Law Enforcement

Legal Rights & Agreement Rules · Context

Scope: operational guidelines for law enforcement seeking Instagram account records; may change at any time

This page is a set of operational guidelines addressed to law enforcement officials who seek Instagram account records. It is guidance about how Instagram handles such requests, not a contract with users. Instagram states that the information may change at any time, and the page states no version date.

Supporting quotations

Information for law enforcement

These operational guidelines are for law enforcement officials seeking Instagram account records. This information may change at any time.

Qualifications & exceptions

• Audience: law enforcement officials, not ordinary users.

Not stated here

• No effective or last-updated date appears in the saved text.

Sharing & Disclosure · Company commitment

Account records are disclosed only under the terms of service and applicable law, including the SCA

Instagram says it discloses account records solely in accordance with its terms of service and applicable law, and names the federal Stored Communications Act (SCA), 18 U.S.C. Sections 2701-2712, as the applicable law under which the three tiers of U.S. legal process described below operate. Separately, Instagram's stated policy is to notify users of requests for their information before disclosure unless prohibited by law or in exceptional circumstances; that notification practice and its exceptions are explained in their own card.

Supporting quotations

Requests for user information

We disclose account records solely in accordance with our terms of service and applicable law, including the federal Stored Communications Act (“SCA”), 18 U.S.C. Sections 2701-2712. Under the SCA:

Our policy is to notify people who use our service of requests for their information prior to disclosure unless we are prohibited by law from doing so or in exceptional circumstances

Qualifications & exceptions

• The SCA is named by citation only; the statute's text is not part of this source and its meaning is not described here.
• The terms of service are linked elsewhere on the page but not supplied.

Not stated here

• Which terms-of-service provisions govern disclosure is not stated on this page.

Sharing & Disclosure · Procedure

A valid criminal subpoena is required to compel basic subscriber records

Under the SCA as described on this page, a valid subpoena issued in connection with an official criminal investigation is required to compel disclosure of basic subscriber records, which the page says are defined in 18 U.S.C. Section 2703(c)(2). The page lists what those records may include: name, length of service, credit card information, email address(es), and any recent login/logout IP address(es), if available. The list is illustrative ("may include") and conditioned on availability.

Supporting quotations

a valid subpoena issued in connection with an official criminal investigation is required to compel the disclosure of basic subscriber records (defined in 18 U.S.C. Section 2703(c)(2)), which may include: name, length of service, credit card information, email address(es), and any recent login/logout IP address(es), if available.

Qualifications & exceptions

• "which may include" and "if available": the list is not a guarantee that each item exists for an account.
• Section 2703(c)(2) is an external statutory citation; its definition is not reproduced on the page.

Not stated here

• Whether a subpoena from a non-criminal (for example civil or administrative) matter is accepted is not stated.

Cross-references

• qualified by (model-proposed): Some stored information is collected automatically; Instagram does not verify email, phone or real names — Basic subscriber records may include a name and email address, but Instagram says it does not verify email, phone or real names, so user-provided identity details in those records are unverified.

Sharing & Disclosure · Procedure

A Section 2703(d) court order is required to compel non-content account records such as headers and IP addresses

A court order issued under 18 U.S.C. Section 2703(d) is required to compel disclosure of certain records or other information pertaining to the account, excluding contents of communications. The page says such records may include message headers and IP addresses, in addition to the basic subscriber records available under a subpoena.

Supporting quotations

a court order issued under 18 U.S.C. Section 2703(d) is required to compel the disclosure of certain records or other information pertaining to the account, not including contents of communications, which may include message headers and IP addresses, in addition to the basic subscriber records identified above.

Qualifications & exceptions

• Section 2703(d) is an external statutory citation; the page does not reproduce the order standard.

