Principles for Social Media Use by Law Enforcement

Social media is a powerful tool for connection and civic involvement, serving myriad purposes. It facilitates community-building, connecting like-minded people and fostering alliance development, including on sensitive or controversial topics; it helps grassroots movements find financial and other support; it promotes political education; it assists civic organizations in organizing and magnifying the reach of offline efforts; it elevates nonmainstream narratives; it encourages artistic expression; and more.¹

Users of color benefit especially from social media’s wide-ranging applications. Black and Hispanic users of X (formerly Twitter) have leveraged that platform to spur political engagement and give voice to underrepresented groups.² College students of color have used social media to share stories about inequitable or traumatic treatment at predominantly white colleges and universities.³ And “Black Twitter” in particular has a record of pushing the national media to cover overlooked stories.⁴ Research shows that young people of color are the demographic group most likely to turn to social media both to consume news and to amplify their own political involvement.⁵ As the Supreme Court has recognized, online platforms “can provide perhaps the most powerful mechanisms available to a private citizen to make his or her voice heard.”⁶

This far-reaching use makes social media an attractive source of information and intelligence for law enforcement. Officers can easily view publicly available information online and follow individuals and hashtags, often without even needing an account. They can also create undercover accounts to join online groups, monitor activity anonymously, or connect directly with individuals — with the attendant risks described below. Social media can provide evidence of criminal activity, from white-collar crime to inciting violence to drug and firearm offenses. It can also be used to commit crimes, such as stalking, harassment, and child sexual exploitation. ⁷

Many law enforcement agencies contract with software vendors that offer proprietary, opaque computer algorithms to collect and analyze massive amounts of data. These algorithms supply agencies with running reports of social media posts on topics, groups, and individuals of interest, allowing law enforcement to analyze associations, and even discern viewpoints. Such tools facilitate the monitoring, collection, and analysis of data far more quickly and cheaply than any individual officer could accomplish, implicating the Supreme Court’s recognition that a “central aim” of the Constitution’s drafters was “to place obstacles in the way of a too permeating police surveillance.”⁸

In some circumstances, targeted social media use can be both appropriate and productive. As the Brennan Center has noted in the context of the FBI, “public social media posts that express specific and credible threats, when brought to the FBI’s attention, can by themselves be all the evidence necessary to justify opening a preliminary or full investigation, as would any other source of information indicating that a crime is taking place or in the works. Likewise, once the FBI opens a properly predicated investigation, agents may logically conclude that monitoring and recording public or private social media posts would be a fruitful investigative step to gather the evidence necessary for a prosecution.”⁹

When there are no less intrusive means available and when its use is properly limited and narrowly scoped, social media can also help augment preparation for public events, as set out below.

But unbounded social media use by law enforcement can cause considerable harm. As the White House Office of Science and Technology Policy recently recognized, “unchecked social media data collection has been used to threaten people’s opportunities, undermine their privacy, or pervasively track their activity — often without their knowledge or consent.”¹⁰ These threats include incursions into constitutionally protected speech and association, disproportionate focus on and repercussions for marginalized communities, and overcollection of irrelevant information. The Department of Justice has advised that even publicly available social media data should not be collected or used indiscriminately by law enforcement.¹¹

Moreover, although the issue is understudied, little empirical evidence supports the value of broadscale social media monitoring,¹² and government officials have expressed skepticism about the efficacy of the practice. A 2021 internal review by the Department of Homeland Security Office of the General Counsel, for instance, observed that agents trying to predict threats by collecting social media and other open-source data often instead gathered information on “a broad range of general threats,” ultimately yielding “information of limited value” that included “memes, hyperbole, statements on political organizations and other protected First Amendment speech.”¹³

This explainer sets out the major risks inherent to law enforcement’s use of social media and then outlines proposed best practices. It aims to contribute to the development of policies that clarify and build appropriate guardrails around social media use by law enforcement.

