Scope
This guide focuses on preserving social media evidence under Federal Rule of Civil Procedure 37(e), detailing when the duty to preserve arises, what content is included, and how to implement defensible collection practices. It covers organization-owned accounts and employee-controlled accounts that may contain relevant content.
This guide does not address criminal discovery rules, state-specific preservation statutes, or third-party subpoena procedures for records you don't control.
Key Concepts and Definitions
Spoliation: The deletion, alteration, or loss of evidence that should have been preserved. Under FRCP 37(e), spoliation occurs when electronically stored information (ESI) is lost because a party didn't take reasonable steps to preserve it.
Reasonable anticipation: The point at which preservation duties begin. You don't wait for a filed complaint. A credible demand letter, regulatory notice, or incident with foreseeable litigation exposure starts the clock.
Possession, custody, or control: The standard for what you must preserve. If your organization can access content, it's within your control. This includes accounts employees use for work, even if hosted on third-party platforms.
Context: The surrounding information that gives meaning to a post or message, such as timestamps, comments, shares, audience settings, and account metadata.
Requirements Breakdown
FRCP 37(e) Framework
The rule establishes a three-part test:
Was ESI lost? This includes deleted posts, edited captions, deactivated accounts, or content removed by automatic deletion settings.
Should it have been preserved? The duty applies when litigation is reasonably anticipated and the content relates to claims or defenses in that dispute.
Did the party fail to take reasonable steps? Courts evaluate whether your preservation process was adequate given the circumstances.
If all three conditions are met and the information can't be restored through additional discovery, the court may impose measures to cure prejudice. If the court finds you acted with intent to deprive the opposing party of the evidence, sanctions can escalate to adverse inference instructions, dismissal, or default judgment.
What "Reasonable Steps" Means
You're not required to preserve everything. Focus on content that may relate to the anticipated dispute. Reasonable steps typically include:
- Issuing a litigation hold that specifically identifies social media platforms and accounts
- Suspending automatic deletion features on relevant accounts
- Capturing content with sufficient context to establish what was posted, when, and by whom
- Following up to verify the hold is being followed
The Lester v. Allied Concrete Company case shows what unreasonable looks like: instructing a client to "clean up" Facebook and MySpace content resulted in $700,000 in sanctions, with $522,000 assessed against the attorney who gave the instruction.
Implementation Guidance
Triggering Event Identification
Build a checklist for your intake process:
- Has the organization received a demand letter or notice of claim?
- Has an incident occurred that typically leads to litigation in your industry?
- Has a regulatory agency opened an investigation?
- Has an employee filed an internal complaint that may escalate?
When any of these conditions are met, evaluate whether social media content exists that may relate to the matter.
Account Inventory
Maintain a current list of organization-controlled accounts across platforms. Include:
- Official corporate accounts (marketing, customer service, executive)
- Department or team accounts
- Employee accounts used for work purposes
Don't forget accounts your team may not think of as "social media": YouTube channels, Reddit communities, Discord servers, or messaging apps with public-facing channels.
Capture Methodology
Screenshots alone don't preserve adequate context. In Deltondo v. The School District of Pittsburgh, a teacher's deletion of a Facebook post left only screenshots that failed to preserve information about who received, shared, or commented on the content. The court found this harmed the defendants' ability to defend their case and ordered $6,780 in attorneys' fees.
Your capture process should preserve:
- The complete post or conversation thread
- Visible timestamps and edit histories
- Comments and replies
- Audience or privacy settings
- Account identification details
For ongoing preservation needs, automated Accessioning tools capture content as it's published and retain it in a searchable repository. This removes the risk that an employee will forget to save a post or accidentally delete relevant content.
Legal Hold Execution
Your hold notice must be specific. "Preserve all relevant documents" doesn't tell an employee what to do with their Twitter account. Include:
- The specific platforms and accounts covered
- Instructions to stop deleting posts or messages
- Steps to disable automatic deletion features
- Contact information for questions about what's relevant
- A reminder that editing existing posts may constitute spoliation
Send follow-up reminders at regular intervals and when new information suggests additional content may be relevant.
Common Pitfalls
Assuming platform retention equals preservation: Leaving content on the original platform creates risk. Account users can delete posts, edit captions, or deactivate accounts. Platform terms of service may allow content removal. Capture and store evidence in a location you control.
Collecting screenshots without metadata: A screenshot shows what a post said but not when it was published, who could see it, whether it was edited, or how others responded. Courts increasingly reject screenshots as insufficient preservation.
Forgetting about private messages: Direct messages and private groups often contain more candid communications than public posts. Your hold must address these channels.
Relying on employees to remember: Expecting staff to manually save relevant posts as they're published doesn't work. People forget, misunderstand what's relevant, or leave the organization. Automate capture where possible.
Failing to preserve departing employee accounts: When an employee leaves, their personal accounts may contain work-related content. Address this in your hold process before access is lost.
Quick Reference Table
| Scenario | Preservation Trigger | Reasonable Steps | Risk If Missed |
|---|---|---|---|
| Demand letter received | Immediately | Issue hold; capture identified accounts; disable auto-deletion | Sanctions under FRCP 37(e); adverse inference |
| Workplace incident with litigation potential | When reasonably foreseeable | Preserve employee and organizational accounts related to incident | Loss of key evidence; inability to defend claims |
| Regulatory investigation notice | Upon receipt of notice | Hold all accounts that may contain relevant communications | Regulatory penalties; spoliation findings |
| Employee files internal complaint | When complaint suggests potential litigation | Preserve complainant, respondent, and witness accounts | Weakened defense; credibility damage |
| Product defect discovered | When defect may lead to claims | Capture customer service accounts; preserve internal team discussions | Inability to establish timeline; punitive damages exposure |
Your preservation duty begins when litigation becomes reasonably foreseeable, not when a complaint is filed. Err toward early preservation when the risk is unclear. The cost of over-preserving is lower than the cost of sanctions for under-preserving.