Sharing & Disclosure · Procedure

A probable-cause search warrant is required to compel stored account contents

A search warrant, issued under the Federal Rules of Criminal Procedure or equivalent state warrant procedures on a showing of probable cause, is required to compel disclosure of the stored contents of any account. The page says contents may include messages, photos, comments, and location information. For requests from outside the United States, the International legal process card notes that a Mutual Legal Assistance Treaty request or letter rogatory may be required to compel contents.

Supporting quotations

a search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include messages, photos, comments, and location information.

A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.

Qualifications & exceptions

• The Federal Rules of Criminal Procedure are named, not supplied.

Cross-references

• qualified by (model-proposed): International requests: an MLAT request or letter rogatory may be required to compel account contents — For international requests, an MLAT request or letter rogatory may be required to compel contents in addition to the warrant standard described for U.S. process.

Data Access & Collection · Company practice

Some stored information is collected automatically; Instagram does not verify email, phone or real names

In the context of records requests, Instagram notes that some information it stores is collected automatically while other information is provided by the user, and that it does not require email or phone verification and does not require people to use real names or identities on Instagram. The page presents this as a caution about the records: user-provided identity details are not verified by Instagram.

Supporting quotations

It is important to note that some information we store is collected automatically, while other information is provided by the user. We do not require email or phone verification, and we do not require people to use real names or identities on Instagram.

Not stated here

• Which record types are automatic and which are user-provided is not itemised here.

Cross-references

• qualifies (model-proposed): A valid criminal subpoena is required to compel basic subscriber records — Basic subscriber records may include a name and email address, but Instagram says it does not verify email, phone or real names, so user-provided identity details in those records are unverified.

Legal Rights & Agreement Rules · Context

The Privacy Policy and Terms of Use are linked for additional information but not supplied

The page points law enforcement to Instagram's Privacy Policy and Terms of Use for additional information about Instagram. Those documents are linked, not reproduced, so their contents are not described in this analysis.

Supporting quotations

For additional information about Instagram, please read our

Not stated here

• The linked Privacy Policy and Terms of Use are not supplied; nothing about their contents is assumed.

Retention & Deletion · Company practice

Retention periods vary; data is not kept for law enforcement unless a valid preservation request arrives

Instagram retains different types of information for different time periods and warns that, given the volume of real-time content, some information may only be stored for a short period. It does not retain data for law enforcement purposes unless it receives a legally valid preservation request. The Account preservation card explains that preservation in connection with an official criminal investigation lasts 90 days pending formal legal process.

Supporting quotations

Data retention and availability

We retain different types of information for different time periods. Given the volume of real-time content on Instagram, some information may only be stored for a short period of time. We do not retain data for law enforcement purposes unless we receive a legally valid preservation request.

We will take steps to preserve account records in connection with official criminal investigations for 90 days pending our receipt of formal legal process.

Not stated here

• Specific retention periods per data type are not stated.

Cross-references

• qualified by (model-proposed): Account records are preserved for 90 days pending formal legal process in official criminal investigations — The 90-day preservation commitment is the practice that applies once the legally valid preservation request named in the retention card is received.

Legal Rights & Agreement Rules · Procedure

Requests must be particular and identify the issuing authority, agent, law-enforcement email and phone

All requests must be made with particularity, including the specific data categories requested and date limitations, together with the name of the issuing authority and agent, an email address from a law enforcement domain, and a direct contact phone number. The username requirement is covered in the next card.

Supporting quotations

Information to include

All requests must be made with particularity, including the specific data categories requested and date limitations for the request, as well as:

The name of the issuing authority and agent, email address from a law enforcement domain, and a direct contact phone number.

Account & Service Control · Procedure

Requests must give the username together with the relevant date; usernames are not static

A request must state the username of the Instagram account on the relevant date, with details of the specific information requested and its relationship to the investigation. Because usernames are not static, Instagram says it is unable to process requests that do not include the relevant date combined with the username.

Supporting quotations

The username of the Instagram account in question on the relevant date and details regarding specific information requested and its relationship to your investigation. Usernames are not static and we are unable to process requests that do not include the relevant date combined with the username.

