Social Media Evidence in Claims: What’s Admissible and What Gets Excluded

Every insurer, defence firm and claims examiner collects social media now. It is fast, it costs almost nothing, and occasionally it changes a file. The problem is not that the industry collects too little. It is that most of what gets collected is assembled in a way that makes it weak, and some of it is collected in a way that damages the party collecting it.

Short answer: social media content is producible and admissible in Ontario proceedings, but a bare screenshot is not evidence, it is a picture of evidence. The party tendering an electronic record carries the burden of authenticating it under section 34.1(4) of the Ontario Evidence Act, and authentication is only the first hurdle: relevance and hearsay still apply, and a photograph proves the moment it captured rather than a continuing capability. Private content is reached through the court’s documentary discovery process, not through a friend request. Sending one, or running a false persona to get behind a privacy setting, is the most damaging thing an investigator can do to a file, because it moves the hearing’s attention from the claimant’s conduct to yours. And the largest practical risk on most files is not admissibility at all, it is that nobody sent a preservation letter and the account is gone.

This turns on statutory interpretation and on how a court treats a specific record, so treat it as orientation and have counsel look at any live file.

Why a screenshot on its own is close to worthless

A screenshot is a bitmap. It carries no source, no date, no chain of custody, and no way to test whether anything was cropped out of frame. Standing alone it invites four questions, and most files cannot answer any of them:

• Where did this come from? No URL, no account handle, no post identifier.
• When was it captured, and when was it posted? Different dates, both material. Interface dates are often relative (“3d”), reshared content carries the resharer’s date rather than the original’s, and platforms restyle their date displays.
• Who captured it, and can they say so under oath? “Someone in the office” and “the client sent it to us” are not answers.
• Is this the whole thing? A cropped image is indistinguishable from an honest one. Once cropping is suggested, you are defending your own conduct instead of examining the claimant’s.

None of that makes screenshots inadmissible by rule. It makes them cheap to attack, and cheap to attack usually means discounted to nothing by the time the argument ends.

What a defensible capture involves

A defensible capture is a documented act, not a keystroke. Someone must later be able to swear to how the record was made, and the same method repeated must produce the same result. Section 34.1(8) of the Evidence Act expressly permits evidence about the standard, procedure or practice by which electronic records are recorded or stored, which is what a documented method gives you.

Two cautions. Metadata is worth capturing but should never be oversold: platforms strip most embedded image metadata on upload, so missing EXIF data on a downloaded photo proves nothing about the original. And keep working copies separate from preserved originals, because once the only surviving copy has been annotated or pasted into a report, the integrity argument gets harder. The logic behind digital forensics and what holds up applies here in a lighter form.

Authentication, and the two proofs it requires

Section 34.1(4) of the Evidence Act, R.S.O. 1990, c. E.23 puts the burden on the party tendering the record: “The person seeking to introduce an electronic record has the burden of proving its authenticity by evidence capable of supporting a finding that the electronic record is what the person claims it to be.”

The threshold is not high. It requires some evidence capable of supporting the finding, not conclusive proof. But it sits on you, and a folder of unattributed images does not discharge it. Where the best evidence rule is engaged, section 34.1(5) is satisfied on proof of the record’s integrity, which section 34.1(5.1) allows to be proved through the integrity of the recording or storage system. These matters can be established by affidavit (s. 34.1(9)), and the adverse party has a right to cross-examine the deponent (s. 34.1(10)). Plan on that happening.

In substance you are proving two things, and files routinely do the first and skip the second.

That the account belongs to the claimant. In rough order of strength: the claimant’s own admission at examination for discovery (the best and the cheapest, if you simply ask); a handle used elsewhere; a profile photograph matching a known image; biographical detail matching the pleadings; connections to known family, employers or colleagues. Any one alone is thin. Several together are hard to argue with.

That the post is what it appears to be. Accounts are shared, hacked, impersonated and operated by spouses, and content is reshared without attribution. Before relying on a post: did the claimant author it or merely appear in it, is the displayed date the original posting date, did the image originate with the account, and who else has access. This is ordinary open-source discipline, and it separates a report that survives opposing counsel from a document dump.

Relevance and hearsay, after authentication

Clearing authentication clears nothing else. Section 34.1(2) says the electronic-records provisions do not modify any other rule of admissibility, “except the rules relating to authentication and best evidence.” Two problems follow, and between them they kill more social media evidence than authentication ever does.

