A social-media message export is useful only when you can explain what it contains, what it omits, who can access it, and whether it changed after capture. This checklist covers native exports, metadata, retention, access, and verification without assuming that one platform download is a complete record.
1. Start with the record you need to preserve
For a defensible baseline, preserve more than message text. The U.S. National Archives and Records Administration (NARA) says a complete Federal record must have content, context, and structure, together with associated metadata such as the author and creation date, and must be maintained for reliability and authenticity (NARA guidance).
Use that as your completeness test:
- Content: the message or conversation export.
- Context: the account, profile, participants, date range, and reason for capture.
- Structure: the format and relationship between files, folders, attachments, and message records.
- Metadata: details such as author and creation date, plus the export scope and timestamp you record.
For this checklist, treat the downloaded export as the copy you preserve, then test whether it contains those elements. NARA lists platform-specific APIs, web capture, manual methods, and platform export tools as possible capture methods. It also says that when a provider cannot export a complete record, the organization remains responsible for implementing capture requirements (NARA guidance).
If your preservation plan also includes public social content, SocialGuardian automatically backs up posts, stories, and videos from major platforms. Its site says the backup includes media and metadata, with a full archive export available anytime. Review SocialGuardian
2. Map accounts, custodians, and retention before exporting
Create one row for every network and profile before requesting data. Record:
- Network and profile handle or URL
- Account owner or custodian
- Business purpose and relevant message scope
- Date range requested
- Export method and format
- Request date, delivery date, and access owner
- Storage location and retention rule
- Known exclusions, delays, or deleted-content warnings
The platform is not the sole test for whether a message belongs in a regulated record. FINRA says social-media recordkeeping obligations depend on whether the communication is a business communication, not simply on the platform. It also says that analysis does not depend on the device or technology, including a personal device (FINRA Notice 11-39).
Retention is also not one universal number. For example:
| Rule or principle | What the cited source says | How to use it in the map |
|---|---|---|
| FINRA broker-dealer records | Certain records must be preserved for at least three years, with the first two years easily accessible. | Confirm whether the communication is within the applicable recordkeeping rule. |
| HIPAA Security Rule documentation | Required documentation is retained for six years from creation or from when it was last in effect, whichever is later. | Confirm whether the item is required documentation before applying this period. |
| GDPR recital 39 | Storage should be limited to a strict minimum, with appropriate security and confidentiality. | Define a necessary period and access controls rather than retaining everything indefinitely. |
The FINRA period is stated in Notice 11-39, the HIPAA requirement appears in 45 CFR 164.316, and the storage and security language appears in GDPR recital 39. These are sourced examples, not a universal retention policy. NIST advises applying forensic practices only after consulting management and legal counsel about applicable laws and regulations (NIST SP 800-86).
Do not let a system that automatically erases or deletes electronic communications be your only recordkeeping control: FINRA says that kind of technology would preclude the ability to retain the communications (FINRA Notice 11-39).
3. Export messages and account data using documented native flows
Use the official flow that matches the platform, and save the request details with the resulting files.
On desktop, the official path to begin an export is More > Settings > Meta Account > Your information and permissions > Export your information > Create export. Instagram says you can select specific information, a date range, format, notification email, and media quality before starting the export (Instagram Help).
Plan around the delivery window: Instagram says a ready export is available for four days, while an export link may take up to 30 days to arrive. Its help page also notes that deleted information may not appear, and describes the export as password-protected and accessible only to the account holder (Instagram Help). Record the request date and the date you actually downloaded the files.
On desktop, Facebook's official path is profile picture > Settings & privacy > Settings > Meta Account > Your information and permissions > Export your information > Create export. Facebook lets you choose HTML or JSON; its help page describes HTML as browser-friendly in a ZIP and JSON as machine-readable (Facebook Help).
The same help page says ready exports remain available for four days and that exporting is password-protected. Facebook also warns that categories are stored for different periods and that deleted information or content will not appear in the export (Facebook Help; Facebook data availability). Treat the result as an account-information export to review, not as proof that every historical message exists.
LinkedIn's official desktop path is Me > Settings & Privacy > Data Privacy > Download your data. LinkedIn says you can select specific categories or a larger download: a specific type may arrive within minutes, a larger download within 24 hours, and the download link remains available for 72 hours (LinkedIn Help).