Not stated here

• Whether other identifiers (for example a user ID number) are accepted instead of a username is not stated.

Sharing & Disclosure · Procedure

Emergency requests involving imminent harm may be submitted through the Law Enforcement Online Request System

Where a matter involves imminent harm to a child or risk of death or serious physical injury to any person and requires disclosure without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System at facebook.com/records. Access to that system requires a government-issued email address. Messages from non-law-enforcement persons are not reviewed (see the next card).

Supporting quotations

Emergency requests

In responding to a matter involving imminent harm to a child or risk of death or serious physical injury to any person and requiring disclosure of information without delay, a law enforcement official may submit a request through the Law Enforcement Online Request System at facebook.com/records.

A government-issued email address is required to access the Law Enforcement Online Request System.

Qualifications & exceptions

• "may submit": the page describes the channel; it does not promise a particular response or timing for emergency requests.

Not stated here

• The standard Instagram applies when deciding whether to disclose in an emergency is not stated here.

Cross-references

• refers to (model-proposed): Requests may be submitted online through the Law Enforcement Online Request System; other routes are slower — The emergency request route is the same Law Enforcement Online Request System described in the submission card, which requires a government-issued email address.
• qualified by (model-proposed): Messages to "this email address" from non-law-enforcement senders are not reviewed; users should call local police — The emergency channel is limited to law enforcement officials: messages from others are not reviewed, and users are directed to local police.
• qualified by (model-proposed): Instagram may charge for responding to requests, with fees possibly waived for child-harm and emergency matters — Fees that Instagram may charge for responding to requests may be waived for emergency requests and potential harm to children.

Legal Rights & Agreement Rules · Restriction or exception

Messages to "this email address" from non-law-enforcement senders are not reviewed; users should call local police

Instagram will not review or respond to messages sent to "this email address" by non-law enforcement officials. Users who are aware of an emergency should immediately and directly contact local law enforcement. The sentence refers to an email address, but no email address appears in the saved text of this page.

Supporting quotations

Important note: We will not review or respond to messages sent to this email address by non-law enforcement officials. Users aware of an emergency situation should immediately and directly contact local law enforcement officials.

Not stated here

• The email address that "this email address" refers to is not present in the saved text; the preceding paragraph names only the online request system.

Cross-references

• qualifies (model-proposed): Emergency requests involving imminent harm may be submitted through the Law Enforcement Online Request System — The emergency channel is limited to law enforcement officials: messages from others are not reviewed, and users are directed to local police.

Sharing & Disclosure · Company practice

Apparent child sexual exploitation is reported to NCMEC from anywhere in the world

Instagram reports all apparent instances of child sexual exploitation appearing on its site, from anywhere in the world, to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law, including content drawn to its attention by government requests. NCMEC refers matters to law enforcement authorities around the world.

Supporting quotations

Child safety

We report all apparent instances of child sexual exploitation appearing on our site from anywhere in the world to the National Center for Missing and Exploited Children (NCMEC), in accordance with applicable law including content drawn to our attention by government requests. NCMEC refers matters to law enforcement authorities from around the world in order to help victims.

Qualifications & exceptions

• "in accordance with applicable law": the reporting duty is framed by law not reproduced here.

Legal Rights & Agreement Rules · Procedure

Requests about child exploitation or safety should say so and include NCMEC report identifiers

If a request relates to a child exploitation or safety matter, the requester should specify those circumstances and include relevant NCMEC report identifiers so that Instagram can address the matter expeditiously and effectively.

Supporting quotations

If a request relates to a child exploitation or safety matter, please specify those circumstances (and include relevant NCMEC report identifiers) in the request to ensure that we are able to address these matters expeditiously and effectively.

