Social Media

What the record consists of, and how little of it is the public page

Organic social media — posts a party publishes rather than pays to place — produces a narrower record than most attorneys expect, and almost none of it is the page a browser renders. At minimum there is the post itself, with its content, timestamp, author account and privacy setting; the engagement record of reactions, comments, shares and saves; the reach and impressions figures the platform calculates and holds; the account's own activity log; and, where the platform keeps one, an edit history and some trace of deletion.

Those items live in three different places. The post and its engagement are visible to anyone with access, which is why counsel's first instinct is a screenshot. The insights sit behind the account's analytics surface and expire. The rest — login records, IP addresses, the platform's own view of what it distributed — sits with the platform and appears in no self-service export. The practical consequence is that a social media case is usually decided in its first weeks, by whether someone with credentials generated a complete export while the account still looked the way it did when the dispute arose. A social media expert witness retained in month eight is generally working from what somebody happened to keep.

Authentication comes first, and two rules from 2017 decide how it is done

Before anyone argues about what a post meant, the proponent has to satisfy Rule 901 — evidence sufficient to support a finding that the item is what the proponent claims it is. Two additions to Rule 902, both effective 1 December 2017, allow that to be done on a written certification instead of through live foundation testimony.

FRE 902(13) covers “[a] record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).” FRE 902(14) covers “[d]ata copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification,” on the same kind of certification. The Advisory Committee explains that a process of digital identification ordinarily means a hash value — “a number that is often represented as a sequence of characters and is produced by an algorithm based upon the digital contents” — and that the rule permits “self-authentication by a certification of a qualified person that she checked the hash value of the proffered item and that it was identical to the original.”

The division between the two is practical. A platform's own export is a record a system generated: 902(13). A forensic copy or a preserved capture is a copy that has to match its original: 902(14). Many productions need both. Both also carry the notice requirement of 902(11) — reasonable written notice of the intent to offer the record, with the record and certification made available for inspection. That requirement is not optional, and it is where proponents most often come unstuck. The rule text is published by the Legal Information Institute.

What a certification does not do, and what the case law actually asks for

The Advisory Committee set the ceiling explicitly. A certification under these rules “can establish only that the proffered item has satisfied the admissibility requirements for authenticity,” and “the opponent remains free to object to admissibility of the proffered item on other grounds—including hearsay, relevance, or in criminal cases the right to confrontation.” Certifying that a system produced a record is not certifying that the record is accurate. An expert who blurs that line supplies the cross-examination.

The recurring fight in this channel is attribution: the page exists, but who made it. In United States v. Vayner, 769 F.3d 125 (2d Cir. 2014), the Second Circuit vacated a conviction where the government offered a printout of a social networking profile and nothing beyond the page's own contents connecting it to the defendant. That decision is often described as making social media evidence hard to admit. It did not; the same opinion observes that “the bar for authentication of evidence is not particularly high.” Maryland had taken a stricter line in Griffin v. State, 419 Md. 343 (2011), rejecting a profile printout authenticated by its contents alone and naming three alternatives — ask the purported creator, examine the creator's computer, or obtain the information from the site itself. Texas was more permissive in Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012). Maryland then converged on the ordinary standard in Sublet v. State (Md. 2015): “the trial judge must determine that there is proof from which a reasonable juror could find that the evidence is what the proponent claims it to be.” The split is about how much circumstantial evidence is needed, not about whether this material is admissible at all.

Getting the record: the account holder's export, and the limits of a subpoena

Meta's “Download Your Information” is the workhorse of social media discovery. It is a self-service export the account holder generates from inside the account, in HTML or JSON, with selectable date ranges and content categories — which means that where the account holder is a party or a cooperating witness it can be obtained without any process at all, by request or by a Rule 34 request for the export itself. X, LinkedIn and TikTok each offer an equivalent download. Their contents, formats and turnaround differ and have changed; each should be confirmed against that platform's current documentation for the period in dispute rather than taken from a secondary description.

