FAQ

A: The SCA is a federal privacy law from the 1980s that protects messages and other data stored online by companies like social media platforms. It works a bit like a Fourth Amendment protection for digital communications: it generally stops providers—including most social media platforms—from handing over what’s on their servers, except in a few specific situations. Congress wrote the law when the internet was brand new, and it hasn’t changed much since.

A: This distinction matters more than anything else here, so it’s worth understanding well. The SCA defines “content” as basically any information about the substance or meaning of a communication (18 U.S.C. § 2510(8)). In plain terms, content is the actual message—the body of an email, an attached file, the text of an instant message, or a photo sent in a DM.

“Non-content” is everything else tied to the account or message that isn’t the substance itself—things like the account holder’s name, the IP address used to log in, the to/from lines on an email, and timestamps. It’s sometimes called “basic subscriber information” or metadata.

A: Two sections do most of the work. Section 2702 controls what providers are allowed to disclose, and it’s the one most non-government lawyers run into. Section 2703 controls the process the government has to follow to force disclosure. For example, if law enforcement wants to see someone’s private Instagram messages, it typically needs a search warrant. See 18 U.S.C. § 2703(a)-(b).

A: For law enforcement, yes—most major platforms publish guides on how government agencies can request content consistent with the SCA and the company’s own policies. See, e.g., X; Meta; Snap. But the companies stay mostly quiet on whether or how they’ll work with private attorneys, and on what information might be available to them outside a government investigation.

A: Generally, no. The SCA bars providers from disclosing the content of a user’s communications—what the message actually said—unless law enforcement is involved, the user consents, or one of the exceptions in 18 U.S.C. § 2702(b) applies.

A: Non-content isn’t covered by the SCA’s ban on disclosing content, so the platform isn’t shielded from turning it over. Section 2702(c)(6) lets a provider disclose non-content records to anyone other than a governmental entity. See 18 U.S.C. § 2702(c)(6).

That means a private party can subpoena a platform for non-content information, and the platform is allowed to comply. It probably won’t be a smoking gun, but it can show you who sent a message, when they sent it, and from what IP address—which can still be very useful to your client.

One thing to keep in mind: § 2702(c)(6) permits disclosure—it doesn’t require it. Platforms routinely object even to well-drafted non-content subpoenas, so you may still end up filing a motion to compel.

A: Often, yes. Many platforms will notify the user about the subpoena, or ask for their consent, before releasing anything. That can slow things down—and in some cases, stop the platform from producing records at all.

A: Send a preservation letter right away. Platforms don’t keep data forever, and a fight over a subpoena can easily outlast the data itself. A litigation-hold letter to the platform’s registered agent puts the company on notice that the records may be needed as evidence in a pending case.

Then think about how you’ll serve the subpoena. Most major platforms are California companies, and an out-of-state subpoena has no legal force against them until it’s domesticated through a California court under California’s Interstate and International Depositions and Discovery Act. See Cal. Civ. Proc. Code § 2029.300.

A: There are a few other ways to get information from social media platforms:

• Ask the account owner directly: often the fastest route, and the one people overlook most. If your client is the account holder—or you can reach the person who is—the platform’s own export tool can produce a full archive in days, not months, with no subpoena required.
• Get the user’s consent: if the user agrees, the SCA no longer requires the platform to withhold the content.
• Check for an exception under 18 U.S.C. § 2702(b): for example, if your client sent the message or was the intended recipient, they can usually get the content directly.
• Work with law enforcement: in a criminal case, law enforcement may be able to obtain content with a warrant, subpoena, or court order under the SCA.
• Check if the account or post is public: the SCA generally doesn’t protect anything a user has posted publicly.

A: Possibly. The California Supreme Court is currently reviewing Snap, Inc. v. Superior Court, a case asking whether platforms that read, analyze, and monetize their users’ communications fall outside the SCA altogether. The appellate decision held that they do. If the California Supreme Court agrees, the analysis above could look considerably different.

Interested in learning more? Click this link for an in-depth discussion in our recent blog post by attorney Zachary Adorno.