Sharing & Disclosure · Procedure

International requests: an MLAT request or letter rogatory may be required to compel account contents

Under the heading International legal process requirements, Instagram repeats that it discloses account records solely in accordance with applicable terms of service and applicable law, and says a Mutual Legal Assistance Treaty request or letter rogatory may be required to compel disclosure of the contents of an account. It points to a further page it labels "in our Privacy Policy"; that link is not supplied. The page does not say which countries or which non-content records this applies to.

Supporting quotations

International legal process requirements

We disclose account records solely in accordance with applicable terms of service and applicable law. A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.

Qualifications & exceptions

• "may be required": the page does not state when an MLAT request or letter rogatory is or is not required.

Not stated here

• The linked page labelled "in our Privacy Policy" (a help.instagram.com address different from the Privacy Policy link earlier on the page) is not supplied.

Cross-references

• qualifies (model-proposed): A probable-cause search warrant is required to compel stored account contents — For international requests, an MLAT request or letter rogatory may be required to compel contents in addition to the warrant standard described for U.S. process.
• referred to by (model-proposed): For users in the European region (excluding the UK), the controller is Meta Platforms Ireland Ltd in Dublin — Non-U.S. requests addressed to Meta Platforms Ireland Ltd. remain subject to the international legal process requirement that an MLAT request or letter rogatory may be needed to compel contents.

Retention & Deletion · Company commitment

Account records are preserved for 90 days pending formal legal process in official criminal investigations

Instagram will take steps to preserve account records in connection with official criminal investigations for 90 days pending receipt of formal legal process. Formal preservation requests can be submitted expeditiously through the Law Enforcement Online Request System at facebook.com/records, or by email, or by mail. The U.S. mailing address is Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025; requests not submitted through the online system should expect longer response times. No email address appears in the saved text.

Supporting quotations

Account preservation

We will take steps to preserve account records in connection with official criminal investigations for 90 days pending our receipt of formal legal process. You may expeditiously submit formal preservation requests through the Law Enforcement Online Request System at facebook.com/records, or by email, or mail as indicated below.

Law enforcement officials seeking Instagram account records must address their request to: Meta Platforms, Inc., 1 Meta Way Menlo Park, CA 94025

should expect longer response times.

Qualifications & exceptions

• Whether the 90-day period can be extended is not stated.
• Requests outside the online system should expect longer response times.

Not stated here

• The email route is named but no email address is present in the saved text.

Cross-references

• qualifies (model-proposed): Retention periods vary; data is not kept for law enforcement unless a valid preservation request arrives — The 90-day preservation commitment is the practice that applies once the legally valid preservation request named in the retention card is received.

Account & Service Control · Procedure

With user consent, officials are directed to have the user retrieve the data via Download Data

If law enforcement seeks information about a user who has consented to the official accessing or obtaining the user's account information, Instagram says the user should be directed to obtain that information from their own account. For account content such as messages, photos and videos, users can use Instagram's "Download Data" feature in their Privacy and Security settings.

Supporting quotations

User consent

If law enforcement seeks information about an Instagram user who has provided consent for the official to access or obtain the user’s account information, the user should be directed to obtain that information on their own from their account. For account content, such as messages, photos and videos, users can access Instagram’s "Download Data" feature from their Privacy and Security settings.

Not stated here

• Whether Instagram itself will disclose under a user's consent, rather than redirecting, is not stated.

Sharing & Disclosure · Company practice

Users are notified of requests before disclosure unless the law forbids it or circumstances are exceptional

Instagram's stated policy is to notify people who use its service of requests for their information prior to disclosure. It does not notify where it is prohibited by law from doing so, or in exceptional circumstances, which the page illustrates with child exploitation cases, emergencies, and situations where notice would be counterproductive. Law enforcement officials who believe notification would jeopardize an investigation are told to obtain an appropriate court order or other appropriate process establishing that notice is prohibited. Delayed notice after a non-disclosure period and the separate abuse-prevention notice are covered in the next two cards.

Supporting quotations

Notification

Our policy is to notify people who use our service of requests for their information prior to disclosure unless we are prohibited by law from doing so or in exceptional circumstances, such as child exploitation cases, emergencies or when notice would be counterproductive.

