Scope: operational guidelines for law enforcement seeking Instagram account records; may change at any time
This page is a set of operational guidelines addressed to law enforcement officials who seek Instagram account records. It is guidance about how Instagram handles such requests, not a contract with users. Instagram states that the information may change at any time, and the page states no version date.
Supporting quotations
Information for law enforcement
These operational guidelines are for law enforcement officials seeking Instagram account records. This information may change at any time.
Qualifications & exceptions
Audience: law enforcement officials, not ordinary users.
Not stated here
No effective or last-updated date appears in the saved text.
Sharing & Disclosure · Company commitment
Account records are disclosed only under the terms of service and applicable law, including the SCA
Instagram says it discloses account records solely in accordance with its terms of service and applicable law, and names the federal Stored Communications Act (SCA), 18 U.S.C. Sections 2701-2712, as the applicable law under which the three tiers of U.S. legal process described below operate. Separately, Instagram's stated policy is to notify users of requests for their information before disclosure unless prohibited by law or in exceptional circumstances; that notification practice and its exceptions are explained in their own card.
Supporting quotations
Requests for user information
We disclose account records solely in accordance with our terms of service and applicable law, including the federal Stored Communications Act (“SCA”), 18 U.S.C. Sections 2701-2712. Under the SCA:
Our policy is to notify people who use our service of requests for their information prior to disclosure unless we are prohibited by law from doing so or in exceptional circumstances
Qualifications & exceptions
The SCA is named by citation only; the statute's text is not part of this source and its meaning is not described here.
The terms of service are linked elsewhere on the page but not supplied.
Not stated here
Which terms-of-service provisions govern disclosure is not stated on this page.
Sharing & Disclosure · Procedure
A valid criminal subpoena is required to compel basic subscriber records
Under the SCA as described on this page, a valid subpoena issued in connection with an official criminal investigation is required to compel disclosure of basic subscriber records, which the page says are defined in 18 U.S.C. Section 2703(c)(2). The page lists what those records may include: name, length of service, credit card information, email address(es), and any recent login/logout IP address(es), if available. The list is illustrative ("may include") and conditioned on availability.
Supporting quotations
a valid subpoena issued in connection with an official criminal investigation is required to compel the disclosure of basic subscriber records (defined in 18 U.S.C. Section 2703(c)(2)), which may include: name, length of service, credit card information, email address(es), and any recent login/logout IP address(es), if available.
Qualifications & exceptions
"which may include" and "if available": the list is not a guarantee that each item exists for an account.
Section 2703(c)(2) is an external statutory citation; its definition is not reproduced on the page.
Not stated here
Whether a subpoena from a non-criminal (for example civil or administrative) matter is accepted is not stated.
Sharing & Disclosure · Procedure
A Section 2703(d) court order is required to compel non-content account records such as headers and IP addresses
A court order issued under 18 U.S.C. Section 2703(d) is required to compel disclosure of certain records or other information pertaining to the account, excluding contents of communications. The page says such records may include message headers and IP addresses, in addition to the basic subscriber records available under a subpoena.
Supporting quotations
a court order issued under 18 U.S.C. Section 2703(d) is required to compel the disclosure of certain records or other information pertaining to the account, not including contents of communications, which may include message headers and IP addresses, in addition to the basic subscriber records identified above.
Qualifications & exceptions
Section 2703(d) is an external statutory citation; the page does not reproduce the order standard.
Sharing & Disclosure · Procedure
A probable-cause search warrant is required to compel stored account contents
A search warrant, issued under the Federal Rules of Criminal Procedure or equivalent state warrant procedures on a showing of probable cause, is required to compel disclosure of the stored contents of any account. The page says contents may include messages, photos, comments, and location information. For requests from outside the United States, the International legal process card notes that a Mutual Legal Assistance Treaty request or letter rogatory may be required to compel contents.
Supporting quotations
a search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include messages, photos, comments, and location information.
A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.
Qualifications & exceptions
The Federal Rules of Criminal Procedure are named, not supplied.
Data Access & Collection · Company practice
Some stored information is collected automatically; Instagram does not verify email, phone or real names
In the context of records requests, Instagram notes that some information it stores is collected automatically while other information is provided by the user, and that it does not require email or phone verification and does not require people to use real names or identities on Instagram. The page presents this as a caution about the records: user-provided identity details are not verified by Instagram.
Supporting quotations
It is important to note that some information we store is collected automatically, while other information is provided by the user. We do not require email or phone verification, and we do not require people to use real names or identities on Instagram.
Not stated here
Which record types are automatic and which are user-provided is not itemised here.
Cross-references
qualifies (model-proposed): A valid criminal subpoena is required to compel basic subscriber records — qualifies: Basic subscriber records may include a name and email address, but Instagram says it does not verify email, phone or real names, so user-provided identity details in those records are unverified.