There are two important scope limits. LinkedIn says the download feature is not available on mobile, and that it provides the requesting member's own personal data, not other members' data (LinkedIn Help). Note both limits in the preservation record.
The saved official procedure is for Android: open the chat > More options > More > Export chat > Without media or Include media > choose a sharing method (WhatsApp Help).
WhatsApp states that an exported chat history is a text file, not a backup file, and cannot be re-imported. If you choose Include media, the most recent media sent is added as attachments. Preserve the text export and attachments together, and do not describe the result as a complete media archive without verifying its scope (WhatsApp Help).
Google Takeout and other account archives
Google describes Takeout as a way to create an archive for keeping records or transferring data. It says archive creation can take from a few minutes to a few days, and that you can choose a file type and maximum archive size; when the selected data exceeds that size, multiple archives are created (Google Takeout).
Google also warns that a data file may not include changes made between requesting a download and creating the archive (Google Takeout). Record the request and archive-creation timing, and keep every archive part.
TikTok and platforms without a documented flow here
This research pack does not establish an official TikTok export path or a claim about TikTok direct-message coverage. Do not copy an Instagram, Facebook, or LinkedIn path into TikTok instructions. Instead, record the platform's current documented export option if one is available; otherwise document the capture method and limitation. NARA identifies APIs, web capture, manual methods, and platform export tools as possible methods, with the choice depending on platform configuration and organizational needs (NARA guidance).
Need the surrounding social record organized while you document message exports? SocialGuardian lists Instagram, TikTok, YouTube, X, Facebook, LinkedIn, Twitch, and Pinterest, and says it backs up media plus metadata. See the setup options
4. Preserve the original, context, and access record
Keep the original files as delivered. Do not overwrite them while making a readable working copy. Alongside the export, save a manifest containing:
- Platform, profile handle or URL, and custodian
- Scope requested and date range
- Request timestamp and download timestamp
- File names, formats, and archive-part count
- Included media or attachment setting
- Delivery-window and password-protection notes
- Missing categories, deleted-content warnings, or other limitations
- Storage location and the people or roles allowed to access it
This is the practical application of NARA's content, context, structure, and metadata standard (NARA guidance).
Screenshots can be a manual capture method, but the saved evidence does not establish a screenshot alone as a complete message record. Preserve the native export when available, keep the surrounding context, and label any manual capture as a method with a documented limitation rather than calling it complete by default.
SocialGuardian's documented product scope is the surrounding social content: its site says it automatically backs up posts, stories, and videos, includes media and metadata, and lets users export a full archive anytime. It does not provide evidence here for claiming that it exports private messages, so keep the message-export workflow above separate from that product description (SocialGuardian).
5. Verify completeness and unchanged files
Run this verification worksheet for every export:
- Compare the requested network, profile, categories, and date range with what was delivered.
- Count every archive part and attachment; record missing or unreadable files.
- Open the delivered HTML, JSON, or text output and confirm that it is readable.
- Check the manifest against the platform's stated delivery window and limitations.
- Record deleted-content warnings and changes-between-request-and-archive warnings.
- Preserve the original export separately from any review copy.
- Calculate a hash for each preserved file or archive and store the value in the manifest.
- Recalculate the hash when the file is reviewed or transferred, and investigate a changed value.
NIST defines a hash function as an algorithm that computes a numerical value representing a data file or electronic message and depending on the entire contents of that file or message (NIST hash function glossary). That makes a hash useful for checking whether a saved export changed; it does not answer whether the original export was complete.
The completeness check matters because Instagram says deleted information may not appear, Facebook says deleted information or content will not appear, and Google warns that changes made between requesting a download and creating an archive may be missing. Record each gap and escalate it instead of silently treating a partial export as complete (Instagram Help; Facebook data availability; Google Takeout).
6. Apply retention, access, and hold controls
Use the map from step 2 to apply the rule that actually governs the communication. Keep access limited to the people or roles recorded in the manifest, and preserve the reason for any exception or legal hold. The sources support the following governance checks:
- FINRA says the communication's business purpose matters, and its cited broker-dealer rule requires certain records to be preserved for at least three years, with the first two years easily accessible (FINRA Notice 11-39).