Law enforcement officials who believe that notification would jeopardize an investigation should obtain an appropriate court order or other appropriate process establishing that notice is prohibited.

Qualifications & exceptions

• "such as": the listed exceptional circumstances are examples, not a closed list.
• Stated as a policy ("Our policy is"), with the exceptions above; it is not an unconditional promise of notice.

Not stated here

• How Instagram decides that notice would be "counterproductive" is not stated.
• The form of notice and the time allowed before disclosure are not stated.

Cross-references

• qualified by (model-proposed): Delayed notice is given after a court-ordered non-disclosure period ends, if circumstances allow — Delayed notice after a court-ordered non-disclosure period qualifies the general notify-before-disclosure policy and its exceptions.
• qualified by (model-proposed): A request that reveals an ongoing terms violation triggers action that may itself notify the user — Abuse-prevention action after a request that reveals an ongoing terms violation may notify the user even where request notification is withheld.

Sharing & Disclosure · Company commitment

Delayed notice is given after a court-ordered non-disclosure period ends, if circumstances allow

Where notice was withheld, Instagram will provide delayed notice upon expiration of a specific non-disclosure period in a court order and where it has a good-faith belief that exceptional circumstances no longer exist, provided it is not otherwise prohibited by law from doing so.

Supporting quotations

We will provide delayed notice upon expiration of a specific non-disclosure period in a court order and where we have a good faith belief that exceptional circumstances no longer exist, and we are not otherwise prohibited by law from doing so.

Qualifications & exceptions

• The sentence joins both conditions with "and"; it does not say whether delayed notice follows an exceptional-circumstances withholding that involved no court order.

Cross-references

• qualifies (model-proposed): Users are notified of requests before disclosure unless the law forbids it or circumstances are exceptional — Delayed notice after a court-ordered non-disclosure period qualifies the general notify-before-disclosure policy and its exceptions.

Account & Service Control · Company practice

A request that reveals an ongoing terms violation triggers action that may itself notify the user

If a law enforcement data request draws Instagram's attention to an ongoing violation of its terms of use, Instagram will take action to prevent further abuse, and that action may include steps that notify the user that Instagram is aware of their misconduct. This is separate from, and can occur despite, the notification exceptions above.

Supporting quotations

If your data request draws attention to an ongoing violation of our terms of use, we will take action to prevent further abuse, including actions that may notify the user that we are aware of their misconduct.

Qualifications & exceptions

• The terms of use are linked earlier on the page but not supplied; what counts as a violation is not described here.

Cross-references

• qualifies (model-proposed): Users are notified of requests before disclosure unless the law forbids it or circumstances are exceptional — Abuse-prevention action after a request that reveals an ongoing terms violation may notify the user even where request notification is withheld.

Legal Rights & Agreement Rules · Company practice

No expert testimony; produced records are self-authenticating, and special certifications must be requested

Instagram is unable to provide expert testimony. Any records it produces are described as self-authenticating and as not requiring the testimony of records custodians. If a special form of certification is required, the requester should attach it to the records request.

Supporting quotations

Testimony

We are unable to provide expert testimony. Any records produced are self-authenticating and do not require the testimony of records custodians. If a special form of certification is required, please attach it to your records request.

Qualifications & exceptions

• "Self-authenticating" is Instagram's description of the records; whether a court accepts them as such is a legal question not addressed here.

Charges & Financial Obligations · Company practice

Instagram may charge for responding to requests, with fees possibly waived for child-harm and emergency matters

Instagram may seek reimbursement for the costs of responding to requests for information, as provided by law. Unusual or burdensome requests may result in added costs that Instagram may recover. Instagram may waive fees in matters pertaining to potential harm to children, to Instagram, or to its users, and for emergency requests. Each statement uses "may": fees are neither promised nor fixed.

