Slack, Teams and Ephemeral Messaging in Discovery

How collaboration platform data breaks email-era discovery

Slack, Microsoft Teams, Google Chat and ephemeral apps such as Signal store and delete messages on terms email never imposed. Retention is often set per conversation or per custodian rather than per organization, threaded replies have no stable document boundary, linked files are pointers rather than attachments, and default settings can destroy messages within 24 hours. An ESI protocol written for email does not make the decisions this data requires.

Retention is configured below the organization — sometimes by the custodian

On Slack's paid plans, data is kept for the lifetime of the workspace by default, and a Workspace Owner can instead set a custom timeline after which messages are deleted. Slack also offers member overrides, which let members on paid plans set their own message retention period for private channels and their DM conversations. Whether edits are captured is a separate switch: a workspace chooses between settings that keep all messages and track message edits and deletions, and settings that keep all messages but do not track them.

Google Chat works the other way around. An administrator sets an organization default for history on or off and may permit users to change it per conversation. When history is off, messages are deleted after 24 hours — and Google's administrator documentation states that Vault cannot hold, retain, or search direct messages sent with history turned off. That setting governs direct and group messages; spaces carry their own history configuration. So a hold applied across a Google Workspace tenant does not reach a direct message the participants took off the record.

So the first custodian question is not "do you use Slack," but which conversations carry non-default retention, who changed it, and when. Request the settings-change history as a document.

What the Google Play chat-preservation findings actually decided

In In re Google Play Store Antitrust Litigation, 664 F. Supp. 3d 981 (N.D. Cal. 2023), Judge James Donato issued findings of fact and conclusions of law on chat preservation after a two-day evidentiary hearing held in January 2023. The factual record describes an auto-deletion architecture many enterprises share.

The court found that Chat history was off by default for all chats among Google employees except threaded rooms; that one-on-one chats with history off were retained for 24 hours and then "deleted forever" and could not be recovered; that one-on-one chats with history on lasted 30 days; and that history-on group and non-threaded-room chats, along with all threaded-room chats, lasted 18 months. It further found that Google had the technical ability to set Chat history to "on" as the default for all employees subject to a legal hold and chose not to, left each hold recipient to decide which chats to preserve, and did no auditing or monitoring of whether they did.

The comparison the court drew is the operative one: when a litigation hold was in place, Google automatically preserved all emails from relevant custodians without any individual action, and custodians could not override that automated preservation — while Chat was delegated. The court concluded that Google did not take reasonable steps to preserve ESI under Rule 37(e), that the lost chats could not be restored or replaced through additional discovery, and that Google acted with the intent required by Rule 37(e)(2) — describing the approach as a "don't ask, don't tell" policy for Chat preservation. On remedy, the court noted that it had already declined to issue terminating sanctions, held it appropriate for Google to cover plaintiffs' reasonable attorneys' fees and costs in bringing the Rule 37 motion, and deferred the appropriate non-monetary sanction pending further proceedings, wanting to see the state of the evidence at the close of fact discovery. The finding of intent came first; the remedy waited for a record of what was lost.

Ephemeral messaging: the mechanism proves faster than the scope

The same split appears in Federal Trade Commission v. Amazon.com, Inc., No. 2:23-cv-01495-JHC (W.D. Wash.), where Judge John H. Chun issued an order on April 29, 2026, later unsealed, addressing both raw notes destroyed from business meetings and messages sent with Signal's disappearing-messages feature.

The court found that plaintiffs had shown by a preponderance that Amazon failed to preserve at least some ESI it had a duty to preserve; that the ESI was lost because Amazon failed to take reasonable steps; and that it could not be restored or replaced through additional discovery. On reasonableness, the court held it was unreasonable for Amazon both to direct employees to "delete/shred" raw meeting notes instead of implementing a full litigation hold and to allow executives to continue sending disappearing messages on Signal after learning of the action — and that Amazon's general preservation efforts did not negate either failing. Quoting United States v. Google LLC, 747 F. Supp. 3d 1, 187 (D.D.C. 2024), the order records that "[a]ny company that puts the onus on its employees to identify and preserve relevant evidence does so at its own peril."