Suppression of First Amendment–Protected Activities

Law enforcement officers routinely monitor hashtags, event pages, location data, and other information on social media ahead of public gatherings and political protests to glean information, follow organizers and participants, and develop response plans.¹ Some social media monitoring companies tout their ability to create revealing maps of individuals’ online networks, which implicates the right to freedom of association. It also raises questions about the extent to which a person’s ideology can be ascertained via their online presence.² Concerningly, police have even used social media to compile profiles based on First Amendment–protected activities and share them among local, state, and federal agen­cies — increasing the risk that protesters will later face retaliatory targeting.³

Police in Memphis, Tennessee, for instance, created dossiers on local activists in 2015 and 2016 and shared them with the city council and multiple law enforcement agencies, violating a federal consent decree prohibiting infringement on First Amendment activities.⁴ And in 2022, a social media monitoring vendor under contract with the Los Angeles Police Department (LAPD) alerted the department about a small community education event focused on LAPD’s own online surveillance.⁵ With no legitimate indication that the event or its attendees posed any threat to public order, the LAPD nevertheless included the event (in which the Brennan Center participated) in internal reports disseminated to several of its divisions.

When police target individuals for surveillance because of their political viewpoints, people may choose to censor their online activity and associations to reduce the risk of govern­mental monit­or­ing.⁶ Research bears this out: one study showed that people are less willing to share non-majority views online when reminded that the government monitors these activities.⁷ Remarkably, this effect was actually more prominent among people who thought they had nothing to hide.

This chilling effect undermines social media’s ability to serve as the new public square and weakens civic connections, particularly for those groups most likely to be targeted online. One environmental activist who had been targeted by police due in part to her online activity described it thus: “Once I realized we were being surveilled and information was being used against us in different ways, I stopped sharing and making these kinds of posts. . . . It made me think, am I safe to share things publicly? Photos of my children? Life events? Political beliefs?”⁸

Facilitation and Magnification of Bias in Policing

Racial and ethnic bias in policing, a well-recognized phenomenon, seeps into online monitoring as well. Documented examples abound of police using social media to target activists of color and groups seeking racial justice. The Boston Police Department, for example, enlisted a social media monitoring tool to track mentions of the terms Black Lives Matter and Muslim Lives Matter, among others.⁹ Similarly, the LAPD employed an online surveillance tool to monitor hashtags such as #BlackLivesMatter and #SayHerName, along with tweets about victims of police killings, including Sandra Bland and Tamir Rice.¹⁰ And during the 2020 racial justice demonstrations following the deaths of George Floyd and Breonna Taylor, law enforcement agencies around the country turned to a tool from the artificial intelligence (AI) surveillance company Dataminr to monitor protestors through their social media activity.¹¹

When it comes to police surveillance, what happens online does not always stay online. The Fresno Police Department in California has used a tool called Beware that captures social media data to help calculate individuals’ “threat scores” and shared that information with operators dispatching officers on calls, posing the risk that officers might arrive ready to shoot or with a SWAT team in tow if social media inaccurately flagged someone as a threat.¹²

Images and other data gleaned from social media also feed the sweeping reach of gang databases, ¹³which typically consist almost entirely of individuals of color and are plagued with inaccuracies, as reported by oversight offices in multiple big-city police departments.¹⁴ According to an April 2023 report released by the New York City Police Department (NYPD) inspector general, individuals can be added to the NYPD’s gang database based solely on social media content when it amounts to “self-admission” of one’s membership to a gang.¹⁵ “Self-admission” is broadly defined to include “an individual’s use of language, symbols, pictures, or colors associated with a criminal group.”¹⁶ Being photographed with a known gang member — even in a context has nothing to do with gang activity — or the use of a specific emoji is sufficient. And inclusion in a gang database has real consequences. Individuals listed as gang members may face increased bail and police escalation of routine traffic stops.¹⁷ Men of color experience these harms most acutely: 99 percent of individuals included in the NYPD’s gang database are Black or Latino; Black men comprise the vast majority.¹⁸ Furthermore, online surveillance can reinforce policing biases even when the police themselves are not doing the monitoring. Dataminr employees have reported that online searches for gang members and gang-related activities to include in the company’s news alert service for police and other public-sector clients focused predominantly on users of color, reflecting their perceptions of both the company’s orders and law enforcement’s appetite for “threat fodder.”¹⁹

Political inclinations also affect how law enforcement officers view online activity. Numerous online posts suggested that violence would occur at the U.S. Capitol on January 6, 2021, yet law enforcement seemed to minimize the threat, failing to take the threat seriously enough to plan for an attack.²⁰ Instead, in the months leading up to the attack, federal law enforcement focused on framing racial justice protests as being instigated by antifa (or anti-fascists), in line with the Donald Trump administration’s messaging and reflecting prevalent law enforcement sympathies.²¹ This history suggests that even if widespread social media surveillance were effective in flagging threats, neither its use nor its application will be equitable.