- HIPAA's cited Security Rule documentation requirement says to retain required documentation for six years from creation or from when it last was in effect, whichever is later (45 CFR 164.316).
- GDPR recital 39 says the storage period should be limited to a strict minimum and personal data handled with appropriate security and confidentiality (GDPR).
NARA recommends a social-media records working group that includes records-management, social-media, IT, privacy and information-security, counsel, and public-affairs staff (NARA guidance). Assign those functions—or their equivalents—to ownership, review, access, and escalation responsibilities. Apply the rule only after the responsible team and counsel confirm that it fits the data and jurisdiction.
7. Cross-platform message-preservation checklist
Copy this into your preservation ticket:
- List every network, profile handle or URL, custodian, and business purpose.
- Define the message categories and date range to preserve.
- Select the documented native export or another documented capture method.
- Record request time, delivery time, format, media setting, and delivery window.
- Preserve the original export and all archive parts and attachments.
- Preserve content, context, structure, and associated metadata.
- Record deleted-content, mobile-availability, own-data-only, text-only, or timing limitations.
- Open and review the delivered files.
- Calculate and store a hash for each original file or archive.
- Restrict access and record the access owner.
- Apply the confirmed retention rule and any hold.
- Escalate an incomplete export to the responsible records, security, privacy, or legal owner.
A compliance process needs both the message export record and the surrounding social-content record. Use SocialGuardian for its documented posts, stories, videos, media, metadata, and full-archive export, then keep your message-export manifest beside the relevant records. Get started
FAQ
What is the difference between backing up and archiving social media messages?
Use the export as the copy you preserve, then test it against content, context, structure, and metadata. A complete record may require additional capture when a provider cannot export the complete record; NARA says the organization remains responsible for implementing capture requirements (NARA guidance).
How do you export Instagram direct messages for compliance?
On desktop, use More > Settings > Meta Account > Your information and permissions > Export your information > Create export. Select the information, date range, format, notification email, and media quality. Record the four-day ready window, possible 30-day email wait, password protection, and deleted-information limitation (Instagram Help).
Can you download Facebook Messenger messages?
Facebook documents an account-information export in HTML or JSON via profile picture > Settings & privacy > Settings > Meta Account > Your information and permissions > Export your information > Create export. Review the delivered categories rather than assuming every historical message is present: Facebook says categories have different storage periods and deleted content will not appear (Facebook Help; Facebook data availability).
How do you export LinkedIn messages or account data?
On desktop, use Me > Settings & Privacy > Data Privacy > Download your data. LinkedIn says specific categories may arrive within minutes, a larger download within 24 hours, and the link remains available for 72 hours. The feature is not available on mobile and provides the requesting member's own data, not other members' data (LinkedIn Help).
Can WhatsApp chats be exported for legal or compliance purposes?
On Android, open the chat, choose More options > More > Export chat, select Without media or Include media, and choose a sharing method. WhatsApp says the result is a text file, not a re-importable backup; including media adds the most recent media sent as attachments (WhatsApp Help). Preserve the export and its limitations in the manifest.
Does TikTok let you download direct messages and account data?
This evidence pack does not establish a TikTok export path or direct-message coverage. Do not infer one from another platform. Check TikTok's current documentation and record the method and limits; NARA also lists APIs, web capture, manual methods, and platform export tools as possible capture methods (NARA guidance).
Are screenshots enough, and what metadata should be preserved?
The saved evidence identifies manual methods as one possible capture method but does not establish screenshots alone as a complete record. Preserve the native export when available and retain content, context, structure, and associated metadata such as author and creation date (NARA guidance).
How long should messages be retained, and how do you verify a backup?
Apply the rule confirmed for the communication. The cited examples include at least three years for certain FINRA broker-dealer records, six years for required HIPAA documentation, and GDPR's strict-minimum storage principle. To verify the backup, compare scope with delivered files, record platform limitations, preserve originals, and store hashes; NIST says a hash depends on the entire file or message contents (FINRA Notice 11-39; 45 CFR 164.316; GDPR; NIST hash function glossary).