Supporting quotations

Cost reimbursement

We may seek reimbursement for costs in responding to requests for information as provided by law. Unusual or burdensome requests may result in added costs that we may recover. We may waive fees in matters pertaining to potential harm to children, us or our users, and emergency requests.

Qualifications & exceptions

• Which law provides for reimbursement, and the amounts, are not stated.

Cross-references

• qualifies (model-proposed): Emergency requests involving imminent harm may be submitted through the Law Enforcement Online Request System — Fees that Instagram may charge for responding to requests may be waived for emergency requests and potential harm to children.

Legal Rights & Agreement Rules · Procedure

Requests may be submitted online through the Law Enforcement Online Request System; other routes are slower

Law enforcement officials may use the Law Enforcement Online Request System, which the page describes as a law enforcement contact process for submitting, tracking and processing requests. A government-issued email address is required to access it. Officials who do not submit requests through that system should expect longer response times.

Supporting quotations

Submission of requests

Online:

a law enforcement contact process, for the submission, tracking and processing of requests. A government-issued email address is required to access the Law Enforcement Online Request System.

Law enforcement officials who do not submit requests through the

Not stated here

• Response times themselves are not stated.

Cross-references

• referred to by (model-proposed): Emergency requests involving imminent harm may be submitted through the Law Enforcement Online Request System — The emergency request route is the same Law Enforcement Online Request System described in the submission card, which requires a government-issued email address.

Legal Rights & Agreement Rules · Procedure

U.S. law enforcement must address requests to Meta Platforms, Inc. in Menlo Park, California

For U.S. law enforcement, requests for Instagram account records must be addressed to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025. The page labels this part of the submission section with a "Please note:" and a "Mail:" marker; the postal address is the only mailing detail given.

Supporting quotations

Please note:

For U.S. Law Enforcement:

Law enforcement officials seeking Instagram account records must address their request to: Meta Platforms, Inc., 1 Meta Way Menlo Park, CA 94025

Mail:

Not stated here

• No email address or fax number appears in the saved text, although the preservation section mentions an email route.

Legal Rights & Agreement Rules · Procedure

For users in the European region (excluding the UK), the controller is Meta Platforms Ireland Ltd in Dublin

For users of the Instagram services in the European region, excluding the United Kingdom, the service provider and data controller is Meta Platforms Ireland Ltd. A request intended for Meta Platforms Ireland Ltd. must be addressed to Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. This appears under the label for law enforcement outside the U.S.

Supporting quotations

For Law Enforcement outside of the U.S.:

Please note that for users of the Instagram services in the European region (excluding the United Kingdom), the service provider and data controller is Meta Platforms Ireland Ltd. If your request is for Meta Platforms Ireland Ltd., it must be addressed to: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland

A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of an account.

Qualifications & exceptions

• International requests may also need a Mutual Legal Assistance Treaty request or letter rogatory to compel contents (see the International legal process card).

Not stated here

• "European region" is not defined on this page.
• Which entity handles United Kingdom users is not stated.

Cross-references

• refers to (model-proposed): International requests: an MLAT request or letter rogatory may be required to compel account contents — Non-U.S. requests addressed to Meta Platforms Ireland Ltd. remain subject to the international legal process requirement that an MLAT request or letter rogatory may be needed to compel contents.

Legal Rights & Agreement Rules · Procedure

Outside the European region, Meta Platforms, Inc. is the provider and requests go to Menlo Park

For Instagram users in countries outside the European region, the service provider is Meta Platforms, Inc., and the page asks that any requests for Instagram or Facebook user data be correctly addressed to Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025.

Supporting quotations

For Instagram users in countries outside of the European region, the service provider is Meta Platforms, Inc., please ensure that any requests for Instagram or Facebook user data are correctly addressed to: Meta Platforms, Inc. 1 Meta Way Menlo Park, CA 94025

Qualifications & exceptions

• Mentions Facebook user data as well as Instagram; this page otherwise concerns Instagram records.

Not stated here

• "European region" is not defined on this page.