Relevance. Since 1 January 2010, Rules 30.02 and 30.03 of the Rules of Civil Procedure require disclosure and production of documents “relevant to any matter in issue,” replacing the older “semblance of relevance” test, a change Heeney R.S.J. traced in Stewart v. Kempster, 2012 ONSC 7236 at para. 11. The bar moved up deliberately.

A photograph proves the instant it captured, not a continuing capability, and that gap is where most social media arguments fall apart. In Stewart, a chronic-pain case, the defendants sought the plaintiff’s vacation photographs and her private Facebook content. The court inspected the photographs and dismissed the motion, putting it plainly at para. 15: “An injured person and a perfectly healthy person are equally capable of sitting by a pool in Mexico with a pina colada in hand. A photograph of such an activity has no probative value.” Images of water skiing or rock climbing would have been relevant. What the court had showed a person standing, sitting or leaning.

Undated and reshared content is weaker still. In Schuster v. Royal & Sun Alliance Insurance Company of Canada, 2009 CanLII 58971 (ON SC), the defendant’s photographs of the plaintiff included images dated before the collision. The court found at para. 39 that they “do not appear, on their face, to be relevant,” and refused the order sought.

Hearsay. A photograph or video tendered to show what it depicts is real evidence. Text is different. A caption, status update, comment or tag offered to prove the truth of what it asserts is hearsay and needs an exception. A claimant’s own post tendered against them is generally available as an admission of a party; a friend’s comment saying “great to see you back on the slopes” is not. And a post is evidence of what the claimant wrote, not that what they wrote was true.

The private-profile question: what the Ontario cases decided

This is the area most often misdescribed. The case law does not support automatic production of private content, and it never has.

Leduc is cited constantly for the proposition that private profiles are producible, and that is not what it did. Brown J. accepted that Facebook postings are “documents” under the Rules and agreed a court can infer from the nature of the service that relevant material is likely present. He then held, at para. 33, that “mere proof of the existence of a Facebook profile does not entitle a party to gain access to all material placed on that site.” What he ordered was leave to cross-examine Mr. Leduc on his supplementary affidavit of documents about the kind of content he had posted. Not production.

Schuster went further the other way. Price J. declined to infer relevance from the nature of Facebook or from the existence of an account, held that an order requiring a plaintiff to hand over a username and password would be “clearly beyond the scope of Rule 30,” and observed at para. 41 that the defendant had been free to ask about the account at discovery and there was no evidence it had.

The working sequence:

1. Capture the public profile properly first. Public content is what supports the inference that relevant private material exists.
2. Ask about it at examination for discovery. Leduc at para. 33 says the necessary evidence will most often emerge from exactly those questions, and Schuster penalizes the party who did not ask.
3. Move under Rule 30.06 where the answers or the public content indicate relevant material was omitted from the affidavit of documents. The rule allows cross-examination on the affidavit, a further and better affidavit, production, or inspection by the court.
4. Tie the request to a pleaded issue and to specified categories, never to the account as a whole.

Note also Rule 30.1.01(3): evidence obtained under Rule 30 carries the deemed undertaking, so private content produced in the litigation cannot be repurposed elsewhere.

The friend request, and the privacy rules on the investigator

There is a shortcut, and it is why some files never recover. An investigator sends a connection request, or stands up a plausible persona, and the private content arrives that afternoon. Do not do it, and do not instruct anyone to do it.

The reason is not primarily that a statute names the act. It is that the moment you do it, the subject of the hearing changes. The question stops being what the claimant can do and becomes how the defence obtained its evidence, who authorized it, and whether the investigator’s account of the file can be trusted at all. That trades a strong position for a weak one, irreversibly.

The formal exposure is real too. Ontario licensees are bound by the Code of Conduct in O. Reg. 363/07 under the Private Security and Investigative Services Act, 2005, which requires a licensee to act with honesty and integrity (s. 2(1)(a)), comply with all federal, provincial and municipal laws (s. 2(1)(c)), and refrain from behaviour that is prohibited or not authorized by law (s. 2(1)(g)). Section 2(3) permits an investigator to conceal that they are an investigator in order to carry out their duties, and that narrow allowance gets misread as licence to fabricate an identity in order to defeat someone’s access controls. Concealing what you are is not the same as manufacturing who you are to get through a door that was closed to you.

The privacy overlay runs the same way. An agency collecting for an insurer or a law firm is a commercial organization collecting personal information in the course of commercial activity, which puts it inside PIPEDA, S.C. 2000, c. 5 (s. 4(1)). Section 5(3) permits collection only for purposes “that a reasonable person would consider are appropriate in the circumstances,” and the no-consent gateway in section 7(1)(b) applies only where it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of law. Deception aimed at access-controlled content is a hard fit with that language. In practice: collect against a defined question rather than a person, keep only what relates to the pleaded issue, and dispose of material on a documented schedule. Our note on PIPEDA and the privacy limits that matter covers how this runs alongside field surveillance, and the same reasoning applies under WSIB claim surveillance.

