Spoliation of Search Data

What the rule requires — and what no court has yet decided

Rule 37(e) governs the loss of electronically stored information. As amended in 2015 it provides that if ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court (1) upon finding prejudice, may order measures no greater than necessary to cure it; or (2) only upon finding that the party acted with the intent to deprive another party of the information's use, may presume the lost information was unfavorable, so instruct the jury, or dismiss the action or enter default. The text is on Cornell's copy of Rule 37.

Four things must be true before a court reaches either subsection: the information must be ESI that should have been preserved; it must be lost; the loss must follow a failure to take reasonable steps; and it must not be restorable through additional discovery. The 2015 committee notes add that the duty arises when litigation is reasonably foreseeable, that the rule creates no new preservation duty, and that (e)(2) requires intent, rejecting negligence because negligently lost information could have favored either side.

Now the disclosure that comes before the analysis. I searched for reported decisions applying Rule 37(e) to analytics data, Search Console data, log rotation, disavow files, rank-tracking histories, and site content removed or rewritten after a demand letter. I did not find one. General Rule 37(e) case law is abundant; none of it concerns search data. Everything below is analysis drawn from the rule text and the technology, not from what courts have held.

Why the most probative evidence expires on a timer

Search evidence deletes itself on a schedule, by ordinary design.

• Google Search Console — the reporting property for a verified site, recording the queries, impressions, clicks, and average positions Google logged for it — holds sixteen months of performance data on a rolling basis, and the window moves forward every day.
• Analytics platforms purge event-level detail on a configurable retention setting. What that window is set to in a given matter is a question of fact, established from the property's own configuration. Do not assume a figure; check it.
• Raw server access logs — the line-per-request record of which client requested which URL, when, and what status code came back — are commonly rotated on thirty to ninety day cycles, and CDN logs are shorter.
• Rank-tracking histories live inside a subscription and lapse with the account.

None of that involves anyone deciding to destroy anything, and that is the difficulty. In most spoliation disputes the argument is about conduct. Here the default outcome, with no conduct at all, is that the most probative record expires on its own.

When the duty attaches, and what “reasonable steps” must reach

The trigger is reasonable foreseeability, not filing. In a search dispute that is usually a demand letter, a delisting request, a preservation letter, or a termination heading toward a claim.

Preservation is hard here because an ordinary hold instruction touches none of the relevant systems. A standard hold tells custodians to stop deleting documents and suspends automatic email deletion. Nobody's mailbox holds Search Console data. Preserving search evidence requires an affirmative export from the verified property, a change to an analytics retention setting, an instruction to the server and CDN administrators to halt rotation, and a decision to keep a third-party subscription alive. Four systems, four administrators, three vendors.

Whether letting a default retention setting run past the trigger date is a failure to take reasonable steps is unresolved. The committee notes treat routine, good-faith operation of an information system as relevant, favoring the party that did nothing unusual. But the rule asks what steps were taken once the duty attached, and clicking a setting is not burdensome.

One pre-amendment decision is worth knowing, with its limits stated. In Healthcare Advocates, Inc. v. Harding, Earley, Follmer & Frailey, 2007 WL 2085358 (E.D. Pa. July 20, 2007), the court declined to sanction over temporary cache files automatically created when defense counsel viewed archived pages of the plaintiff's website, finding very little fault and that the files were automatically deleted. It predates the 2015 amendment and is not a Rule 37(e) case, but its reasoning about non-deliberate deletion cuts against any theory built on routine expiry.

“Cannot be restored or replaced” is where an expert does the work

The fourth element is a threshold, and here it is contestable in a way it usually is not, because much search data has partial substitutes held by third parties.

• Archive snapshots partially replace lost page content, subject to what a crawler captured and when; the gaps between snapshots are themselves a disclosable fact.
• Third-party link indexes partially replace a lost record of inbound links, with coverage limits and first-seen dates that estimate when a link appeared rather than observe it.
• Third-party rank indexes partially replace ranking history, but they are estimates from proprietary panels and fixed keyword sets, not a record of what the site was shown.
• Bing Webmaster Tools partially replaces Search Console, for a different engine and index; ad platform reporting partially replaces analytics, for paid traffic only.
• Server logs and analytics partially replace each other and substitute for neither, counting different events: server requests against script-observed sessions.