The court went further and held that plaintiffs had met their burden of showing that curative sanctions were warranted under Rule 37(e), and that plaintiffs had made a strong showing that Amazon willfully destroyed at least some evidence to avoid its discovery obligations. It nonetheless denied sanctions under Rule 37(e)(1) and Rule 37(e)(2) at that stage: because it was unclear what comprised the universe of spoliated evidence, the court could not determine what measures would be "no greater than necessary to cure the prejudice," and on the same record could not find the specific intent Rule 37(e)(2) demands. Both denials came with leave to take further discovery into the extent of the spoliation and to renew afterwards. The same order denied Amazon's Rule 53 motion to appoint a special master for want of "clear need" — a reminder that routing a discovery fight to a special master is not automatic even in litigation of that size.

The lesson is procedural rather than a defence verdict: prove the deletion mechanism and the failure of reasonable steps first, take discovery on scope, then ask for a remedy calibrated to what the record shows was lost. And the duty attaches when litigation is reasonably anticipated — in the Google Play MDL the court fixed it at the filing of the first constituent suit. A company's preservation obligations exist irrespective of whether it communicated those obligations to the employees who did the deleting, and they can arise before any preservation letter goes out.

"Put Teams on hold" is not one instruction

A note on sources before the mechanics. Microsoft retired its classic eDiscovery experiences on August 31, 2025, and the Purview articles that document Teams content locations and conversation transcripts in the detail below now state that they apply only to organizations hosted by 21Vianet in China. The architecture they describe is still the clearest published account of how Teams compliance records are distributed, and it is the right map for drafting a preservation demand — but confirm the specific mechanics against the current eDiscovery experience in the Purview portal before relying on them in a protocol.

On that documentation, Teams content is not stored in one place. Messages in 1:1 and group chats sit in the Exchange Online mailbox of every participant. Standard channel messages sit in the mailbox associated with the team. Private channel messages sit in the mailboxes of all members of that private channel. Shared channel messages sit in a system mailbox associated with the shared channel, which cannot be searched on its own — preservation has to run against the parent team's mailbox.

Files follow a different map: files shared in 1:1 and group chats live in the OneDrive of the person who shared them, files in a standard channel live in the team's SharePoint site, and files in private and shared channels live in a dedicated SharePoint site for that channel. Meeting recordings live in the OneDrive of the meeting organizer or initiator, depending on the tenant's recording-ownership configuration — so identify which account owns the recording rather than assuming.

A preservation demand that says "Microsoft Teams" therefore leaves four categories of location unnamed: the custodian mailboxes, the custodian OneDrive accounts, the team mailboxes, and the SharePoint sites for each private and shared channel the custodians belong to.

Message families, and what counts as one document

Chat has no envelope, so the platforms invent one. In Purview, Teams messages are reconstructed into HTML transcript files: a transcript and its attachments share a FamilyId. For 1:1 and group chats, every transcript from the same conversation — including each custodian's copy and later delta collections — shares a ConversationId; for channel chats, each post and its replies carry their own. Because copies of a 1:1 or group chat exist in each participant's mailbox with different metadata, each copy arrives as its own transcript rather than deduplicating away.

Transcript boundaries are set by the query that found the message: for 1:1 and group chats, a keyword query pulls in messages posted 12 hours before and after each responsive item, while a date-range-only query groups a 24-hour window. For channel chats, the responsive post and all its replies are grouped. A ContainsEditedMessage property flags transcripts holding an edit.

Slack's standard export makes the opposite choice: it "will not differentiate between messages in a thread and messages sent to a channel," so threaded replies appear inline in the conversation. Channels, users and conversations appear as alphanumeric IDs that must be joined against channels.json, groups.json, dms.json and users.json before a reviewer can read them.

Agree, at the Rule 26(f) conference, on the unit of production — a message, a day of a channel, or a threaded conversation — and on which field carries the grouping key. Rule 26(f)(3)(C) requires the discovery plan to address any issues about disclosure, discovery or preservation of ESI, including the form or forms in which it should be produced, and Rule 16(b)(3)(B)(iii) lets the court put that in the scheduling order.

The export you can get depends on the other side's licence tier

Slack's standard export covers messages and file links from public channels on every plan. An export that also includes private channels and direct messages requires Business+ or Enterprise; on Business+, a Workspace Owner has to apply for access to the self-serve export tool, while Enterprise has access to custom exports covering all conversation types. Exports arrive as JSON and contain file links, not files. On the Microsoft side, conversation threading, support for cloud attachments and SharePoint versions, review sets and analytics are listed as premium eDiscovery capabilities rather than capabilities of the base feature set — so a tenant without that licensing cannot natively produce threaded conversations or resolved linked files.

