They succeeded, and a Federal Court found that the law was vague enough to cause a reasonable person to guess whether they were breaking the law or not. Thus they found it violated the First Amendment rights of U.S. citizens, and struck it down.

Perhaps one of the biggest controversies involved the use of NSLs by the FBI. Because they allow the FBI to search telephone, email, and financial records without a court order they were criticized by many parties. In November 2005, BusinessWeek reported that the FBI had issued tens of thousands of NSLs and had obtained one million financial, credit, employment, and in some cases, health records from the customers of targeted Las Vegas businesses. Selected businesses included casinos, storage warehouses and car rental agencies. An anonymous Justice official claimed that such requests were permitted under section 505 of the USA PATRIOT Act and despite the volume of requests insisted "We are not inclined to ask courts to endorse fishing expeditions". Before this was revealed, however, the ACLU challenged the constitutionality of NSLs in court. In April 2004, they filed suit against the government on behalf of an unknown Internet Service Provider who had been issued an NSL, for reasons unknown. In ACLU v. DoJ, the ACLU argued that the NSL violated the First and Fourth Amendments of the U.S. Constitution because the USA PATRIOT Act failed to spell out any legal process whereby a telephone or Internet company could try to oppose an NSL subpoena in court. The court agreed, and found that because the recipient of the subpoena could not challenge it in court it was unconstitutional. Congress later tried to remedy this in a reauthorization Act, but because they did not remove the non-disclosure provision a Federal court again found NSLs to be unconstitutional because they prevented courts from engaging in meaningful judicial review.

Another provision of the USA PATRIOT Act brought a great deal of consternation amongst librarians. Section 215 allows the FBI to apply for an order to produce materials that assist in an investigation undertaken to protect against international terrorism or clandestine intelligence activities. Amongst the "tangible things" that could be targeted, it includes "books, records, papers, documents, and other items". Supporters of the provision point out that these records are held by third-parties, and therefore are exempt from a citizen's reasonable expectations of privacy and also maintain that the FBI has not abused the provision. As proof, then Attorney General John Ashcroft released information in 2003 that showed that section 215 orders had never been used. However, despite protestations to the contrary, the American Library Association strongly objected to the provision, believing that library records are fundamentally different to ordinary business records, and that the provision would have a chilling effect on free speech. The association became so concerned that they formed a resolution condemning the USA PATRIOT Act, and which urged members to defend free speech and protect patrons' privacy. They urged librarians to seek legal advice before complying with a search order and advised their members to only keeping records for as long as was legally needed. Consequently, reports started filtering in that librarians were shredding records to avoid having to comply with such orders.

Another controversial aspect of the USA PATRIOT Act is the immigration provisions that allow for the indefinite detention of any alien whom the Attorney General believes may cause a terrorist act. Before the USA PATRIOT Act was passed, Anita Ramasastry, an associate professor of law and a director of the Shidler Center for Law, Commerce, & Technology at the University of Washington School of Law in Seattle, Washington, accused the Act of depriving basic rights for immigrants to America, including legal permanent residents. She warned that "Indefinite detention upon secret evidence — which the USA PATRIOT Act allows — sounds more like Taliban justice than ours. Our claim that we are attempting to build an international coalition against terrorism will be severely undermined if we pass legislation allowing even citizens of our allies to be incarcerated without basic U.S. guarantees of fairness and justice. "Many other parties have also been strongly critical of the provision. Russell Feingold, in a Senate floor statement, claimed that the provision "falls short of meeting even basic constitutional standards of due process and fairness [as it] continues to allow the Attorney General to detain persons based on mere suspicion". The University of California passed a resolution condemning (amongst other things) the indefinite detention provisions of the Act, while the ACLU has accused the Act of giving the Attorney General "unprecedented new power to determine the fate of immigrants... Worse, if the foreigner does not have a country that will accept them, they can be detained indefinitely without trial."

Another controversial aspect of the USA PATRIOT Act is its effect on the privacy of British Columbian citizens. British Columbia’s privacy commissioner raises concerns that the USA PATRIOT Act will allow the United States government to access Canadians' private information, such as personal medical records, that are outsourced to American companies. Although the government of British Columbia has taken measures to prevent United States authorities from obtaining information, the widespread powers of the USA PATRIOT Act could overcome legislation that is passed in Canada. B.C. Privacy Commissioner David Loukidelis stated in a report on the consequences of the USA PATRIOT Act, “once information is sent across borders, it’s difficult, if not impossible, to control”.

In an effort to maintain their privacy, British Columbia placed amendments on the Freedom of Information and Protection of Privacy Act (FOIPPA), which was enacted as law on October 21, 2004. These amendments aim to place more firm limitations on “storing, accessing, and disclosing of B.C. public sector data by service providers. "These laws only pertain to public sector data and do not cover trans-border or private sector data in Canada. The public sector establishments include an estimated 2,000 “government ministries, hospitals, boards of health, universities and colleges, school boards, municipal governments and certain Crown corporations and agencies.”

Legal action has been taken in Nova Scotia to protect the province from the USA PATRIOT Act’s data collecting methods. On November 15, 2007 the government of Nova Scotia passed a legislation aimed to protect Nova Scotians’ personal information from being brought forward by the USA PATRIOT Act. The act was entitled “The new Personal Information International Disclosure Protection Act”. The goal of the act is to establish requirements to protect personal information from being revealed, as well as punishments for failing to do so. Justice Minister Murray Scott stated, "This legislation will help ensure that Nova Scotians' personal information will be protected. The act outlines the responsibilities of public bodies, municipalities and service providers and the consequences if these responsibilities are not fulfilled."