Social Media Posts and Their Custody
Material on a social platform is under the continuous control of the person who posted it, and of the platform. Capturing it in a form that survives its removal, and establishing who actually wrote it, are different exercises requiring different evidence.
The rule in short
Social media evidence presents two distinct problems. The first is capture: a post can be edited or removed at any time, so a record has to be made that will outlive it. The second is attribution: an account is not a person, and connecting a post to an individual requires evidence beyond the display name on the profile.
Online material is the only category of evidence whose subject can destroy it from a phone in a few seconds. That single fact shapes everything about how it should be handled, and it is compounded by a second problem: knowing that an account posted something is not knowing that a person did.
Capturing a post so that it survives
Capture the address as well as the content. The full address identifying the specific post, rather than the profile, because a screenshot of text with no address cannot be located again by anybody.
Capture the surrounding context. The thread, the replies and the preceding material, because a post extracted alone is exposed to exactly the objection discussed in why screenshots prove little.
Record when the capture was made. By whom, using what method, in a signed statement, which converts an anonymous image into somebody's evidence about what they saw.
Prefer a full page capture. Including the address bar and the timestamp, and preferably in a form that preserves the underlying page rather than only an image of it.
Use an archiving service as well. A third-party archive that records a page independently produces a copy nobody involved in the dispute controls, which is far harder to challenge.
Do it immediately. Because the material can be removed at any moment, and a post that has been deleted before anybody captured it is frequently unrecoverable.
Attribution, which is the harder problem
An account is not a person. Accounts are shared between family members, borrowed, compromised and created in other people's names, and a display name is simply a field that whoever set it up typed in.
The platform holds the answer. Registration details, connection addresses and device history establish who operated an account, and they come from the provider rather than from the page.
Circumstantial attribution is common. Content only that person could know, references to their own circumstances, and a pattern of use consistent with their movements together build a case that is difficult to answer.
Denial is easy and cheap. Anybody can say an account is not theirs or that somebody else had access, which is why the attribution evidence has to be assembled rather than assumed.
Device evidence closes the gap. A device that was signed into the account, holding drafts or images that appear in the posts, ties the two together decisively.
| Question | Answered by a capture | Answered by platform data |
|---|---|---|
| What did the post say | Yes | Yes |
| When was it published | Partly | Yes |
| Who operated the account | No | Usually |
| Was it edited | No | Sometimes |
| Does it still exist | No | Yes |
Deleted and private material
Deletion is not always final. Platforms retain removed material for a period before purging it, and the account holder's own export frequently includes items that are no longer visible to anybody else at all.
Web archives may hold copies. Independent archiving services capture public pages periodically, and a copy in such an archive is both independent and dated.
Other users may have captured it. Screenshots taken by people who saw the material at the time, or replies that quoted it back, frequently survive the deletion of the original post entirely.
Making an account private is not deletion. The material still exists and is still within the account holder's export, which is a point people frequently misunderstand.
Deletion after a dispute is spoliation. Removing material once a duty to preserve has arisen carries the consequences described in spoliation and missing evidence.
Raising a post in correspondence before it has been captured is the surest way to have it deleted. Capture, archive and record the capture first, and only then use the material in any communication with the other side.
What a post actually proves
That the content was published. Which is frequently the whole point, particularly in disputes about statements made publicly, where the publication itself rather than the truth of the statement is what matters.
Not that its contents are true. A post asserting something is a statement by its author, subject to the ordinary rules discussed in the hearsay problem.
Something about the author's state of mind. Which is a non-hearsay use and is frequently the most valuable thing a post contributes to a case.
A date, from the platform. The publication time recorded by the service is reliable in a way a screenshot's appearance is not, because it was generated by the platform rather than set by any user.
Context that images lose. Whether a post was a reply, a share, or a quotation of somebody else changes its meaning entirely and is invisible in a cropped capture.
Practical handling
Capture first, analyze later. Because the material can vanish while somebody is still deciding whether it matters, and the analysis can be done from a good capture at leisure afterward.
