"(《世界人权宣言》) 欧盟电子证据条例（EU）2023/1543 is often discussed as if it were a problem only for telecoms. It is not. Since 2026 年 8 月 18 日, online marketplaces, SaaS platforms, cloud storage and IaaS providers, hosting companies, social networks and collaboration tools can all be in scope, if they let users communicate with each other or if storing data for users is a defining part of the service. If that describes your platform and you offer services to users in the EU, you must be ready to receive and execute European Production Orders (sent as EPOCs) and European Preservation Orders (transmitted as EPOC-PR certificates) — directly from the issuing authority, on tight regulatory deadlines. For production orders covering traffic or content data, the authority in your addressee’s Member State is usually notified and can raise grounds for refusal within 10 days (96 hours in emergencies).
For platforms that have historically dealt with data requests as an occasional, ad-hoc legal matter, this is a step-change. The German government’s implementing bill estimates around 10,000 affected service providers in Germany alone. This guide explains exactly which platforms are affected, what kinds of orders to expect, what the regulation requires of marketplaces and cloud providers in particular, and how to build a compliant operating model now that the Regulation applies.
哪些在线平台属于电子证据的范围？
条例》特意使用了宽泛、技术中立的定义，以反映现代在线服务的实际情况。与平台运营商最直接相关的类别包括
- 在线市场 — where they let buyers and sellers communicate with each other (messaging, Q&A, reviews) or store data on users’ behalf; being a marketplace is not enough on its own (Regulation (EU) 2023/1543, Art. 3(3)(c) and recital 27). This can cover B2C marketplaces, peer-to-peer trading platforms, ticketing platforms, gig and on-demand marketplaces, and rental platforms.
- 云计算和存储提供商 - IaaS、PaaS 和 SaaS 提供商、对象/文件存储服务、备份和灾难恢复提供商以及托管数据库服务。.
- 托管服务提供商 — managed hosting, dedicated servers, VPS, and CDNs and edge platforms where they store customer data.
- 社交网络和在线社区 - 包括论坛、约会应用程序、专业网络、具有社交功能的游戏平台以及创作者/流媒体平台。.
- 存储用户数据的信息社会服务 - 协作套件、文件共享工具、项目管理平台、低代码/无代码平台以及保留提示或输出的人工智能产品。.
- 互联网域名和 IP 号码服务 — registries, registrars, privacy/proxy services and regional internet registries.
- 与数字无关的人际交流 - 嵌入到大型产品中的超顶信息、视频会议和聊天功能。.
最重要的是，该条例适用于 “实质性联系 ”测试: you are in scope if users in the EU can use your service and you have a substantial connection to the EU: an establishment there, a significant number of EU users, or activities targeted at EU Member States (language, currency, local app store, ads), regardless of where your corporate entity is registered. Mere accessibility of your website is not enough.
当局会要求提供哪类数据？
该条例区分了四类电子证据，每一类都有不同的门槛和保障措施：
- 用户数据 - 身份、联系方式、账单信息、使用的服务类型和注册日期。.
- 仅为识别用户身份而要求提供的数据 — IP addresses with, where needed, source port and timestamp, requested only to identify a person.
- 交通数据 (other than identification data) — connection logs, transaction metadata, purchase history, device IDs, timestamps and routing information.
- 内容数据 — listings, messages, uploaded files, photos, documents and other substantive content.
For production orders, subscriber and identification data may be requested for any criminal offence; traffic and content data are reserved for offences punishable in the issuing State by a maximum sentence of at least three years, or for listed offences: non-cash payment fraud, child sexual abuse and attacks against information systems committed online, and terrorist offences. Preservation orders can cover any data category for any criminal offence. Marketplaces and 云平台 通常同时包含这四个类别——这就是为什么精确的数据映射是一项基础性的合规工作。.
市场和云平台上的典型电子证据场景
在线市场欺诈
An investigator pursuing a fraud ring asks a marketplace operator for the seller’s identity, registration IP, transaction history and message threads with victims. Subscriber data and the registration IP address (identification data) can be ordered for any criminal offence. Transaction metadata, message threads and photos are traffic and content data: they need a judge-issued or judge-validated order for an offence carrying a maximum of at least three years (or a listed offence such as online payment fraud), and the enforcing State is usually notified at the same time.
云平台上的勒索软件和基础设施滥用
A prosecutor investigating a ransomware operation asks a cloud provider for control-plane logs, instance metadata, billing identity and storage access logs for a suspect tenant. Where the attack threatens life or critical infrastructure (e.g. a hospital), these can arrive as emergency orders with an 8-hour deadline; otherwise the 10-day deadline applies.
