Skip to main content
Promotional banner for the pentest readiness checklist
Social Media Evidence Preservation Under FRCP 37(e)eDiscovery & Legal Holds
5 min readFor Legal Operations Professionals

Social Media Evidence Preservation Under FRCP 37(e)

Scope

This guide focuses on preserving social media evidence under Federal Rule of Civil Procedure 37(e), detailing when the duty to preserve arises, what content is included, and how to implement defensible collection practices. It covers organization-owned accounts and employee-controlled accounts that may contain relevant content.

This guide does not address criminal discovery rules, state-specific preservation statutes, or third-party subpoena procedures for records you don't control.

Key Concepts and Definitions

Spoliation: The deletion, alteration, or loss of evidence that should have been preserved. Under FRCP 37(e), spoliation occurs when electronically stored information (ESI) is lost because a party didn't take reasonable steps to preserve it.

Reasonable anticipation: The point at which preservation duties begin. You don't wait for a filed complaint. A credible demand letter, regulatory notice, or incident with foreseeable litigation exposure starts the clock.

Possession, custody, or control: The standard for what you must preserve. If your organization can access content, it's within your control. This includes accounts employees use for work, even if hosted on third-party platforms.

Context: The surrounding information that gives meaning to a post or message, such as timestamps, comments, shares, audience settings, and account metadata.

Requirements Breakdown

FRCP 37(e) Framework

The rule establishes a three-part test:

  1. Was ESI lost? This includes deleted posts, edited captions, deactivated accounts, or content removed by automatic deletion settings.

  2. Should it have been preserved? The duty applies when litigation is reasonably anticipated and the content relates to claims or defenses in that dispute.

  3. Did the party fail to take reasonable steps? Courts evaluate whether your preservation process was adequate given the circumstances.

If all three conditions are met and the information can't be restored through additional discovery, the court may impose measures to cure prejudice. If the court finds you acted with intent to deprive the opposing party of the evidence, sanctions can escalate to adverse inference instructions, dismissal, or default judgment.

What "Reasonable Steps" Means

You're not required to preserve everything. Focus on content that may relate to the anticipated dispute. Reasonable steps typically include:

  • Issuing a litigation hold that specifically identifies social media platforms and accounts
  • Suspending automatic deletion features on relevant accounts
  • Capturing content with sufficient context to establish what was posted, when, and by whom
  • Following up to verify the hold is being followed

The Lester v. Allied Concrete Company case shows what unreasonable looks like: instructing a client to "clean up" Facebook and MySpace content resulted in $700,000 in sanctions, with $522,000 assessed against the attorney who gave the instruction.

Implementation Guidance

Triggering Event Identification

Build a checklist for your intake process:

  • Has the organization received a demand letter or notice of claim?
  • Has an incident occurred that typically leads to litigation in your industry?
  • Has a regulatory agency opened an investigation?
  • Has an employee filed an internal complaint that may escalate?

When any of these conditions are met, evaluate whether social media content exists that may relate to the matter.

Account Inventory

Maintain a current list of organization-controlled accounts across platforms. Include:

  • Official corporate accounts (marketing, customer service, executive)
  • Department or team accounts
  • Employee accounts used for work purposes

Don't forget accounts your team may not think of as "social media": YouTube channels, Reddit communities, Discord servers, or messaging apps with public-facing channels.

Capture Methodology

Screenshots alone don't preserve adequate context. In Deltondo v. The School District of Pittsburgh, a teacher's deletion of a Facebook post left only screenshots that failed to preserve information about who received, shared, or commented on the content. The court found this harmed the defendants' ability to defend their case and ordered $6,780 in attorneys' fees.

Your capture process should preserve:

  • The complete post or conversation thread
  • Visible timestamps and edit histories
  • Comments and replies
  • Audience or privacy settings
  • Account identification details

For ongoing preservation needs, automated Accessioning tools capture content as it's published and retain it in a searchable repository. This removes the risk that an employee will forget to save a post or accidentally delete relevant content.

Legal Hold Execution

Your hold notice must be specific. "Preserve all relevant documents" doesn't tell an employee what to do with their Twitter account. Include:

  • The specific platforms and accounts covered
  • Instructions to stop deleting posts or messages
  • Steps to disable automatic deletion features
  • Contact information for questions about what's relevant
  • A reminder that editing existing posts may constitute spoliation

Send follow-up reminders at regular intervals and when new information suggests additional content may be relevant.

Common Pitfalls

Assuming platform retention equals preservation: Leaving content on the original platform creates risk. Account users can delete posts, edit captions, or deactivate accounts. Platform terms of service may allow content removal. Capture and store evidence in a location you control.

Collecting screenshots without metadata: A screenshot shows what a post said but not when it was published, who could see it, whether it was edited, or how others responded. Courts increasingly reject screenshots as insufficient preservation.

Forgetting about private messages: Direct messages and private groups often contain more candid communications than public posts. Your hold must address these channels.

Relying on employees to remember: Expecting staff to manually save relevant posts as they're published doesn't work. People forget, misunderstand what's relevant, or leave the organization. Automate capture where possible.

Failing to preserve departing employee accounts: When an employee leaves, their personal accounts may contain work-related content. Address this in your hold process before access is lost.

Quick Reference Table

Scenario Preservation Trigger Reasonable Steps Risk If Missed
Demand letter received Immediately Issue hold; capture identified accounts; disable auto-deletion Sanctions under FRCP 37(e); adverse inference
Workplace incident with litigation potential When reasonably foreseeable Preserve employee and organizational accounts related to incident Loss of key evidence; inability to defend claims
Regulatory investigation notice Upon receipt of notice Hold all accounts that may contain relevant communications Regulatory penalties; spoliation findings
Employee files internal complaint When complaint suggests potential litigation Preserve complainant, respondent, and witness accounts Weakened defense; credibility damage
Product defect discovered When defect may lead to claims Capture customer service accounts; preserve internal team discussions Inability to establish timeline; punitive damages exposure

Your preservation duty begins when litigation becomes reasonably foreseeable, not when a complaint is filed. Err toward early preservation when the risk is unclear. The cost of over-preserving is lower than the cost of sanctions for under-preserving.

a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.

You Might Also Like