Acquiring data from META platforms (Facebook, Instagram, Messenger) by law enforcement

Platforms belonging to Meta Platforms, Inc. (Facebook, Instagram, Messenger, Threads) are among the most frequently used sources of information in criminal, civil and administrative proceedings.
From the perspective of law enforcement and court digital-forensics experts, it is crucial to understand what data can be obtained, under what procedure and on what legal basis.

Meta, as a provider of social-media services, discloses data solely to authorised bodies, within the framework of specific procedures and international regulations.

1. Categories of data disclosed by Meta

Meta discloses data in two basic categories:

In addition, Meta offers a third mode – a Preservation Request, i.e. the temporary preservation of data (for 90 days) before a formal order for its disclosure is issued.

2. How law enforcement can request data

Meta has a dedicated portal for law enforcement and the judiciary: https://www.facebook.com/records

This is the official point for handling legal requests concerning all Meta platforms (Facebook, Instagram, Messenger, Threads, WhatsApp).

After logging in and verifying their authority, bodies can submit:

• Preservation Requests – securing data,
• Legal Process Requests – requests to disclose data,
• Emergency Requests – urgent requests when a person's life or safety is at risk.

3. NON-CONTENT DATA – technical data (e.g. logins, IP)

Within a non-content data request, Meta may provide, among other things:

• account identification data (ID, profile name, link),
• the e-mail address assigned to the account,
• the phone number,
• the date the account was created,
• login IP addresses (with dates and times),
• information about devices, browsers and locations,
• the account status (active, deleted, suspended).

This data does not include the content of communications and therefore does not breach the secrecy of correspondence. It may be disclosed on the basis of:

• Article 20c of the Police Act (telecommunications data),
• Article 218 § 1 of the Code of Criminal Procedure,
• or equivalent provisions on obtaining telecommunications data.

Requests should be directed through the Facebook Law Enforcement Portal from an official e-mail address (e.g. @policja.gov.pl, @prokuratura.gov.pl).

4. CONTENT DATA – the content of communications and publications

The content of communications (posts, messages, photos, recordings) may be disclosed only:

• on the basis of a court order, or
• within the framework of mutual legal assistance (MLAT, Mutual Legal Assistance Treaty),
• in the European Union – via a European Investigation Order (EIO).

In the case of Poland, such requests are directed by:

The National Public Prosecutor's Office
Department of International Cooperation
ul. Postępu 3, 02-676 Warsaw

After approval by the US authorities (Meta is headquartered in California), the data is transferred in the form of an encrypted package (ZIP, P7M) containing JSON, HTML or CSV files.

5. PRESERVATION REQUEST – temporary data preservation

Before a body obtains a formal court order, it can submit a request for the temporary preservation of the account's data.
Meta then stores all data associated with the account for 90 days, to prevent it from being deleted or altered.

The request is also submitted via the portal:
https://www.facebook.com/records

The request should specify:

• the username, profile ID or URL,
• the scope of data to be preserved,
• the legal basis,
• the officer's contact details.

After receiving confirmation, the body has 90 days to submit the proper request for the disclosure of data.

6. Publicly available data – the expert's role

A digital-forensics expert may obtain publicly available data independently, e.g.:

• posts, comments, photos, reactions,
• profiles, pages, open groups,
• publication dates and URLs.

Such data can be obtained using specialist analytical tools (e.g. OSINT-class systems, crawlers, tools for analysing large data sets). However, the expert should:

• document the source and time of data acquisition,
• secure the material in a non-editable format (PDF, CSV, JSON),
• confirm the integrity of the data (hash checksums).

7. Practical tips for law enforcement

1. Preservation Request – submit as soon as possible after the account is identified.
2. Non-content data – a request suffices for technical findings (e.g. IP, e-mail, devices).
3. Content data – requires a decision of the court or the National Public Prosecutor's Office (EIO/MLAT).
4. Public data – can be secured directly by the expert.
5. Translation – requests should be submitted in English or bilingually (PL/EN).

8. Summary

Meta (Facebook, Instagram, Messenger) enables full cooperation with law enforcement within three modes.

For experts and law enforcement, this means that, as early as the initial stage of proceedings, one can:

• secure the data,
• identify the account,
• and then request detailed information.

The effectiveness of these actions depends on the speed of the response and the formal correctness of the request — which is why it is worth using ready-made templates (Preservation Request, Non-content Data Request) and maintaining contact with the Meta Law Enforcement Response Team.

Our practice offers support to law enforcement and the judiciary in obtaining and analysing data from the META ecosystem (Facebook, Instagram, Messenger, Threads). We have dedicated tools for reviewing large data sets, which significantly speeds up the analysis and reporting process.