Difficulty Accurately Interpreting Posts

Accurately assessing the meanings of posts, pictures, music, videos, and other forms of expression and communication on social media is notoriously challenging. Individuals use in-group slang, and both law enforcement personnel and algorithmic tools may fail to recognize sarcasm, satire, or hyperbole. Trying to interpret posts by young people, who often use memes and pop culture references that may be inscrutable to outsiders, can intensify these challenges. This effect is likely to be heightened for young people of color and immigrant youths, who are more heavily policed and more susceptible to inaccurate or biased presumptions that gestures, clothing, and other characteristics viewed online indicate gang activity or other criminal behavior.²²

Critically, police and others in positions of authority may be more apt to perceive a social media post as dangerous based on the speaker or their viewpoint. For example, police in Kansas arrested a Black teenager in 2020 on charges that he had contributed to inciting a riot through a Snapchat post; in fact, his post denounced violence rumored to be coming toward his hometown.²³ In another instance, the former head of the civil rights division at the Oregon Department of Justice was wrongly identified as a threat — and was ultimately forced out of his job — because he tweeted graphics from a popular Public Enemy album that police misinterpreted as menacing.²⁴ That tweet and others were discovered and flagged for DOJ officials by an investigator using a digital surveillance tool trained to look for social media mentions of “Black Lives Matter” and “KKK,” among other terms.

Misleading Inferences

A person’s social media connections can reflect everything from close relationships to passing acquaintanceships. An outside observer may struggle to accurately interpret the strength or depth of those associations. People may feel social pressure to connect with family members, colleagues, professional acquaintances, or classmates online, and they may feel compelled to interact with their connections by commenting on or liking a post whether or not a relationship is remote. These dynamics make it particularly fraught to ascribe criminal intent or activity to an individual based on online linkages, which may be superficial or, even if they do reflect an actual relationship, may not signify participation in illegal activity.

The presumption that online proximity necessarily reflects a real-life affiliation can have tragic consequences, especially for young people of color. In one example, a Black New York City teen spent more than a year at the Rikers Island correctional facility, much of it in solitary confinement, based largely on the district attorney’s assessment that he was a member of a criminal gang.²⁵ The district attorney relied on Facebook photos of the teen with members of a local crew (a group of young people, typically young men, loosely affiliated by block or housing development) and several posts from crew members that he had liked. In fact, the teen was simply connected to crew members because they were his neighbors and family members.²⁶

Also troubling is the law enforcement practice of feeding pictures drawn from social media into facial recognition programs to generate leads and identify possible subjects. These algorithms have a documented history of performing less accurately on people with darker skin, and women of color in particular.²⁷ At least six people in four states (Georgia, Maryland, Michigan, and New Jersey) are known to have been wrongfully arrested because they were misidentified by facial recognition software. Five of them were Black men; one was a Black woman.²⁸

Social media can even be used for misdirection, further undermining its ostensible utility for law enforcement. In one such instance, a young man posted multiple photos of himself in different locations holding a pistol to convey the impression that he was ready for a violent confrontation. In reality, the man took the photos in a single afternoon with a borrowed gun and posted them over time to suggest that he typically had the weapon with him. He told a sociologist conducting fieldwork in his neighborhood that he did not carry the weapon around, let alone plan to use it; he simply wanted people to assume that he was armed to feel more secure in public.²⁹ The same sociologist, Stanford University professor Forrest Stuart, has documented the ways in which Black youths who drive Chicago’s drill music culture promote a tough and sometimes violent image online that, by design, often vastly overstates the actual levels of violence in their daily lives.³⁰

