Orbital Data Centres: Who Licenses Them and Whose Law Applies to the Data

Are orbital data centres legal? Nothing in space law forbids one. Article I of the Outer Space Treaty leaves outer space free for use, and a computer is a use. The harder questions are who has to approve it, whose rules govern the data on board, and who carries the loss when it fails.

Those questions have stopped being theoretical. Law firms now write client alerts on them, and the FCC’s file of pending applications adds up to more than 80 times the number of satellites Earthjustice says are in orbit today, about 15,000. This piece sets out where the law stands for developers, investors and customers.

What has been filed

The FCC’s Space Bureau has accepted four applications, as WilmerHale recorded on 1 October.

SpaceX asked for up to one million satellites at 500 to 2,000 km, accepted on 4 February. Starcloud asked for up to 88,000 at 600 to 850 km, on a list dated 13 March. Blue Origin’s Project Sunrise covers up to 51,600 at 500 to 1,800 km, on a list dated 17 April. Orbital Compute asked for up to 100,000 at 500 to 850 km, on a list dated 31 July. I found no grant of any of them in searches up to 5 November.

A note of caution on timing. The Government Accountability Office said in April that running data centres in orbit is unproven, that “space does not cool computing hardware efficiently”, and that some satellites are planned by the mid-2030s. WilmerHale says large-scale facilities are not imminent. Smaller systems that process data already generated in space are closer.

Who licenses what

There is no single regulator and no licence for orbital computing as such.

The FCC is the first stop, but its hook is radio. In its environmental proceeding it said it “licenses the use of spectrum, not facilities” (91 FR 66062). The SpaceX notice describes primarily optical inter-satellite links, with radio for telemetry, tracking and command on a non-interference basis, and Starcloud and Orbital Compute describe their radio request as back-up telemetry, tracking and command. As I read those filings, the radio licence reaches a small part of the system. Debris and disposal rules come with it, but WilmerHale notes the FCC considered large-constellation standards “premature to adopt”.

The FAA licenses launch and reviews payloads. The Office of Space Commerce handles remote sensing and runs the mission authorisation pilot set up under Executive Order 14335. The notice says participation is voluntary and non-binding and a certificate “will have no direct legal effect”, though it could one day stand in for parts of a payload review or inform FCC debris waivers.

Article VI of the Outer Space Treaty still requires “authorization and continuing supervision” of private activity. For a data centre, that supervision is split across these agencies, as we set out in our guide to who regulates space in the US. WilmerHale warns that a company can satisfy one regulator and then meet new concerns from another.

Milestones and the speculation problem

All four applicants ask to be excused from the FCC’s milestone and surety bond rules in 47 CFR 25.164 and 25.165. That request is the commercial heart of these filings.

The rules are changing. Under the new Part 100, as we explained in our note on milestones and surety bonds, systems licensed outside a processing round post no bond and face a longer schedule: one satellite working within seven years, then 10%, 50% and 100% of the system by years nine, 12 and 14. The Space Bureau has said pending applications authorised after the Effective Date get the Part 100 rules. I could not find that date, or the order itself, in the Federal Register.

Run the arithmetic for a million satellites and year nine alone means 100,000. An investor should ask what happens to the unbuilt authority if a system falls short.

Rivals are pressing the same point. Amazon asked the FCC to deny SpaceX’s application as a “speculative placeholder“. NASA told the FCC that Blue Origin’s system must not “compromise human spaceflight, national assets, or the scientific use of the space environment“. I read both as arguments about how a licence should be conditioned, and I expect conditions to matter more than the headline number.

Whose law applies to the data

The tempting pitch is that data in orbit sits beyond national law. It does not.

The starting point is Article VIII of the Outer Space Treaty: the State of registry keeps “jurisdiction and control” over the object. So the registry State’s law follows the satellite. Data law then adds its own layers, and most of them ignore geography.

The GDPR applies to processing in the context of an EU establishment “regardless of whether the processing takes place in the Union or not”, and to a non-EU operator offering services to people in the Union. Under Article 3 the server’s location is beside the point.

Transfers are the harder question. The European Data Protection Board’s test asks whether the importer “is in a third country”, and orbit is not a country. Lawyers at Abreu Advogados, writing for the International Bar Association, say in-orbit processing on a third-country satellite may be a transfer, and that the treatment “remains uncertain”. My own view is that the useful question is where the operator is established and who can reach the data. The Board treats remote access from a third country as a transfer where its criteria are met, so a US-operated satellite should be assumed to raise the same issues as a US cloud.

That point may sharpen. The FCC’s Further Notice tentatively concludes that every licensed space station should keep a US-based control point. The FCC’s reason is safety, but a European customer’s lawyer will read it as a fact about access.

The US side is blunt too. Under 18 USC 2713, the CLOUD Act provision, a provider must disclose data in its possession, custody or control “regardless of whether” it is located within or outside the United States. State breach laws work the same way, attaching to the residence of the people affected, as a Washington Lawyer article sets out. It adds that enforcement stays practical while operators keep ground stations, assets or market presence on Earth.

Europe may add a fourth layer. The Irish Presidency’s text of the EU Space Act defines space-based data as “any type of data, whether raw or processed”, including data “exchanged with” a spacecraft. Article 14, as we noted in our note on that text, requires third-country operators to be entered in a Union repository before providing such data in the Union. Whether an orbital cloud provider counts is unclear to me, and this remains a draft, but the definition is wide enough that I would raise the question.

Who pays when it fails

Treaty liability will not help a customer. The Liability Convention defines damage as loss of life, injury or impairment of health, or loss of or damage to property. The Abreu authors say it does not cover purely economic loss, and they note these instruments were not built for data breaches or service interruption. Our own view is that the text leaves pure economic loss unsettled, but no customer should plan around that.

So the risk sits in contract. WilmerHale lists what agreements should allocate: licensing delay, launch complications, hardware replacement, capacity loss, collision and debris events, outages, cyber incidents, data loss and early termination. Hardware risk is high, since GAO warns that radiation can corrupt data and degrade hardware and that limited servicing may retire satellites early.

Insurance needs the same early look. WilmerHale cautions that property, cyber, technology errors and omissions, launch and in-orbit products may not fit, so nobody should assume cover exists until a broker has confirmed it.

Environmental and export questions

Environmental review has narrowed at the FCC. On 8 July Earthjustice asked the Commission to pause these applications for a programmatic review. On 30 September the FCC concluded that space-based operations fall outside NEPA, as we covered in our note on the order. A challenge is likely, and FAA launch licensing still carries NEPA for now.

Export control may soon be part of the application. The same Further Notice asks whether applicants should certify compliance with the EAR and ITAR in the design, launch, operation and control of their systems. Anyone buying launch abroad or sharing technical data with foreign partners should start from our export controls guide.

What I would watch

The first is the first grant. Its conditions will tell us more than any filing: how many satellites, what milestones, what debris and collision terms, and whether the FCC answers the environmental petition or simply steps past it.

The second is the FCC’s comment deadline of 25 November on the Further Notice. Replies on the US control point and export certification will show how operators with foreign customers see those proposals.

The third is Brussels. If the EU Space Act’s definition of space-based data survives, or a data protection authority takes a view on in-orbit transfers, orbital data centres will have their first Europe-specific compliance cost. I would expect customers to ask about it before regulators do.

Anuj KumarEditor-in-Chief

Anuj Kumar is the founder of Legal Desire Media and publishes Fashion Law Journal and Space Law Journal.

Space Law Journal is a joint initiative of Legal Desire Media and Odyogeek. Spotted something we got wrong, or want to respond? Write to space@legaldesire.com.