You're staring at a 20-page email string. Seven authors, seven recipients, five dates, two weeks of back-and-forth. Do you log it as one entry or break it into its parts?
Courts haven't settled this. The answer affects your review budget, your exposure to a motion to compel, and what you reveal about the substance of legal advice.
The Question at Hand
Rule 26(b)(5) of the Federal Rules of Civil Procedure requires a party withholding information as privileged to describe the withheld material in a way that lets other parties assess the claim without revealing the privileged content. The rule says nothing specific about email strings. That silence has produced a split.
One camp says log only the top email, since it contains the whole thread. The other says each withheld email within the string gets its own entry. The disagreement is practical, and it has consequences for how your team structures privilege review and logging workflows.
The Case for Logging Only the Top Email
The efficiency argument is straightforward. A long thread may contain dozens of messages. Logging each one multiplies reviewer hours, quality control cycles, and the length of a log that opposing counsel will then dissect. For a team handling several matters at once, the difference between one entry and thirty is real money.
There is also a substantive argument. Privilege protects what a client communicated to counsel. A detailed entry for each message can edge toward disclosing the very thing the privilege exists to protect: who raised which concern, when, and in response to what. As the Supreme Court put it in Upjohn Co. v. United States, a fact is one thing and a communication about that fact is another. Itemized entries risk revealing the shape of the conversation even if the content stays redacted.
Muro v. Target Corp., 250 F.R.D. 350 (N.D. Ill. 2007), declined to require separate logging of each email in a string. Practitioners who favor the top-email approach point to that line of authority and to the proportionality principle embedded in the federal rules.
The Case for Logging Each Email
The counterargument rests on the purpose of the log itself: "trust, but verify." A log that lumps a long thread under one description asks the court and the opposing party to take the privilege claim on faith.
Wallace v. Rocking Horse Children's Health Ctr. shows how that fails. The defendant logged nearly twenty pages of email under a single entry. The entry listed seven authors, seven recipients, many of them non-attorneys, and five dates across fourteen days. The court found it unclear that one privilege rationale could cover all of it, and said the clustering made it "near impossible to decipher how and to what extent the asserted privileges apply."
Wallace adopted what it called the majority view: individual emails within a string should be separately logged in some fashion. The court's reasoning was that logging only the top email does not show how many separate communications the document contains or who received which one. That deprives the other side, and the court, of the ability to test the claim.
United States v. Davita, Inc., 301 F.R.D. 676 (N.D. Ga. 2014), reached a similar result, requiring that each withheld email within a string be logged at least once. Note the limit in Wallace: a repeated email does not need to be logged repeatedly. The requirement is one entry per withheld message, not one per appearance.
Where Practitioners Actually Land
Most experienced teams have concluded that the top-email-only approach is the riskier default, especially where a thread includes non-attorneys or spans a long period. A thread that looks cohesive to the reviewer can look like a business discussion with a lawyer copied to the person challenging the log. When that happens, the cost of the challenge, a second review, and a revised log usually exceeds what the original itemization would have cost.
But few teams want to itemize everything either. In practice they sort by risk:
- Short, attorney-heavy threads are often logged by message without much debate.
- Long threads with mixed participants get message-level treatment because they invite scrutiny.
- Attachments are handled separately. Under the "part and parcel" principle, an attachment to a privileged communication may be withheld even without an independent privilege basis, which changes what the log must say about it.
The unresolved part is how to cut cost on high-volume matters without inviting a Wallace-style order. That is where cooperation and procedure matter more than doctrine.
Our Take
The most promising development is the certification log. Under that approach, the log identifies the top email, and counsel certifies that every non-privileged attachment has been or will be separately produced. The certification can also state how many attachments are being withheld as independently privileged, that counsel reviewed them with a good faith basis for withholding, and that they were reviewed for waiver by disclosure. It can be paired with a categorical log that gives some additional detail about the withheld material.
This does not eliminate the Wallace concern. It answers it differently. Wallace worried that a top-email entry hides non-privileged material and prevents verification. A certification addresses the first problem directly, because non-privileged attachments get produced. It addresses the second by putting counsel's representation on the record, with categorical detail as a backstop.
The tradeoffs are real. A certification log asks the receiving party to accept a representation in place of an itemized entry. Some courts and some opponents will resist. And the approach is cleaner for attachments than for the email messages in the body of a thread, where Wallace's reasoning has more force. Do not assume a certification will survive a court that has adopted the majority view without first securing agreement.
That is why we'd put the procedural tools first. Fed.R.Civ.P. 26(f) requires a discovery plan, and Rule 29 permits stipulations about discovery procedure. The Sedona Conference's May 2024 commentary on privilege logs, 25 Sedona Conf. J. 221, encourages cooperation to keep these disputes from arising. Raise log format at the Rule 26(f) conference, propose a certification or categorical approach, and get the stipulation in writing.
If you can't get agreement, log message by message for threads with mixed participants and long date ranges, and reserve streamlined methods for cases where the risk of challenge is low. Efficiency matters, but a log a court rejects is the most expensive log you can produce.