Legal Rights & Agreement Rules · Context
The Privacy Policy and Terms of Use are linked for additional information but not supplied
The page points law enforcement to Instagram's Privacy Policy and Terms of Use for additional information about Instagram. Those documents are linked, not reproduced, so their contents are not described in this analysis.
Supporting quotations
For additional information about Instagram, please read our
Not stated here
The linked Privacy Policy and Terms of Use are not supplied; nothing about their contents is assumed.
Retention & Deletion · Company practice
Retention periods vary; data is not kept for law enforcement unless a valid preservation request arrives
Instagram retains different types of information for different time periods and warns that, given the volume of real-time content, some information may only be stored for a short period. It does not retain data for law enforcement purposes unless it receives a legally valid preservation request. The Account preservation card explains that preservation in connection with an official criminal investigation lasts 90 days pending formal legal process.
Supporting quotations
Data retention and availability
We retain different types of information for different time periods. Given the volume of real-time content on Instagram, some information may only be stored for a short period of time. We do not retain data for law enforcement purposes unless we receive a legally valid preservation request.
We will take steps to preserve account records in connection with official criminal investigations for 90 days pending our receipt of formal legal process.
Not stated here
Specific retention periods per data type are not stated.
Legal Rights & Agreement Rules · Procedure
Requests must be particular and identify the issuing authority, agent, law-enforcement email and phone
All requests must be made with particularity, including the specific data categories requested and date limitations, together with the name of the issuing authority and agent, an email address from a law enforcement domain, and a direct contact phone number. The username requirement is covered in the next card.
Supporting quotations
Information to include
All requests must be made with particularity, including the specific data categories requested and date limitations for the request, as well as:
The name of the issuing authority and agent, email address from a law enforcement domain, and a direct contact phone number.
Account & Service Control · Procedure
Requests must give the username together with the relevant date; usernames are not static
A request must state the username of the Instagram account on the relevant date, with details of the specific information requested and its relationship to the investigation. Because usernames are not static, Instagram says it is unable to process requests that do not include the relevant date combined with the username.
Supporting quotations
The username of the Instagram account in question on the relevant date and details regarding specific information requested and its relationship to your investigation. Usernames are not static and we are unable to process requests that do not include the relevant date combined with the username.
Not stated here
Whether other identifiers (for example a user ID number) are accepted instead of a username is not stated.
Sharing & Disclosure · Procedure
Emergency requests involving imminent harm may be submitted through the Law Enforcement Online Request System
Where a matter involves imminent harm to a child or risk of death or serious physical injury to any person and requires disclosure without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System at facebook.com/records. Access to that system requires a government-issued email address. Messages from non-law-enforcement persons are not reviewed (see the next card).
Supporting quotations
Emergency requests
In responding to a matter involving imminent harm to a child or risk of death or serious physical injury to any person and requiring disclosure of information without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System at facebook.com/records.
A government-issued email address is required to access the Law Enforcement Online Request System.
Qualifications & exceptions
"may submit": the page describes the channel; it does not promise a particular response or timing for emergency requests.
Not stated here
The standard Instagram applies when deciding whether to disclose in an emergency is not stated here.
Legal Rights & Agreement Rules · Restriction or exception
Messages to "this email address" from non-law-enforcement senders are not reviewed; users should call local police
Instagram will not review or respond to messages sent to "this email address" by non-law enforcement officials. Users who are aware of an emergency should immediately and directly contact local law enforcement. The sentence refers to an email address, but no email address appears in the saved text of this page.
Supporting quotations
Important note: We will not review or respond to messages sent to this email address by non-law enforcement officials. Users aware of an emergency situation should immediately and directly contact local law enforcement officials.
Not stated here
The email address that "this email address" refers to is not present in the saved text; the preceding paragraph names only the online request system.
Apparent child sexual exploitation is reported to NCMEC from anywhere in the world
Instagram reports all apparent instances of child sexual exploitation appearing on its site, from anywhere in the world, to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law, including content drawn to its attention by government requests. NCMEC refers matters to law enforcement authorities around the world.
Supporting quotations
Child safety
We report all apparent instances of child sexual exploitation appearing on our site from anywhere in the world to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law including content drawn to our attention by government requests. NCMEC refers matters to law enforcement authorities from around the world in order to help victims.
Qualifications & exceptions
"in accordance with applicable law": the reporting duty is framed by law not reproduced here.
Legal Rights & Agreement Rules · Procedure
Requests about child exploitation or safety should say so and include NCMEC report identifiers
If a request relates to a child exploitation or safety matter, the requester should specify those circumstances and include relevant NCMEC report identifiers so that Instagram can address the matter expeditiously and effectively.
