Senators Say a Secret FISA Court Ruling Is Being Withheld as Section 702 Renewal Looms

Two senators who sit at the center of U.S. intelligence oversight say the administration is sitting on a secret court ruling that Congress needs before it votes on the country’s best-known warrantless surveillance program. Senators Ron Wyden of Oregon and Adam Schiff of California told Director of National Intelligence Jay Clayton and Attorney General Todd Blanche, in a demand letter first reported by Wired, that the government missed its own deadline to release a Foreign Intelligence Surveillance Court opinion from March 2026. They want an explanation, and the names of the officials responsible, by November 6.

The fight matters well beyond Washington. Section 702 of the Foreign Intelligence Surveillance Act is the authority behind much of the U.S. collection of foreigners’ communications from American service providers, and it is the program European courts have focused on in every challenge to transatlantic data transfers. How the program is supervised, and how openly, feeds directly into the legal footing that companies rely on when they move personal data from Europe to the United States.

What the withheld ruling is about

According to the senators and to earlier reporting, the court in March objected to search filters that let intelligence analysts pull Americans’ messages out of intercepted data without the approvals, written justifications or records the law requires. The court still approved another year of collection. The New York Times reported in April, citing unclassified administration talking points sent to lawmakers, that the court found tools used to narrow intercepted data to an American’s messages amount to searches of Americans and ordered them rebuilt. Senator Alex Padilla has said in a written question that the Justice Department “is appealing portions” of the ruling.

Some background is public. A FISA court opinion declassified last year described an FBI “participants filter” that let agents select people in contact with surveillance targets and read their messages. In February 2025, the Justice Department told the court the tool had been running searches nobody counted. The FBI switched it off the next month and back on later that year after a rebuilt version was approved.

The deadlines in play

• September 13, 2026: the end of the 180-day window that the administration’s own public documentation gives for reviewing such rulings for release. The ruling remains classified.
• November 6, 2026: the date by which Wyden and Schiff want the administration to explain the delay.
• December 2026: when Congress usually finishes the annual defense authorization bill. Surveillance reform advocates expect the administration may try to attach a Section 702 renewal to it, as happened with a short extension in 2023.
• March 2027: when the court’s current approval of the program expires.

Section 702 itself lapsed in June 2026 when Congress did not renew it, but collection continues under the court’s March approval. Our earlier report on the White House push for a clean renewal of Section 702 covers how the reauthorization fight developed earlier in the year.

There is a broader pattern here. In April, Senators Tom Cotton and Mark Warner, the Intelligence Committee’s Republican chair and Democratic vice chair, asked for the ruling to be released within 15 days. In July, Blanche answered “Yes” in writing when asked whether he would declassify it by the 180-day deadline. Meanwhile, 23 civil liberties and accountability groups led by Demand Progress, ranging from the ACLU to the conservative-backed Project for Privacy and Surveillance Accountability, have urged congressional leaders not to reauthorize the program while the ruling stays secret.

The public compliance numbers do not settle the question either. Intelligence agency fact sheets from March 2026 cite a 98.9 percent compliance rate for FBI searches of Americans. The Justice Department inspector general’s October 2025 review put the figure at 98.6 percent and could not conclude the FBI’s querying problems were “entirely in the past.”

Why privacy teams outside government should care

Most companies will never receive a Section 702 directive. Many of them still depend on the legal arguments built around it.

1. EU-U.S. data transfers rest on it. The Court of Justice of the EU struck down Privacy Shield in 2020 in large part because of Section 702, as explained in our guide to the Schrems II ruling. The current EU-U.S. Data Privacy Framework depends on the European Commission’s view that U.S. safeguards are now adequate. Evidence that a secret court found search tools bypassing required approvals is the kind of material challengers will cite. Our report on a possible Schrems III challenge lays out how such a case could unfold.
2. Transfer impact assessments need updating. Companies that use standard contractual clauses must assess the law of the destination country. A lapsed statute, ongoing collection under a court approval, and a withheld ruling are all facts an honest assessment should mention.
3. Government access requests are a policy question. Providers that may receive directives need a clear internal process for reviewing them, escalating them and recording what they handed over, within what the law lets them disclose.
4. Certification still has to be kept current. If you rely on the Data Privacy Framework, your certification must be renewed on time. Our explainer on what happens if your DPF certification lapses covers the consequences.

Practical steps for transfer programs

• List every flow of EU, U.K. and Swiss personal data to the U.S., the mechanism each relies on (DPF, standard contractual clauses or another tool), and the recipients.
• Keep a fallback ready. If the DPF were struck down, which flows could move to standard contractual clauses quickly, and which would need technical measures such as encryption with keys held in Europe?
• Note in your transfer assessments that Section 702’s statutory status and oversight are in flux, and set a date to revisit after the November 6 response and the December defense bill.
• Check vendor contracts for commitments on government access requests and transparency reporting.

For a wider view of U.S. surveillance authorities beyond Section 702, see our overview of surveillance laws in the United States.

Where Captain Compliance fits

Captain Compliance helps teams map data flows and keep records of processing, including where data goes across borders and under which transfer mechanism, through its cross-border data transfer support. A current map makes it much faster to respond if a transfer tool is challenged. It does not change the legal risk of the underlying transfer.

Frequently asked questions

Has Section 702 expired?

The statutory authority lapsed in June 2026 without renewal, but collection continues under the FISA court’s March 2026 approval, which runs until March 2027.

What did the secret ruling decide?

The ruling is classified. Senators and press reports say the court objected to search filters that let analysts retrieve Americans’ messages without required approvals and records, and ordered the tools rebuilt. The Justice Department is reportedly appealing parts of it.

Does this affect the EU-U.S. Data Privacy Framework right now?

Not directly. The framework remains in place. The dispute adds facts that critics may use in future legal challenges, so companies relying on it should keep fallback plans current.

When will the ruling be released?

No date has been set. The senators asked for answers by November 6, 2026.

Should companies stop using the Data Privacy Framework?

There is no legal requirement to stop. The prudent step is to document your reliance on it and prepare alternatives.

Secrecy is part of the legal risk

European judges have said more than once that what makes U.S. surveillance hard to accept is not only its reach but the difficulty of knowing how it is controlled. A ruling that says controls failed, kept secret past the government’s own deadline, is close to the exact problem those judges described. Congress may renew Section 702 in a defense bill in December. Whatever it does, the next challenge to transatlantic data flows will probably cite this ruling, whether or not anyone outside a secure room has read it.