> It'd almost certainly require consent or a warrant to get the data (in the US).

The problem is that, as many court rulings have affirmed, in the US it's not "your" data anymore when it gets to the company's servers.

At that point, most companies will hand over everything to a politely-worded request, with only a few actually holding out to the point of a warrant.