Supporting quotations
If a request relates to a child exploitation or safety matter, please specify those circumstances (and include relevant NCMEC report identifiers) in the request to ensure that we are able to address these matters expeditiously and effectively.
Sharing & Disclosure · Procedure
International requests: an MLAT request or letter rogatory may be required to compel account contents
Under the heading International legal process requirements, Instagram repeats that it discloses account records solely in accordance with applicable terms of service and applicable law, and says a Mutual Legal Assistance Treaty request or letter rogatory may be required to compel disclosure of the contents of an account. It points to a further page it labels "in our Privacy Policy"; that link is not supplied. The page does not say which countries or which non-content records this applies to.
Supporting quotations
International legal process requirements
We disclose account records solely in accordance with applicable terms of service and applicable law. A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.
Qualifications & exceptions
"may be required": the page does not state when an MLAT request or letter rogatory is or is not required.
Not stated here
The linked page labelled "in our Privacy Policy" (a help.instagram.com address different from the Privacy Policy link earlier on the page) is not supplied.
Account records are preserved for 90 days pending formal legal process in official criminal investigations
Instagram will take steps to preserve account records in connection with official criminal investigations for 90 days pending receipt of formal legal process. Formal preservation requests can be submitted expeditiously through the Law Enforcement Online Request System at facebook.com/records, or by email, or by mail. The U.S. mailing address is Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025; requests not submitted through the online system should expect longer response times. No email address appears in the saved text.
Supporting quotations
Account preservation
We will take steps to preserve account records in connection with official criminal investigations for 90 days pending our receipt of formal legal process. You may expeditiously submit formal preservation requests through the Law Enforcement Online Request System at facebook.com/records, or by email, or mail as indicated below.
Law enforcement officials seeking Instagram account records must address their request to: Meta Platforms, Inc., 1 Meta Way Menlo Park, CA 94025
should expect longer response times.
Qualifications & exceptions
Whether the 90-day period can be extended is not stated.
Requests outside the online system should expect longer response times.
Not stated here
The email route is named but no email address is present in the saved text.
With user consent, officials are directed to have the user retrieve the data via Download Data
If law enforcement seeks information about a user who has consented to the official accessing or obtaining the user's account information, Instagram says the user should be directed to obtain that information from their own account. For account content such as messages, photos and videos, users can use Instagram's "Download Data" feature in their Privacy and Security settings.
Supporting quotations
User consent
If law enforcement seeks information about an Instagram user who has provided consent for the official to access or obtain the user’s account information, the user should be directed to obtain that information on their own from their account. For account content, such as messages, photos and videos, users can access Instagram’s "Download Data" feature from their Privacy and Security settings.
Not stated here
Whether Instagram itself will disclose under a user's consent, rather than redirecting, is not stated.
Sharing & Disclosure · Company practice
Users are notified of requests before disclosure unless the law forbids it or circumstances are exceptional
Instagram's stated policy is to notify people who use its service of requests for their information prior to disclosure. It does not notify where it is prohibited by law from doing so, or in exceptional circumstances, which the page illustrates with child exploitation cases, emergencies, and situations where notice would be counterproductive. Law enforcement officials who believe notification would jeopardize an investigation are told to obtain an appropriate court order or other appropriate process establishing that notice is prohibited. Delayed notice after a non-disclosure period and the separate abuse-prevention notice are covered in the next two cards.
Supporting quotations
Notification
Our policy is to notify people who use our service of requests for their information prior to disclosure unless we are prohibited by law from doing so or in exceptional circumstances, such as child exploitation cases, emergencies or when notice would be counterproductive.
Law enforcement officials who believe that notification would jeopardize an investigation should obtain an appropriate court order or other appropriate process establishing that notice is prohibited.
Qualifications & exceptions
"such as": the listed exceptional circumstances are examples, not a closed list.
Stated as a policy ("Our policy is"), with the exceptions above; it is not an unconditional promise of notice.
Not stated here
How Instagram decides that notice would be "counterproductive" is not stated.
The form of notice and the time allowed before disclosure are not stated.
Sharing & Disclosure · Company commitment
Delayed notice is given after a court-ordered non-disclosure period ends, if circumstances allow
Where notice was withheld, Instagram will provide delayed notice upon expiration of a specific non-disclosure period in a court order and where it has a good-faith belief that exceptional circumstances no longer exist, provided it is not otherwise prohibited by law from doing so.
Supporting quotations
We will provide delayed notice upon expiration of a specific non-disclosure period in a court order and where we have a good faith belief that exceptional circumstances no longer exist, and we are not otherwise prohibited by law from doing so.
Qualifications & exceptions
The sentence joins both conditions with "and"; it does not say whether delayed notice follows an exceptional-circumstances withholding that involved no court order.