在线儿童安全调查
Investigations into child sexual abuse material on social or content platforms typically combine identification orders with content production and preservation orders. These cases benefit from the Regulation’s specific offence list and, where a child is at imminent risk, the 8-hour emergency regime, but also demand the highest standards of integrity and chain of custody.
账户接管和大规模网络钓鱼
Authorities may issue European Preservation Orders (sent as EPOC-PRs) early in an investigation to lock down logs and account data while a production order is prepared. Platforms must be able to preserve specific datasets for 60 days, extendable by 30, and for as long as needed once the authority confirms that a production request has been issued, without disturbing normal retention or analytics workflows.
Designated Establishment or Legal Representative: Who Receives Your Orders
Every in-scope provider that is active in more than one Member State, or established outside the EU, must name an addressee for orders: EU-established providers designate one of their EU establishments as the 指定机构; providers without an EU establishment appoint a 法定代表人 in a participating Member State (Directive (EU) 2023/1544, Art. 3). New entrants have six months from launch. This addressee is the address of service for every EPOC and EPOC-PR — and is itself liable for compliance.
- Without a designated establishment or legal representative you breach national law implementing Directive (EU) 2023/1544 (in Germany: fines up to EUR 500,000). Failing to execute orders can cost up to 2% of worldwide turnover.
- 指定实体必须在国家主管机构注册（在德国为 联邦司法局; 其他会员国也有相应的规定）。.
- 它必须拥有在监管期限内执行命令的权力和业务能力。.
- 它必须与您的全球法律、安全和工程团队无缝协调，而且往往是跨时区协调。.
For non-EU platforms, the most efficient solution is often a legal representative service: an EU-based partner appointed under Directive (EU) 2023/1544, jointly liable with you, that runs the 24/7 intake, validates and triages orders, and escalates to your in-house teams the substantive decisions that require platform-side knowledge. SMEs may share a legal representative with other providers.
市场和云平台的运行要求
合规不仅仅是纸上谈兵。为了可靠地满足 10 天标准期限和 8 小时紧急期限的要求，平台通常需要：
- Secure intake through the national e-Evidence system of the Member State where your addressee sits, either via the ETSI TS 104 144 API or the web interface, with validation of qualified electronic signatures and seals (Art. 21) and issuing-authority credentials.
- 跨系统数据发现 能够在传统和现代数据存储中定位用户、身份识别、流量和内容数据。.
- Standardised delivery through the same channel, in formats the issuing authority can process, with integrity hashes.
- 加密传输 to the issuing authority’s X.509 certificate where one is supplied, with verifiable receipt and audit-grade logging; files over 25 MB go by the most appropriate secure alternative means (Art. 19(5)).
- 防篡改审计跟踪 涵盖从接收到交付的每一个操作--这对证据完整性和事后监管审查至关重要。.
- 全天候待命的法律和工程响应人员, 在紧急订单方面，有经过演练的运行手册。.
- 数据最小化控制 根据《个人信息处理条例》（GDPR）第 5 条的规定，确保您只披露特别订购的内容。.
- Optional e-Evidence statistics (Art. 28(4)), coordinated with any DSA transparency reporting you already publish.
对于最大的平台来说，在内部构建所有这些功能是可行的，但大多数市场和云提供商都受益于专门构建的解决方案。云计算 ICS 电子证据合规平台 它涵盖了从接收到验证、提取、审查和交付的整个生命周期，并与现有的身份、日志和存储系统相集成。.
云服务提供商的特殊考虑因素
Cloud providers face several layered challenges that pure-content platforms do not. Orders should normally go to your business customer as data controller. You will be addressed directly only if the controller cannot be identified or approaching it would jeopardise the investigation, and you must inform the customer unless the authority asks you not to (Art. 5(6)-(7)).
- 多租户和隔离 生产必须以单个客户的数据为目标，同时在技术和合同上不暴露其他租户。.
- 客户控制加密： 在客户持有自己的密钥（BYOK/HYOK）的情况下，提供商可能确实无法提供内容数据，这种限制必须记录在案并加以说明。.
- 分担责任： 合同和数据处理协议应明确说明哪一方负责接收和执行有关哪些数据的执法命令。.
- 通知客户： 商业客户--尤其是企业 B2B 客户--通常拥有获得访问请求通知的合同权利，但须遵守签发机构规定的保密义务。.
