How to Get (Some) Third-Party Discovery from Social Media Companies

It happens all the time: a client says that certain posts or messages on a social media platform contain the smoking gun to their case. If only they hadn’t deactivated their TikTok account or if they had taken a screenshot of the fleeting Instagram message, we wouldn’t be in this situation. Or maybe they’re certain that the person hiding behind that X account’s pseudonym is really the responsible party. But how do they—or even can they—get the social media platforms to provide the critical evidence?

Overcoming the Stored Communications Act

This is a tricky question because of the Stored Communications Act (“SCA”), a forty-year-old law intended to protect the privacy of stored digital communications held by third-party providers. The SCA creates a Fourth Amendment-like privacy protection for digital communications stored on the internet. It prohibits certain providers—including most social media platforms—from disclosing the contents of the information stored on their systems, except under limited circumstances.

Two provisions do most of the work. Section 2702 restricts what providers may disclose, and it is the one most non-government attorneys run into. Section 2703 governs the process the government must use to compel disclosure. For example, if the government (i.e., law enforcement) wants to see your private Instagram dance, they likely need a search warrant to compel its disclosure. (Other types of forced disclosure range from requiring a subpoena to a court order.) See 18 U.S.C. § 2703(a)-(b). And the major social media companies have all developed guides for how law enforcement and government agencies can seek the content that is otherwise shielded by the SCA. See, e.g., X; Meta; Snap. But they are silent on how—or if—they work with non-government attorneys.

Understanding Content vs. Non-Content and Why This Distinction Is Important

To understand exactly what a non-government attorney can obtain, we first need to define the difference between “content” and “non-content” under the SCA. The SCA defines content as “any information concerning the substance, purport, or meaning of that communication.” 18 U.S.C. § 2510(8). In simpler terms, content is generally considered to be the substantive information of the message—for example, the body of an email, the attached files, the text of the instant message, or the picture being DM’d.

Non-content, on the other hand, is the information pertaining to the message and account that does not include the substance of the communications—for example, the subscriber information (potentially the name or account number), IP address used to log in, the to and from lines of an email, and the time and date stamps. It is sometimes referred to as basic subscriber information or metadata.

The SCA generally prohibits providers from disclosing the content of their users’ communications—what the message was conveying—absent law enforcement involvement, user consent, or one of the exceptions listed in 18 U.S.C. § 2702(b).

But what about the non-content information? Non-content falls outside the SCA’s prohibition on disclosing content, so the platform is not shielded as to that material. Section 2702(c)(6) permits a provider to disclose non-content records to any person other than a governmental entity.

Social Media Platforms Can Disclose Non-Content Information

A non-government party can subpoena records from a social media platform seeking that non-content information. And the social media company can produce it. See 18 U.S.C. § 2702(c)(6). While it might not be the smoking gun itself, it can tell you what user sent a message or logged on to the platform, when they did it, and from what IP address. This information could be invaluable to your client.

One caveat worth building into your expectations: § 2702(c)(6) permits disclosure—it does not compel it. Platforms routinely object even to well-drafted non-content subpoenas, so plan on the possibility of a motion to compel.

One thing to be aware of is that many social media platforms will alert users of the subpoena or see if the user will consent before releasing the information. This can delay the subpoena results and potentially stop the social media platform from complying at all.

*          *          *

Other ways to get information from social media platforms:

• Seek the documents from the account owner: You can try to get the content of the messages directly from the owner of the account, circumventing the social media platform completely.
• Get the consent of the user: With consent, the social media companies are not bound by the SCA to withhold the message’s content.
• Work with law enforcement: In a criminal case, you can work with law enforcement to get the content information. Under the SCA, law enforcement can obtain a significant amount of content information if they have the proper authority (e., a search warrant, subpoena, or court order).
• See if an exception applies under 18 U.S.C. § 2702(b): For example, if your client was the intended recipient or the person sending the message, they can likely get the content of the message.
• Check if the account or post is public: The SCA typically does not apply to a communication that is publicly posted.

Looking for more direct answers? Check out our Q&A on this same topic.