Subpoenaing the platform for the same material is a different exercise. The Stored Communications Act bars a provider of electronic communication service to the public from knowingly divulging the contents of a communication in electronic storage, and its exceptions do not include a civil subpoena. Non-content records — subscriber information, login and IP records — are treated separately and are more readily obtained. That content versus non-content line is the single most important distinction in drafting a subpoena here. The workable expectation is that content comes from the account holder and the platform is asked only for what sits around it.

Deletion, edits, and why the date of the export is a material fact

An export is a snapshot of the account as it existed at export time, and deleted posts generally do not appear in one. That sentence carries more practical weight than anything else on this page. It is why a preservation demand issued in week two is worth more than a broad subpoena issued in month eight, and it is why the export date belongs in the report, in the exhibit caption, and in the first paragraph of any opinion resting on what the export contains.

Edit history is platform-specific, mostly not public, and has changed repeatedly. Some platforms have displayed an edit history on edited posts; at least one retains prior versions only for a limited window and only on a paid feature; others have not offered post editing with public version history in the same way. Any statement about what a given platform preserved on a given date has to be checked against that platform's documentation for that date rather than against how it behaves now. What follows is a limit rather than a technique. An examiner can testify that a post existed in a given state at a given capture time, and to what an export shows. Testifying from the export alone that nothing was edited and nothing was deleted is not available, because absence from a snapshot is not absence from history.

Insights are the most perishable evidence in the matter, and they are estimates

Reach, impressions, profile visits and follower demographics are reported through the platform's analytics surface on retention windows shorter than the timeline of most disputes. If they are not exported early they may be unrecoverable, and unlike a post there is no public copy to fall back on.

They are also not counts. Reach is a deduplicated estimate of unique accounts rather than of people, and the methodologies behind it have been restated. Meta published corrections to its own metrics in November 2016 disclosing, among other errors, that seven-day and 28-day organic Page reach had been “miscalculated as a simple sum,” with seven-day reach approximately 33% lower and 28-day reach approximately 55% lower once fixed — an error the company said had been live since May of that year. A second disclosure the following month covered estimated reach methodology and a misallocation of streaming reactions. None of that indicates that any particular figure in any particular matter is wrong. It supports a narrower and more useful proposition: an insights number is the platform's own account of its own product, and a report should characterize it that way rather than as an independent measurement.

What is public, what is not, and the asymmetry inside the ad libraries

Counsel often assumes a public archive exists. For paid placements one does, and its scope is asymmetric in a way that decides cases. Meta's Ad Library API exposes an ad_type parameter whose documented values are ALL, POLITICAL_AND_ISSUE_ADS, FINANCIAL_PRODUCTS_AND_SERVICES_ADS, EMPLOYMENT_ADS and HOUSING_ADS. Several of the fields a litigator most wants — bylines, delivery_by_region and the estimated audience size range — are documented as available only for political and issue ads. The spend and reach data people assume is public is, for ordinary commercial advertising, not public.

Retention follows the same asymmetry. Meta's own announcement describes the library as carrying all active ads any Page is running, with ads about social issues, elections and politics also archived for seven years. Note the word active: for a commercial advertiser the library is a live window rather than an archive, and an ad that stopped running last month may leave no public trace while the advertiser's own export still holds it. Meta's page also states that on 24 May 2025 the first ads archived for seven years began to exit the library, so even the political archive is a rolling window that is now pruning. For organic posts there is no comparable public archive at all.

What a social media analysis does not settle

It does not establish who saw a post. Reach is an estimate of accounts, impressions are not people, and privacy settings, feed ranking and blocking all sit between a published post and any particular reader. An insights export offered to show that a named individual saw something will not carry that weight.

It does not establish who was at the keyboard. An account is not a person, and connecting the two is done with circumstantial evidence — access and login records, corroborating messages, content only the purported author would know — which is precisely what the authentication cases are about.

It does not establish that a record is complete or accurate. A 902(13) or 902(14) certification goes to authenticity; hearsay, relevance and accuracy objections all survive it. And it does not establish causation between what was posted and what happened to a business afterward. These records are strong evidence of what was published, by which account, at what time, and how the platform reported distributing it. They are weak evidence of receipt, of perception, and of cause. Being clear about that boundary at the outset of an engagement is easier than being clear about it in a deposition.

Frequently Asked Questions

Published 2026-08-12