Schuster is instructive even though the court did not rule on method. The defence obtained photographs of the plaintiff through what appeared to be her mother-in-law’s Facebook account. The court did not condemn how they were obtained; it found they did not appear relevant on their face and refused the order. The shortcut produced nothing, and the file still had to do the ordinary work.

Preservation and spoliation

The most common way social media evidence is lost is not exclusion. It is deletion, usually in the first week after a claim is filed.

A party is obliged to preserve documents relevant to matters in issue, and that reaches electronic content the party controls. Rule 30.03(2)(c) requires an affidavit of documents to list documents that were in the party’s possession, control or power but no longer are, with a statement of when and how possession was lost and where the document is now. Deleting an account does not remove it from the affidavit of documents. It turns it into a schedule entry with an awkward explanation attached.

In McDougall v. Black & Decker Canada Inc., 2008 ABCA 353, the Alberta Court of Appeal stated the settled position at para. 18: spoliation “occurs where a party has intentionally destroyed evidence relevant to ongoing or contemplated litigation in circumstances where a reasonable inference can be drawn that the evidence was destroyed to affect the litigation,” and once shown, “a presumption arises that the evidence would have been unfavourable to the party destroying it,” rebuttable by other evidence. The Ontario Court of Appeal has declined to foreclose further remedies: Spasic Estate v. Imperial Tobacco Ltd., 2000 CanLII 17170 (ON CA).

This area is in motion. The Supreme Court of Canada heard SS&C Technologies Canada Corporation v. Bank of New York Mellon Corporation (SCC docket 41543, on appeal from 2024 ONCA 675) on 10 December 2025 on the question of the appropriate remedy for spoliation. Judgment was reserved and, as of this writing, has not been released. Expect the remedial framework to be restated.

The practical step is small and almost nobody skips it twice. Send a written preservation letter early, through counsel, identifying the categories of content to be preserved (accounts, posts, photographs, messages, location and activity data), stating that the obligation is continuing, and asking for written confirmation. It costs a letter, and it converts a later deletion from an evidentiary gap into an argument you get to make.

Proportionality: why a demand for the whole history fails

Demands for a claimant’s entire social media history are refused with some regularity, and the reason is written into the Rules. Rule 29.2.03(1) requires the court to consider whether the time required would be unreasonable, whether the expense would be unjustified, whether production would cause undue prejudice, whether it would unduly interfere with the orderly progress of the action, and whether the information is readily available elsewhere. Rule 29.2.03(2) adds a direction to consider whether the order would produce an excessive volume of documents.

Layered on that is a real privacy weighing. In Stewart at para. 24, Heeney R.S.J. approached a 139-friend private profile from the opposite direction to Murphy: permitting 139 people to see content means excluding roughly a billion others, which supports the conclusion that the plaintiff has “a real privacy interest in the content of her Facebook account.” Stewart also quotes McLachlin J. in M. (A.) v. Ryan, [1997] 1 S.C.R. 157: a litigant does not, by claiming damages, grant her opponent “a licence to delve into private aspects of her life which need not be probed for the proper disposition of the litigation.”

The request that succeeds looks like this: photographs and posts depicting the claimant engaged in physical activity, over a defined period tied to the alleged disability, limited to the restriction pleaded. The request that fails looks like this: everything.

Where social media evidence genuinely wins cases

Having spent this article on how it fails, here is when it works. Rarely as a standalone smoking gun.

• Corroboration. It is strongest lined up with something else: surveillance footage of a claimant lifting and carrying, a dated public post about a weekend of the same activity, and a medical file that says otherwise. The post alone is a picture of a moment.
• Impeachment. A claimant who testifies they have not travelled, driven, worked or participated in an activity since the loss, contradicted by their own dated public post, has a credibility problem that extends past the specific point. That is often worth more than the underlying fact.
• Locating and scoping. Employment, business activity, associates, vehicles and locations surface through open sources far more cheaply than through field work, and they direct the field work that follows. This is the daily use of open-source intelligence in a claims context.
• Clearing a file. Sometimes nothing contradicts the claim. That is a real result, and closing a legitimate claim quickly is cheaper than investigating it slowly.

