Platform Data Productions

The two constraints that decide what comes back

This is written for counsel deciding what to subpoena, and when, in an internet defamation matter. Two independent constraints govern what legal process to a US platform returns, and conflating them causes most of the wasted motion here.

The statutory constraint. The Stored Communications Act, 18 U.S.C. §§ 2701–2712, separates content from non-content records, and governmental requesters from everyone else. A civil litigant is not a governmental entity, and several routes in the statute are not available to one.

The physical constraint. A provider cannot produce what it no longer holds. Retention, not law, is the binding constraint in a large share of matters, and the windows are short.

The second is the one worth planning around, because it is knowable in advance — where the operator publishes it. So the first question is not what process to use but which records still exist to be reached. That question has a published answer for two of the five operators most often at issue, and none at all for the other three.

Three major operators publish nothing, and that is the finding

The retention question gets asked constantly and answered confidently, and for three of the five operators that matter most here the confident answer has no operator behind it. Reading each operator's own pages on 15 August 2026: Meta and X publish a 90-day preservation window. Google, Reddit and Yelp publish no preservation or log-retention window at all.

Say that plainly. Any number an attorney has been quoted for Google, Reddit or Yelp came from somewhere other than the operator. The circulated figure of 100 days for Reddit IP-address retention traces to older versions of Reddit's privacy policy and could not be confirmed against any current Reddit page; it is not used here. The same applies to remembered numbers for Google preservation, and to any figure for X IP logs.

The consequence is sequencing rather than despair. Where the window is unpublished, the working assumption has to be that it is shorter than anyone expects and that the request goes out first rather than after the pleadings settle. An estimate written into a report is the thing that gets an expert impeached. An accurately stated absence is not.

What each operator publishes, read on one day

The table records what each operator's own pages said on the date they were read. Operator policy changes without notice, so the date is part of the fact.

Meta's guidelines carry two sentences, the second operative:

"We will take steps to preserve account records in connection with official criminal investigations for 90 days pending our receipt of formal legal process."

"We do not retain data for law enforcement purposes unless we receive a valid preservation request before a user has deleted that content from our service."

— Meta Law Enforcement Guidelines, read 15 August 2026

Read the second against the ordinary shape of a defamation matter, where the post is often down before anyone is retained. X's guidelines for law enforcement publish a matching 90 days and a non-answer on logs:

"We will preserve, but not disclose, a temporary snapshot of the relevant account records for 90 days pending service of valid legal process."

"Some information (e.g., IP logs) may only be stored for a very brief period of time."

— X guidelines for law enforcement, read 15 August 2026

Google's Transparency Report FAQ confirms preservation requests are accepted and publishes no window; Reddit's legal-requests overview and request portal state neither a window nor a retention figure.

Section 2703(f) runs to a governmental entity

The mechanism invoked most often by name is statutory, and it is specific about who may invoke it. 18 U.S.C. § 2703(f), headed "Requirement To Preserve Evidence," reads:

"A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process."

— 18 U.S.C. § 2703(f), read at the House US Code site, 15 August 2026

Records are preserved under that provision for 90 days, extendable by a further 90 on a renewed request — the source of the figure recurring across the operator pages. The words that matter to a civil practice are "upon the request of a governmental entity." A private litigant's preservation letter is not a § 2703(f) request and does not carry its statutory force. Platforms commonly honor civil preservation requests as policy rather than statute, and this research could not confirm from any of the five a published commitment to do so on law-enforcement terms. What preservation duty binds a civil opponent is a question for counsel.

Three mechanical points decide whether a request produces anything. Calendar the expiry — where a window is extendable on renewed request, the renewal is the requester's job. Identify the account the way the platform does: a URL to the profile, the account identifier where visible, the exact username with capitalization preserved, the post permalinks, and the date range. "The negative reviewer" is unactionable. And send it through the operator's own channel; Meta, Google and Reddit operate request portals, and Yelp designates a registered agent.

And expect the account holder to be notified: Reddit, X and Meta each publish a policy of notice prior to disclosure unless prohibited. What that implies for sequencing is for counsel.