Request the account export. From the account holder where possible, because it is complete, dated and generated by the platform rather than assembled by a party.
Send a preservation request. To the platform, identifying the account and the period, which stops the ordinary deletion cycle while process is arranged.
Assemble attribution separately. As its own exercise with its own evidence, rather than assuming that the display name settles it.
Expect the account to change. Profiles are edited, display names are changed and posts are removed continuously, so a capture made today describes the account as it stood today rather than as it will stand next month.
The defining feature of this material is that its subject can destroy it instantly and without warning. Everything about handling it follows from that, and the first rule is to capture before doing anything else, including mentioning it.
Capture means more than a screenshot. The address, the surrounding thread, the time of capture and the identity of whoever made it all have to be recorded, and an independent archive copy is worth obtaining wherever the page is public.
Attribution is the problem that decides most contested social media evidence, and it is a separate exercise. Platform registration and connection data answer it; a display name does not, and a denial costs the other side nothing.
Deleted material is more recoverable than people assume. Account exports frequently contain removed items, archives hold public pages, and other users' captures survive independently of whatever the author has done to the original.
Finally, a post proves that something was published rather than that it was true. Where the publication itself is the issue that is enough; where the underlying facts matter, the post is a statement by its author and is treated as one.
Points to carry away
- A post can be edited or deleted by its author at any moment.
- Capture has to preserve the address, the time and the context.
- An account is not a person, and attribution is separate.
- Platform data answers attribution questions that images cannot.
- Archived copies and third-party captures corroborate.
Questions readers ask
How should a post be captured properly?
By recording more than the visible text. A proper capture includes the full address of the specific post, the surrounding thread and replies, the date and time of capture, and the identity of the person who made it, set out in a signed statement. A capture that preserves the underlying page rather than only an image of it is stronger again, and an independent archiving service producing a dated copy adds corroboration that nobody in the dispute controls.
How is an account connected to a person?
Rarely from the page itself, and usually from a combination of platform data and circumstance. Registration details, the addresses and devices used to access the account, and the payment methods associated with it come from the provider and are the strongest evidence. Around that sits circumstantial material: content only that person could know, references to their circumstances, timing consistent with their movements, and devices found to have been signed in. Denials are cheap, so the attribution case has to be built deliberately.
Can deleted posts be recovered?
Frequently. The account holder's own data export often contains items no longer publicly visible, because platforms retain removed material for a period. Independent web archives capture public pages periodically and hold dated copies outside anybody's control. Other users who saw the material may have captured or quoted it. Where none of those produces anything and the deletion occurred after a duty to preserve arose, the removal itself becomes the issue rather than the content.
Sources
- Federal Rules of Evidence — Rule 901, Authenticating or Identifying Evidencelaw.cornell.edu
- Federal Rules of Evidence — Rule 801, Definitions That Apply to Hearsaylaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 37, Failure to Make Disclosureslaw.cornell.edu
- 18 U.S. Code § 2702 — Voluntary Disclosure of Customer Communicationslaw.cornell.edu
- 18 U.S. Code § 2703 — Required Disclosure of Customer Communicationslaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 34, Producing Documents and Electronically Stored Informationlaw.cornell.edu
True Justice Record is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Evidence That Lives on a Phone
When a Device Is Lost or Wiped
Where a device is gone, provider-held account data is unaffected, backups may capture an earlier state, and the other participants in any conversation hold their own copies. The circumstances of the loss then matter separately: an ordinary loss is neutral, while a wipe performed after a duty to preserve arose is treated as spoliation.
Voice Notes and Recordings
A recording is authenticated by evidence of how it was made and by whom, identification of the voices on it, and confirmation that it is complete and unaltered. Transcripts are aids rather than evidence. Editing is easy and increasingly hard to detect, so provenance carries more weight than any examination of the audio itself.
Location History Offered as Evidence
Location evidence comes from satellite positioning, from network cell sites, from wireless network observations and from application check-ins, each with a different accuracy. All of it places a device rather than a person. Interpreting it responsibly means establishing which method produced each point and what margin that method carries.