A request that reveals an ongoing terms violation triggers action that may itself notify the user
If a law enforcement data request draws Instagram's attention to an ongoing violation of its terms of use, Instagram will take action to prevent further abuse, and that action may include steps that notify the user that Instagram is aware of their misconduct. This is separate from, and can occur despite, the notification exceptions above.
Supporting quotations
If your data request draws attention to an ongoing violation of our terms of use, we will take action to prevent further abuse, including actions that may notify the user that we are aware of their misconduct.
Qualifications & exceptions
The terms of use are linked earlier on the page but not supplied; what counts as a violation is not described here.
No expert testimony; produced records are self-authenticating, and special certifications must be requested
Instagram is unable to provide expert testimony. Any records it produces are described as self-authenticating and as not requiring the testimony of records custodians. If a special form of certification is required, the requester should attach it to the records request.
Supporting quotations
Testimony
We are unable to provide expert testimony. Any records produced are self-authenticating and do not require the testimony of records custodians. If a special form of certification is required, please attach it to your records request.
Qualifications & exceptions
"Self-authenticating" is Instagram's description of the records; whether a court accepts them as such is a legal question not addressed here.
Charges & Financial Obligations · Company practice
Instagram may charge for responding to requests, with fees possibly waived for child-harm and emergency matters
Instagram may seek reimbursement for the costs of responding to requests for information, as provided by law. Unusual or burdensome requests may result in added costs that Instagram may recover. Instagram may waive fees in matters pertaining to potential harm to children, to Instagram, or to its users, and for emergency requests. Each statement uses "may": fees are neither promised nor fixed.
Supporting quotations
Cost reimbursement
We may seek reimbursement for costs in responding to requests for information as provided by law. Unusual or burdensome requests may result in added costs that we may recover. We may waive fees in matters pertaining to potential harm to children, us or our users, and emergency requests.
Qualifications & exceptions
Which law provides for reimbursement, and the amounts, are not stated.
Requests may be submitted online through the Law Enforcement Online Request System; other routes are slower
Law enforcement officials may use the Law Enforcement Online Request System, which the page describes as a law enforcement contact process for submitting, tracking and processing requests. A government-issued email address is required to access it. Officials who do not submit requests through that system should expect longer response times.
Supporting quotations
Submission of requests
Online:
a law enforcement contact process, for the submission, tracking and processing of requests. A government-issued email address is required to access the Law Enforcement Online Request System.
Law enforcement officials who do not submit requests through the
Not stated here
Response times themselves are not stated.
Legal Rights & Agreement Rules · Procedure
U.S. law enforcement must address requests to Meta Platforms, Inc. in Menlo Park, California
For U.S. law enforcement, requests for Instagram account records must be addressed to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025. The page labels this part of the submission section with a "Please note:" and a "Mail:" marker; the postal address is the only mailing detail given.
Supporting quotations
Please note:
For U.S. Law Enforcement:
Law enforcement officials seeking Instagram account records must address their request to: Meta Platforms, Inc., 1 Meta Way Menlo Park, CA 94025
Mail:
Not stated here
No email address or fax number appears in the saved text, although the preservation section mentions an email route.
Legal Rights & Agreement Rules · Procedure
For users in the European region (excluding the UK), the controller is Meta Platforms Ireland Ltd in Dublin
For users of the Instagram services in the European region, excluding the United Kingdom, the service provider and data controller is Meta Platforms Ireland Ltd. A request intended for Meta Platforms Ireland Ltd. must be addressed to Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. This appears under the label for law enforcement outside the U.S.
Supporting quotations
For Law Enforcement outside of the U.S.:
Please note that for users of the Instagram services in the European region (excluding the United Kingdom), the service provider and data controller is Meta Platforms Ireland Ltd. If your request is for Meta Platforms Ireland Ltd., it must be addressed to: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland
A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.
Qualifications & exceptions
International requests may also need a Mutual Legal Assistance Treaty request or letter rogatory to compel contents (see the International legal process card).
Not stated here
"European region" is not defined on this page.
Which entity handles United Kingdom users is not stated.
Outside the European region, Meta Platforms, Inc. is the provider and requests go to Menlo Park
For Instagram users in countries outside the European region, the service provider is Meta Platforms, Inc., and the page asks that any requests for Instagram or Facebook user data be correctly addressed to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025.
Supporting quotations
For Instagram users in countries outside of the European region, the service provider is Meta Platforms, Inc., please ensure that any requests for Instagram or Facebook user data are correctly addressed to: Meta Platforms, Inc. 1 Meta Way Menlo Park, CA 94025
Qualifications & exceptions
Mentions Facebook user data as well as Instagram; this page otherwise concerns Instagram records.