Every one is partial, and the word doing the work in the rule is cannot. Whether a partial substitute is a replacement, or merely evidence that something similar once existed, is a technical assessment before it is a legal one: how the source is built, what it covers, at what granularity, and whether the case's question can be answered from it. That assessment decides whether any sanction is available at all. The honest answer is usually mixed, and a confident blanket answer means nobody did the work.

Remediation and destruction are frequently the same act

Here is the sharpest fact pattern in this area. A party receives a demand letter about something on its website. Within days the pages come down; the anchor text — the visible clickable words of a link, which tell a search engine what the target page is about — is rewritten; the disputed inbound links go into a disavow file, the list a site owner submits asking Google to ignore specified links; and the URLs are 301-redirected, permanently sending users and search engines from an old URL to a new one.

Each is defensible as remediation and each destroys the evidence of the condition complained of. A 301 does not merely hide the old page: the old URL stops returning its content, and search engines consolidate it into the target. Removing a page removes the thing the case is about, and rewriting anchor text destroys the text whose wording is the disputed fact.

So the question on a sanctions motion is almost never whether the site changed. It did. The question is what changed, when, in what order, and in what relationship to the letter. Reconstructing that sequence is forensic work: archive snapshots with exact capture timestamps rather than approximate months, third-party index first-seen and last-seen dates, the site's deployment history, server logs showing when a URL began returning a redirect or a 404, and the disavow file's upload history. Changes that began before the letter and continued at the same rate describe a maintenance program; changes that began within hours of it and targeted exactly the material it identified describe something else.

Intent, prejudice, and the limit on what a reconstruction shows

Under Rule 37(e)(2) the severe measures — the presumption, the adverse-inference instruction, dismissal, default — are available only on a finding that the party acted with intent to deprive another party of the information's use. Negligence does not reach it.

A technical reconstruction can establish what existed, what changed, when, in what order, whether the change was targeted or general, and whether any step has no maintenance rationale. What it cannot establish is intent, an inference for the finder of fact. That is the line an expert has to hold, and it is the reliability line as well. An opinion that the defendant removed pages in order to destroy evidence has left the discipline the witness is qualified in. An opinion that forty URLs, every one identified in the letter of 3 March, began returning 301 redirects between 4 and 6 March while twelve thousand others were unchanged, is a finding.

Most practical activity here is likely to fall under subsection (1) rather than (2), because the ordinary case is data that expired on a timer while nobody was watching. Cures under (1) are bounded by the rule's words — no greater than necessary — and the plausible ones are concrete: evidence from a substitute source, expert testimony to a reconstruction with its stated limits, preclusion of the losing party from disputing what the substitute shows, or discovery of what it still holds. That last is worth pressing, because marketing reports, agency dashboards, and board decks routinely contain numbers long expired out of the source system, and they live in no system anyone thought to hold.

What preservation looks like when it happens in time

What follows is not advice about the scope of anyone's duty, which is for counsel. It is the technical order of operations once search evidence must be preserved, sequenced by how fast each source goes:

1. Export Search Console performance data immediately, at query and page level, for every property and verified variant, and record the export date. The oldest month you can retrieve today is the oldest you will ever have.
2. Check the analytics retention configuration, record and capture what it is set to, and extend it before assuming what remains.
3. Stop log rotation or divert logs to retained storage, on the origin servers and the CDN separately, and confirm it was implemented, not merely requested.
4. Preserve the site as it stands, by crawl and by forensic capture, before anybody begins remediating.
5. Keep third-party tool subscriptions alive. Rank and link histories die with the account, and the renewal date is on nobody's calendar.
6. Collect the derivative reports — dashboards, monthly decks, exports made for other purposes — often the only surviving form of anything outside the windows above.

The reason this belongs on a page about spoliation is timing. The distance between clean preservation and a contested sanctions motion is usually weeks, and the clock starts at the demand letter, not the complaint. Nobody hears it running.

Frequently Asked Questions

Published 2026-08-11