpoena? It is a legal demand for a customer's non-content phone records, such as numbers called, dates, and durations. Under the Stored Communications Act, a subpoena reaches only limited categories of records; the contents of communications require a search warrant, and location information requires a court order or a warrant.
Can we tell a customer their records were subpoenaed? Usually yes. A provider may choose to notify a customer by default. That changes only when a court issues a nondisclosure order, which must be justified and usually time-limited and can be challenged if it is overbroad.
Are we liable for complying with a subpoena? The law shields a provider that produces records in good-faith compliance with valid legal process. The risk runs the other way: producing more than the instrument authorizes, or mishandling the order, is where exposure lives.
When the Subpoena Arrives, Be Ready
A phone records subpoena is routine until it is mishandled. Subsentio reviews and validates legal demands and manages records production for communications providers of every size, so that when an order arrives, the process is already in place: the order is read correctly, the response is limited to what the law allows, and your customers' rights and yours are protected. Request a records-production review and see where your process stands before the next demand lands.
About Subsentio: Subsentio helps communications providers meet their law enforcement assistance obligations as a trusted third party. Beyond CALEA lawful intercept, it reviews and validates court orders, subpoenas, and other legal demands and manages records production for carriers, broadband providers, and VoIP operators.