What to do on your next file

1. Capture the public profile properly before anything else, with URL, timestamp, capturer identity, preserved originals and a hash. Do it early, because public content goes private without notice.
2. Send a preservation letter in the first weeks, listing categories, stating the obligation is continuing, and requesting written confirmation.
3. Ask about accounts at examination for discovery, by name and by platform. The cases penalize the party who did not ask.
4. Move under Rule 30.06 only where you have evidence, not a theory about what a typical profile contains, and tie the request to specified categories and a pleaded issue.
5. Never instruct anyone to friend, follow or message the claimant, and confirm in writing that your investigator understands that.
6. Assume your capture method will be cross-examined, and make sure the person who performed it can describe it without notes.

If you need the open-source component of a claim file assessed, or done properly from the start, our insurance and claims investigations work is built around evidence that survives the challenge rather than evidence that reads well in a report. Assign a case or contact us and we will tell you honestly whether it is worth the spend.

Ontario legal context

Authentication and best evidence for electronic records are governed by section 34.1 of the Evidence Act, R.S.O. 1990, c. E.23, which places the authentication burden on the tendering party (s. 34.1(4)) and expressly leaves every other admissibility rule untouched (s. 34.1(2)). Documentary discovery is governed by the Rules of Civil Procedure, R.R.O. 1990, Reg. 194: rule 30.01(1)(a) defines a document to include data and information in electronic form, rules 30.02 and 30.03 set the relevance standard and the affidavit of documents obligation including counsel’s certificate under rule 30.03(4), rule 30.06 supplies the remedies where a relevant document may have been omitted, rule 30.07 imposes continuing disclosure, and rule 29.2.03 requires proportionality. Production of private content has been considered in Murphy v. Perger, Wice, Leduc v. Roman, Schuster and Stewart v. Kempster, cited above. Destruction of evidence is addressed by the law of spoliation as stated in McDougall v. Black & Decker Canada Inc., 2008 ABCA 353 at para. 18, with remedies currently reserved before the Supreme Court of Canada in docket 41543. Collection by a commercial investigator is governed by PIPEDA, S.C. 2000, c. 5, and licensee conduct by O. Reg. 363/07 under the Private Security and Investigative Services Act, 2005.

This article is general information about investigative practice in Ontario, not legal advice. Laws change and every situation is different. For advice about your specific circumstances, consult a licensed Ontario lawyer or contact a licensed investigator directly.

Frequently asked questions

Is a screenshot of a claimant’s Facebook post admissible evidence in Ontario?

A screenshot is admissible only if someone can authenticate it. Under section 34.1(4) of the Ontario Evidence Act, the party introducing an electronic record has the burden of proving it is what they say it is. A bare image with no source URL, no capture date, no identified capturer and no preserved original gives a court nothing to work with, and it is easy to attack as cropped.

Can an insurer or defence counsel get a claimant’s private social media content?

Sometimes, through the court’s documentary discovery process, not by getting into the account. Ontario courts have ordered production of relevant private content where the public profile or the claimant’s own discovery answers showed that relevant material likely exists. Proving only that an account exists is not enough, and courts have refused orders based on speculation about what a typical profile contains.

Should an investigator send a friend request to reach a private profile?

No. Using a friend request or a fabricated persona to reach access-controlled content shifts the hearing from the claimant’s conduct to the investigator’s. Ontario licensees are bound by the Code of Conduct in O. Reg. 363/07 to act with honesty and integrity, and PIPEDA requires that collection be appropriate in the circumstances. The lawful route is a targeted production request through the litigation.

What happens if a claimant deletes their social media account after filing a claim?

Deletion after a claim is filed can support an adverse inference. Canadian courts treat spoliation as the intentional destruction of relevant evidence in ongoing or contemplated litigation where it can reasonably be inferred the destruction was aimed at affecting the litigation, which raises a rebuttable presumption that the evidence would not have helped the party who destroyed it. A written preservation letter is the practical step.

Does a photograph of a claimant doing something physical disprove their claim?

Usually not on its own. A photograph proves what happened in the instant it captured, not a person’s ongoing capability, and it proves nothing at all if it is undated, reshared or originally taken before the loss. Ontario courts have refused production of vacation photographs on the basis that an injured person and a healthy person are equally capable of sitting by a pool.

Can a court order the platform itself to hand over the account?

It is rarely a practical route. Rule 30.10 of the Rules of Civil Procedure allows production from a non-party where the document is relevant to a material issue and it would be unfair to proceed without it, but the major platforms are foreign corporations that routinely resist civil production. In practice, content is obtained from the account holder as a party, not from the platform.