- 跨地区复制： data may sit in multiple Member States or third countries, raising potential conflicts between EU orders and third-country law (the “Article 17 review”), raised as a reasoned objection within 10 days; the mere fact that data is stored outside the EU is not a valid ground.
网上市场的特殊考虑因素
- 卖方验证数据 (KYC、商业登记、税号）往往是对调查人员最有价值的用户数据，必须能够随时提取。.
- 列表和信息 这些数据通常是内容数据，需要较高的犯罪严重性阈值才能生成。.
- 付款数据 held by payment service providers is outside the e-Evidence Regulation (financial services are excluded); authorities obtain it through national procedures.
- 跨境卖家 造成与消费者保护、增值税和每日生活津贴义务的重叠；电子证据应与这些方案结合，而不是重复。.
违规处罚
Member States must impose effective, proportionate and dissuasive penalties. Member States must allow pecuniary penalties of up to 2% of total worldwide annual turnover for failing to execute orders or protect their confidentiality. Germany, for example, fines up to EUR 500,000, or up to 2% of turnover for providers above EUR 25 million; for hyperscalers and large marketplaces, the headline figures rapidly become material to financial reporting. Beyond fines, repeated failures can trigger court orders, regulatory action and significant reputational damage with enterprise customers, partners and investors.
A 90-Day Catch-Up Plan for Platforms
- Days 1–15 — Scope and data mapping. 确认哪些实体和服务在范围内，映射各系统的用户/身份/流量/内容数据，找出差距。.
- Days 15–30 — Legal foundations. Designate an EU establishment or appoint a legal representative, register with the competent authority, update contracts, DPAs, terms and law-enforcement guidelines.
- Days 30–60 — Technical build. Connect to the national e-Evidence system of the Member State where your addressee sits (ETSI TS 104 144 API or web interface). As of September 2026 only Germany and Ireland can receive orders this way; elsewhere, agree a secure fallback channel with the authorities. Deploy intake/validation/extraction tooling, harden audit logging.
- Days 60–80 — Operational readiness. 招聘和培训全天候响应团队，最终确定运行手册，开展应急桌面演练。.
- Days 80–90 — Assurance. Independent compliance audit, board-level sign-off and a go-live rehearsal.
常见问题
如需更详细的参考资料，请参阅我们的 电子证据常见问题.
电子证据是否适用于小型市场和云计算初创企业？
Yes. There is no general SME exemption. If you offer an in-scope service to users in the EU, you are in scope regardless of headcount or revenue. Smaller platforms can scope their compliance proportionately, but the core obligations — designated establishment or legal representative, intake, response capacity — still apply. The exception: a provider established in one Member State and offering services only there need not designate an addressee (Directive (EU) 2023/1544, Art. 1(5)). SMEs may share a legal representative with other providers.
我们能依靠现有的执法工作流程吗？
Probably not. Most existing workflows assume manual email/portal intake and weeks of turnaround. The e-Evidence Regulation requires intake through the national e-Evidence system (ETSI TS 104 144 API or web interface), hour-level emergency response and tamper-evident audit logs that legacy workflows usually do not provide.
如果数据由子处理程序或我们集团的其他部门持有，该怎么办？
The provider receiving the order is responsible for executing it. Orders are normally addressed to the data controller; a processor is addressed only if the controller cannot be identified or approaching it would jeopardise the investigation, and must then inform the controller unless told not to (Art. 5(6)-(7)). Internal contracts and data-processing arrangements must be aligned so that you can compel a sub-processor or affiliate to deliver data within the regulatory deadlines.
端到端加密服务如何？
条例》并未要求提供商削弱加密。如果由于客户持有的密钥或真正的 E2E 架构而确实无法访问内容数据，则可以告知这一限制，但仍必须提供用户、身份和元数据。.
ICS 如何帮助平台做好准备
ICS 同时提供 技术合规平台 and a legal representative service (with support for EU providers running their own designated establishment) for platforms of all sizes — from fast-growing SaaS scale-ups to global marketplaces and hyperscale cloud providers. Our combined offering covers intake through the national e-Evidence system (ETSI TS 104 144 API or web interface), automated validation, multi-system data extraction, encrypted delivery, tamper-evident audit logging and 24/7 managed operations, all framed within an integrated 电子证据合规方案.
立即联系 ICS for an independent e-Evidence readiness assessment for your platform, with a clear plan to close any gaps now that the Regulation applies (since 18 August 2026).