What each tier of process reaches

The statute sets out tiers and the operators describe their compliance in matching terms. As the statute is written, and as Meta describes its own practice, read 15 August 2026:

• Subpoena reaches the basic subscriber records of § 2703(c)(2): name; address; session times and durations; length and types of service; the subscriber or instrument number, including temporarily assigned network addresses — IP addresses; and means and source of payment. Meta describes its own subpoena tier as name, length of service, credit card information, email addresses and a recent login or logout IP address — recent, singular, not a history.
• A § 2703(d) court order reaches transactional records beyond that tier — Meta describes these as message headers and IP addresses.
• A search warrant reaches content — messages, photos, videos, timeline posts and location information — and Meta adds that for end-to-end encrypted conversations it will still provide message and call logs and IP data. Content is unavailable; the pattern of contact is not.

The civil-litigant problem follows directly, and it is the most common surprise in this work: a civil subpoena to a US platform generally does not produce private message content. Providers routinely move to quash on Stored Communications Act grounds, and the doctrine is unsettled — the California Supreme Court in Facebook, Inc. v. Superior Court, No. S245203, decided 13 August 2020, declined to resolve the question, assuming without deciding that Facebook provided the relevant services. The practical answer has been stable while the doctrine has not: plan on non-content records and public content.

What a production contains when it arrives

Set the legal characterization aside and look at the artifacts. A production typically contains five categories of unequal value.

• The registration record. Account creation timestamp — usually UTC, sometimes Unix epoch — registration IP, email addresses, phone numbers, the name as entered, and the user-agent string. This is the highest-value single record in a sock-puppet matter: registration IP and timestamp are what tie separate accounts together.
• Login and session history. IP address, timestamp, user agent, sometimes cookie or device identifiers. Its length depends on retention, which is exactly where three operators publish nothing.
• Content records. Post text, timestamps, edit history where the platform keeps it, and identifiers for attached media.
• Deletion and moderation records. Whether the platform recorded a removal, and on what basis — frequently the only proof that content once existed.
• Payment records. Where an account bought advertising, promotion or a subscription, the payment instrument is often the strongest identity link in the file, and the one most often left out of a request.

None of this is visible from outside. IP addresses, device fingerprints, cookie and advertising identifiers, registration emails and the platform's own linkage assessments exist, are not public, and are reachable only by process. An analyst who claims to have traced an anonymous poster from public signals alone should be asked which record was relied on.

What productions routinely do not contain

Three absences recur often enough to plan around. A clean audit trail of edits: most consumer platforms do not keep version-by-version histories of user posts for production, and whether edit history is retained varies by platform — this research could not establish that and does not assert it. Anything about who read the content: platforms hold view and impression aggregates for their own purposes, and there is no general practice of producing per-viewer logs. Content the user deleted before the preservation request: Meta says this in terms, and no other operator contradicts it.

There is also a limit in the other direction. Reddit's Public Content Policy says of deletion:

"We cannot guarantee that third parties have deleted copies of Reddit public content they've made without your or our permission."

— Reddit, Public Content Policy, captured 12 August 2026

Reddit licenses public content in bulk and names large language model makers among its licensees. It also distinguishes deleting an account, which disassociates the user from the content, from deleting the content itself. So public Reddit content may persist in third-party corpora after removal at the source, and a deleted account is not an evidentiary dead end.

The assumptions this method carries

This method is reproducible, with assumptions that have to be written down rather than absorbed. Another examiner working from the same production reaches the same conclusions, provided four things are stated.

1. The scope of the production. What was asked for, what tier of process was used, what came back and what the platform declined. A finding about the absence of a record means nothing without the request that would have captured it.
2. The operator's retention position on the date of the request. For Meta and X, a published 90 days. For Google, Reddit and Yelp, nothing published — so the age of a missing record cannot be converted into an inference about whether it existed.
3. Timestamp handling. Whether the platform delivered UTC or local time, whether values are Unix epoch, and what conversion was applied. Mis-conversion is a routine source of wrong timelines.
4. What the record identifies. An IP address identifies a connection, not a person at a keyboard. A registration email identifies an account, not an author.

State those four and the analysis holds up in someone else's hands. Leave them implicit and the same data supports a conclusion that cannot be defended.

Frequently Asked Questions

Published 2026-08-15