Confirm the tier before drafting: a Pro-plan tenant cannot produce direct messages natively.

Under Rule 34(b)(1)(C) the requesting party may specify the form of production; under Rule 34(b)(2)(D) the responding party may object to a requested form and must then state the form or forms it intends to use; and under Rule 34(b)(2)(E)(ii), absent a specified form, ESI comes in a form in which it is ordinarily maintained or a reasonably usable form. Rule 34(b)(2)(E)(iii) adds that a party "need not produce the same electronically stored information in more than one form" — which is why the specification has to be right the first time, though the whole of Rule 34(b)(2)(E) applies only "[u]nless otherwise stipulated or ordered by the court," so a negotiated protocol or a court order can reopen what a bare request cannot. Rule 45(a)(1)(C) and Rule 45(e)(1)(B)–(C) apply the same structure to non-party subpoenas. Specify the time zone as well: Purview presents Teams conversation dates in Coordinated Universal Time.

Reactions, edits and linked files have to be asked for by name

Reactions carry meaning — an emoji approval is an act — but they are conditional data. Microsoft's documentation states that reactions are supported for eDiscovery for commercial customers after June 1, 2022, that reactions before that date are not available for eDiscovery, and that content must be on legal hold to understand reaction history. Previous versions of edited Teams messages are likewise preserved only if the user is on hold. In Slack, whether edits are retained depends on the retention setting; an export shows an edited field, and a deleted message may carry a previous field holding the original text, but only where retention allowed it. A cloud attachment, meanwhile, is a URL — the file behind it can change or be deleted after the message was sent. Ask for the target file, the version as of the message date, and the reaction and edit history as separate deliverables.

Two protections belong in the protocol. Because chat volume is large and lawyers often sit in the same channels as business custodians, seek an order under Federal Rule of Evidence 502(d), under which a federal court may order that privilege or work-product protection is not waived by disclosure connected with the litigation before it, with that non-waiver effective in any other federal or state proceeding. The court's order is what carries that reach: under Rule 502(e) a bare agreement between the parties binds only the parties unless it is incorporated into a court order, and Rule 16(b)(3)(B)(iv) lets the scheduling order take in the parties' Rule 502 agreements along with the timing and method for complying with Rule 26(b)(5)(A).

Then ask for the certifications contemplated by Federal Rule of Evidence 902(13), for records generated by an electronic process or system that produces an accurate result, and 902(14), for data copied from a device, storage medium or file and authenticated by a process of digital identification. Both require a certification meeting Rule 902(11) or (12), which carries its own condition: the proponent must give the adverse party reasonable written notice of the intent to offer the record and make the record and certification available for inspection in advance. Build that notice into the protocol's deadlines — it is the same discipline that applies to authenticating social media evidence and to reading a forensic report.

Proportionality arguments need numbers

Rule 26(b)(1) limits discovery to what is relevant to a claim or defense and proportional to the needs of the case, weighing the importance of the issues at stake, the amount in controversy, the parties' relative access to relevant information, their resources, the importance of the discovery in resolving the issues, and whether the burden or expense outweighs the likely benefit. Rule 26(b)(2)(B) lets a party decline discovery from sources it identifies as not reasonably accessible because of undue burden or cost, but on a motion to compel or for a protective order it puts the burden of showing inaccessibility on the responding party.

Chat burden assertions frequently fail on that record. In the Google Play proceedings the court found that Google's information governance lead, asked about storage, was not aware of any analysis or study of how expensive or burdensome it would be to preserve chats, even for that case alone. A burden objection should arrive with a cost estimate, a volume count and a description of the collection path — and where the real objection is review cost, technology-assisted and generative review workflows belong in the conversation rather than excusing the source.

Learn more

• Katherine Charonko — Partner and ESI Practice Group Leader, Bailey & Glasser
• David Shonka — Partner and General Counsel, Redgrave LLP; three-time Acting General Counsel of the FTC
• Gail Gottehrer — Vice President for Global Litigation, Labor & Employment Law, and Government Relations, Fresh Del Monte Produce, Inc.
• James Orenstein — JAMS neutral; former U.S. Magistrate Judge, E.D.N.Y.
• Gregory M. Sleet — JAMS neutral; twenty years on the U.S. District Court, D. Del.

This article is general information about discovery practice, not legal advice; consult counsel about a specific matter. The rulings discussed are district-court discovery orders, which bind no other court.