From AI chatbots to social media: data identification and preservation in the digital age

Reuters

16-02-2025

February 12, 2025 - The advent of new software applications, such as AI chatbots like ChatGPT and third-party messaging applications like Slack, may help streamline chaotic areas of our lives, but their inclusion in e-discovery preservation workflows could do quite the opposite. New applications may pose challenges for collections in the course of discovery, but they more immediately pose challenges at the identification and preservation stages of the EDRM (Electronic Discovery Reference Model).
As such, attorneys need to be aware of new applications their clients are using so that they can ensure data generated by this software is preserved appropriately and can counsel their clients on what to do if the application does not allow for the preservation of this data.
Identifying new sources of data and the challenges they pose for preservation
The new applications an average client is likely to use can be placed in one of three categories: AI chatbots, third party messaging applications, and social media platforms. Once you have identified one of these sources as containing relevant data, the Federal Rules demand that this data is preserved so that sanctions are avoided.
The most common way that data is deleted from these applications is through default or selected settings. As such, the most integral step in data preservation for these applications is to understand what, if any, the default data retention period of a particular application is and if the period can be actively changed by the individual user for preservation purposes. Note that, as technology changes, so too do the retention policies associated with these applications. Be sure to consult each application's website to understand its latest privacy and retention policies.
1. AI chatbots
An AI chatbot is a tool that uses artificial intelligence to answer questions and respond to prompts. Some of the most popular AI chatbots are ChatGPT and Microsoft Copilot; however, new chatbots are always emerging. For example, Perplexity.ai, Jasper AI, and Google's Gemini have garnered the attention of technology enthusiasts.
ChatGPT chats are saved unless actively deleted; however, users can opt to disable the automatic saving of chat histories. As such, ensuring that a client does not actively delete relevant histories and that automatic retention settings are not disabled will prevent relevant information from being deleted.
Copilot chats, especially when governed by a larger organization, can be retained for a set period of time before deletion. In this instance, retention settings are set at an enterprise level for an organization, so it best for an attorney to understand what the retention period is and ensure automatic deletion is suspended if needed.
Perplexity.ai prompts are saved as long as the account is active, and once an account is deleted, information is removed from servers within 30 days. Here, instructing a client to keep his/her account active and to not actively delete chat histories will ensure messages are preserved. If a deletion occurs within the 30-day window, corresponding directly with Perplexity.ai for preservation may be warranted.
Jasper AI appears to have a short retention period for chat history so it is important to collect data as early as possible, to understand if there are any other means by which relevant chat history was saved if deleted (i.e., screenshots), and to document the steps taken to attempt preservation in case needed in court.
Gemini prompts are saved for up to 72 hours, and the last 24 hours of conversation data is accessible within a user's activity log even if a particular activity function is disabled. Auto-delete settings are managed by the user with options to save prompts for anywhere from three to 36 months. As such, instructing your client to choose the longest auto-delete setting along with making early arrangements for collection will prevent spoliation.
2. Third party messaging applications
Third party messaging applications allow individuals to do everything from chat and conduct video conferences to store shared files. Teams and Slack are rampant in the corporate market, WhatsApp and WeChat are popular in the foreign data market, and Signal, Telegram, and Element have also gained traction.
These tools often have back-end enterprise settings that dictate how long messages are kept. Teams messages are stored according to an organization's retention policy, and policies can be set for specific teams or an entire organization. Understanding your client's back-end retention policies for these applications will ensure that you counsel your client appropriately about disabling auto-delete functions.
Slack saves messages for different lengths of time depending on the user's plan and set retention schedules. For free accounts, data is kept up to one year, and for paid plans, data is kept for as long as the paid workspace exists by default. As such, it is important to understand under which type of account your client is operating so that you can appropriately counsel them on maintaining an active paid workspace or implementing an early collection so messages that would be deleted in the ordinary course are preserved.
For WhatsApp and Element, users can set messages to disappear after a set amount of time, though messages can be kept for the lifetime of the account. For Telegram, Signal and WeChat, data is retained until an account is deleted or the user actively deletes the data. For these applications, attorneys should counsel their clients to choose appropriate retention settings when available and avoid deleting an account or relevant messages.
3. Social media accounts
Social media has remained a staple of content production. The popular platforms of Facebook, Instagram and X are still thriving alongside Snapchat and TikTok, but other new platforms have emerged such as Bluesky, Threads, and Mastodon.
Social media applications often offer lengthy data retention. Platforms like TikTok, X, Facebook, Instagram, Mastodon, Bluesky, and Threads do not delete your posted information unless the account itself is deleted or if the user actively deletes the data. Oftentimes, even if an account is deleted, there is a period during which the company may keep a user's data before permanent deletion.
It is best to counsel your client to not actively delete any relevant data from these platforms and to keep his/her account active. If an account is deleted, it may be worth checking directly with the platform to see if that data has been retained and if it can be preserved.
Snapchat data deletes 24 hours after viewing or seven days after viewing, depending on a user's setting; however, the Memories feature of Snapchat allows content to be kept for as long as the user would like. In this instance, it is best to counsel your client to suspend the use of these applications for relevant communications, work on an early collection of anything that may be preserved through a client's Memories, and document your process in the interim.
Keeping up with the future of data identification and preservation
The rapid evolution of software applications presents both opportunities and challenges in the realm of e-discovery. As new tools emerge, it is crucial for attorneys to stay informed about the technologies their clients use and their associated data retention policies. By understanding the default data retention settings and advising clients on best practices, legal professionals can ensure that relevant information is preserved appropriately.