When lies reinforce existing biases, the risk that law enforcement or intelligence agencies will be duped into acting on fake posts is amplified. In 2020, the Maine fusion center disseminated FBI and DHS reports to local law enforcement agencies warning of potential violence at anti–police brutality demonstrations. These warnings turned out to be based on fake social media posts by right-wing provocateurs.³¹

Unreliability of Automated Digital Surveillance Tools

Many third-party social media surveillance tools utilize keyword lists to flag threats for law enforcement. Yet these tools struggle to account for variables like tone, speaker, and context.³² Automated programs may simply report all posts containing flagged words, leading to piles of irrelevant reports. Police in Jacksonville, Florida, learned that rather than uncovering early threat indicators, flagging the word bomb elicited posts describing first-rate pizza or beer as “the bomb.”³³ School officials who have purchased monitoring software to scour students’ social media accounts have ultimately found that those tools offered insufficient value as well.³⁴ Notably, these kinds of products also violate the major platforms’ policies, which prohibit developers from using their data for surveillance purposes.³⁵

Moreover, natural language processing tools that are trained in one language can have trouble accurately interpreting other ones.³⁶ In one example, Israeli police held and questioned a man who had posted the greeting “good morning” in Arabic; an automated tool mistranslated it into Hebrew as “attack them.”³⁷ This bias can also surface when a system attempts to understand dialects for which training data was lacking. A 2017 study of natural language processing tools found that they miscategorized African American Vernacular English (AAVE) as non-English. One system incorrectly identified it as Danish with 99.9 percent confidence.³⁸ A more recent study demonstrated that even some of the more sophisticated large language models can falter considerably in many non-English languages.³⁹

Undercover Accounts Ripe for Misuse

Finally, the use of undercover accounts or false identities on social media presents particular opportunities for mischief and privacy intrusions. Alias identities can be used to trick people into accepting connections they would not have permitted in real life, allowing law enforcement officers to see a wealth of information that they would not otherwise be privy to — including posts, pictures, and information about friends and family members — and even exchange and view private communications. In-person covert activity raises these same concerns but comes with built-in limitations: an officer interacting in person cannot easily pretend to be a target’s childhood best friend, or someone of a different race or ethnicity, or multiple people. None of these limitations applies to online covert activity.

The relative ease of purporting to be more than one person online implicates the Supreme Court’s growing recognition that effortless surveillance may “alter the relationship between citizen and government in a way that is inimical to democratic society.”⁴⁰ Technological tools can populate fake accounts with a sufficient range of interests and connections to look legitimate. Some digital monitoring companies even create fake accounts in bulk, using them to scrape millions of data points from public social media accounts. This practice violates Facebook’s and Instagram’s policies, but as long as the surveillance companies evade detection, police departments can buy licenses to use these products to gather information on individuals and groups anonymously.⁴¹

At the same time, while many police departments have public-facing policies permitting personnel to use covert accounts in at least some circumstances, only a fraction of those policies incorporate baseline limitations on online undercover activity — such as requirements that accounts be used only when reasonable articulable suspicion of a crime exists or that they be subject to regular supervisory review — let alone the more robust restraints set out below.⁴² These loose controls have led to abuses: the Memphis Police Department used an undercover Facebook account to target racial justice activists,⁴³ and the NAACP sued the city of Minneapolis for alleged discriminatory use of undercover social media accounts to target activists of color.⁴⁴ The lawsuit resulted in a consent decree between the city and the Minnesota Department of Human Rights that contains new procedural and oversight mechanisms for undercover account use.⁴⁵

Also worth noting is that use of a false name directly violates Facebook’s terms of service. The company’s head of civil rights has emphasized that there is no exception to this policy for the police, and it has sent sharp letters of rebuke to both the Memphis and Los Angeles police departments, And Meta filed suit in 2022 against a company that uses fake accounts to scrape data from Facebook users and has advertised its services to the government.⁴⁶

Social media is here to stay, and no configuration of legal and policy safeguards will eliminate the possibility of harm or misuse. Circumstances will arise in which investigating a crime or ensuring public safety necessitates using social media to view or gather information. At a minimum, police agencies should have a legitimate law enforcement purpose to monitor or collect social media data, although that requirement alone would still risk permitting far too much online information gathering with too few guardrails.

Accordingly, and given the harms articulated above, local, regional, and state law enforcement agencies that use social media for investigative and other purposes should develop and implement policies and practices consistent with the recommendations outlined below. These policies should include substantial mechanisms for input from community members and experts in privacy, civil rights, and civil liberties, among other fields. Best practices will evolve as more information emerges about both the benefits and risks of this technology. Policies would also benefit from legislation making them legally enforceable through private lawsuits.

Social Media Use Policies

Agencies that use social media monitoring in furtherance of their official missions should have publicly available policies that describe their practices and set out restrictions and oversight requirements. Those policies should contain the following provisions:

1. Criminal Investigations

Social media data may be viewed, monitored, or collected only when an agency has established specific and articulable facts showing reasonable grounds to believe that the data is relevant and material to an ongoing criminal investigation. Information gathered from social media should be documented in cases’ investigative files as soon as is practicable.

Data collected should not be shared with other law enforcement agencies absent either a showing of reasonable suspicion that the information contains evidence of criminal activity over which the receiving agency has jurisdiction, or relevance to an ongoing investigation or pending criminal trial in which the receiving agency is then engaged. Agencies should also have a memorandum of agreement in place confirming that the receiving agency will abide by equivalent limitations in any use or further dissemination of the data.

When agency use of social media is likely to yield information about First Amendment–protected rights, best practices regarding profiling and targeting of constitutionally protected activity (discussed below) should be followed.

2. Preparation for Public Events

Publicly available social media content may be monitored or viewed in advance of significant public events solely to determine the resources necessary to keep participants and the public safe. When agencies can make these determinations in ways that do not risk incidentally viewing First Amendment–protected information — such as by consulting a permit application or contacting an event organizer directly — these means are preferred. All social media monitoring should be approved by an individual at the rank of police chief or a named senior-level designee.

Social media surveillance should only be undertaken when specific, articulable, and credible facts demonstrate a public safety concern justifying the monitoring. Such concerns and the supporting facts should be documented in writing. The documentation should include a description of the social media searches to be made, including identification of any search terms, individuals, or hashtags monitored; the justification(s) for those searches; and the factor(s) necessitating social media as a necessary tool for making resource determinations.

A determination that a public safety concern exists should never be based to any degree on the constitutionally protected political or religious beliefs or the ethnic, racial, national, or religious identity of an individual or group, nor should it be based on violence at a previous event that resulted from police activity.

Only data relevant to a law enforcement agency’s resource and planning determinations to ensure public safety should be collected. If officers find no indication of criminal activity while monitoring, then social media data should not be retained past the event date. If online surveillance uncovers information connected to an existing criminal investigation, then that data may be retained in accordance with relevant statutes and departmental rules.¹

Data should not be shared with other law enforcement agencies absent a demonstrable showing of necessity to address a specific and articulated public safety concern and a memorandum of agreement with the receiving agency confirming that it will abide by the limitations set out above in any use or further dissemination of the data.

3. Evaluation of Social Media Information

Any information collected from social media must be evaluated for validity and reliability prior to being used as criminal intelligence and must be authenticated before being used in a criminal investigation.²

4. Controls for Undercover Account Use

Because of the risk of abuse and the inherent lack of transparency, as well as platform policies prohibiting their use, undercover accounts should be used extremely sparingly if at all, and only with a policy in place that requires:

• documentation and supervisory confirmation that no less invasive means are available, and that a subpoena or warrant to the social media platform is impossible or would not accomplish the law enforcement purpose;
• a showing that use of the account is likely to obtain information from someone reasonably suspected of criminal activity related to a small category of serious crimes (as defined in advance), and that law enforcement expects the information is necessary to a properly initiated investigation of such crimes;
• documentation and supervisory approval of the name on the undercover account, the officer who will use it, and the purpose for its use;
• the names of the persons or groups with whom the officer will seek to connect;
• regular, ongoing reviews at intervals no longer than 45 days to confirm the account’s continued necessity for the approved purpose; and
• automatic termination of account access unless the chief of police or a named senior designee explicitly authorizes an extension.

Permission to impersonate an actual person in the course of an approved criminal investigation should be limited to a narrow set of circumstances (e.g., assisting in identifying an online stalker) — the officer must, in addition to satisfying the restrictions above, obtain the permission of the person being impersonated, Officers may not change the individual’s password or alter other private or sensitive information related to the account without explicit consent, and may not take any actions — including interacting with individuals or groups or posting on behalf of the impersonated individual — beyond the pre-determined limited set of actions necessary to carry out the investigation. Furthermore, the impersonated person must be allowed to withdraw permission at any point, at which time the officer must immediately cease use of and access to the account. All undercover activity on the impersonated account must be properly documented in the investigative file.

5. Protections Against Profiling and Targeting of Constitutionally Protected Activity

Collection or monitoring of social media is prohibited when it is based to any degree on the race, religion, ethnic or national origin, gender or gender identity, sexual orientation or characteristics, or immigration status of an individual or group, except when trustworthy information specific and limited in time and location links persons possessing these traits to the description of individuals suspected of criminal activity, or it is based to any degree on a person’s exercise of First Amendment freedoms, or is reasonably likely to chill the exercise of such freedoms, except where there is reasonable suspicion of criminal activity or planning and clear evidence indicates that the First Amendment–protected activity directly relates to the suspected criminal activity or planning, or in the narrow context of event planning (subject to the restrictions set forth above).

When social media use during a criminal investigation is reasonably likely to yield information about the exercise of First Amendment–protected rights, data collection should not commence until the following measures have been met:

1. Completion of documentation clearly demonstrating that (i) the expected collection of information about First Amendment rights is unavoidably necessary for the proper conduct of the investigation and (ii) every reasonable precaution has been employed to minimize the collection and retention of information about, or interference with, First Amendment rights;³ and
2. Review by a supervisor confirming specifically that each factor immediately above has been met and approving the social media collection. Social media data collection should be subject to regular, ongoing reviews at intervals no longer than 45 days to confirm continued adherence to each condition above. These reviews should be conducted by the chief of police or a named senior designee, and they should include written documentation of a decision to reapprove or terminate the collection.

6. Whistleblower Protections

Protections to prevent retaliation against internal whistleblowers who disclose violations or abuses of social media monitoring practices — along with effective redress mechanisms — must be in place.

7. Contracting Limitations

The police department or its contracting authority must require any vendor to agree to be bound by any of the above conditions that are relevant to the vendor’s services. They should also obtain from vendors a demonstration or other explanation of how they will comply. Law enforcement agencies may not contract with any vendor who cannot or will not adhere to these requirements.

Social Media Use Reports

Every law enforcement agency that uses social media monitoring for investigative, intelligence, or event-planning purposes should publish a regular written report at least every two years. These reports should include the following information at a minimum:

• the number of criminal investigations and cases in which social media was used to gather information, monitor individuals, or collect evidence;
• the number of covert accounts used by the agency, broken down by division or other relevant sub-unit;
• the number of criminal investigations and cases in which covert accounts were used, including both the total number and the number disaggregated by category of crime, as well as the length of time in each investigation for which a covert account was approved;
• of the investigations in which covert accounts were used, the number that used impersonating accounts, including both the total number and the number disaggregated by category of crime;
• the average length of time that covert accounts remained open;
• the number of criminal investigations for which officers collected information about the exercise of First Amendment rights, including the total number, the number disaggregated by category of crime, and the number that involved any violations of this policy;
• the number of public events (other than those hosted by the department itself) for which officers viewed social media content or collected online data, including the date of each event; and
• the number of events for which agencies retained social media data beyond the event date or for which provisions of this policy were otherwise violated.

Social Media Monitoring Product Approvals

Jurisdictions should hold public hearings and obtain local government oversight and approval before contracting with vendors that facilitate the collection or analysis of social media data for the permitted purposes described above. The oversight and approval process must include considerations of cost, effects (including potential repercussions for marginalized communities and First Amendment–protected activities). The process should also outline accountability and oversight measures, and it should require a demonstration of efficacy evaluated and validated by an independent third party. Any contract must include stringent oversight, auditing, and public disclosure measures.

Third-Party Audits

Independent oversight entities should audit every law enforcement agency’s social media monitoring practices and disclosures on an ongoing basis to ensure compliance with departmental policies and with constitutional protections and safeguards. The results of each audit should be posted publicly on the agency’s website.