A lawyer signing an AI injury case in 2026 has a reasonable first instinct and it is wrong. The instinct is that the conversation logs are the case, that OpenAI has them, and that a subpoena will produce them. Two of those three are true.
The coordinated proceeding makes the stakes concrete. In re: ChatGPT Product Liability Cases, JCCP No. 5431, was granted from the bench on January 30, 2026 with the written order following on February 3, gathering a dozen state court actions alleging that ChatGPT’s design contributed to severe psychological harm and, in several cases, death. Case Management Order No. 1 issued August 4, 2026, installing four plaintiffs’ co-leads, a liaison, and a steering committee. The next case management conference is set for September 23. Individually retained counsel retain their own client’s case.
The inventory has not stopped growing since. The twelve cases named in the March 9 order assigning the coordination trial judge have been joined by at least eleven further add-on petitions and notices, arriving at a rate of roughly one a month and accelerating over the summer. The most recent is Jean Doe v. OpenAI Foundation, CGC-26-639036, filed in San Francisco Superior Court on July 13, 2026 and noticed for coordination on August 20 under California Rule of Court 3.544 and Code of Civil Procedure section 404.4. The practitioner this article addresses is not a hypothetical.
And here is the fact that should organize everything else. The register of actions in CJC-25-005431 runs to 116 entries as of late August 2026. Not one of them is a discovery order. There is no protective order, no order on electronically stored information, and no preservation order of any kind. Eight months of docket activity consists of coordination petitions, add-on stipulations, a contested leadership fight, pro hac vice applications, and jury fees. The proceeding has organized itself thoroughly and has not yet turned to evidence.
That last clause is where this article lives. Leadership will run liability discovery against OpenAI. Nobody is running the evidence file for your client but you, and the mechanism you were probably planning to use does not exist.
Why the subpoena fails
Start with what the statute is for, because the purpose explains the result.
Congress passed the Stored Communications Act in 1986 as Title II of the Electronic Communications Privacy Act, codified at 18 U.S.C. §§ 2701–2713. Its target was the government, not the civil bar. The Supreme Court had held in the 1970s that information voluntarily handed to a third party loses its reasonable expectation of privacy, which meant police could reach stored messages held by a service provider without a warrant. The SCA was written to supply statutory protection where the Fourth Amendment no longer reached.
Because it was imitating a constitutional line, it borrowed the constitutional distinction. Content is the letter, transactional data is the envelope. The disclosure ban sits at 18 U.S.C. § 2702(a)(1), which provides that a covered provider shall not knowingly divulge to any person or entity the contents of a communication in electronic storage. Non-content records get a weaker rule, one that restricts disclosure to the government but leaves providers free to give basic subscriber information to private parties. The account is not sealed. The conversations are.
Civil litigants appear to have been shut out by omission rather than design. Section 2702(b) of the same title lists the circumstances in which a provider may divulge content: consent of the subscriber, necessity incident to the service, emergencies, law enforcement process. Courts read that list as closed. Civil discovery is not on it, so a Rule 45 subpoena has no exception to invoke. One district court put it flatly, holding that the statute contains no exception for civil discovery subpoenas. Whether Congress meant to exclude civil litigants or simply never considered them in a year when the technology in view was electronic bulletin boards and remote time-sharing is a fair question, and the answer does not change the outcome.
Mechanically, then, the subpoena is not void. It is served, the provider moves to quash on the ground that compliance would require it to violate a federal statute, and the motion is granted. That is the posture in O’Grady, in Crispin, and in the Facebook cases, where the California courts held that an order compelling production cannot be enforced without forcing the provider to break federal law.
Two cautions before anyone treats that as settled with respect to OpenAI.
No court has ruled on a civil subpoena to OpenAI for a user’s conversations. The case law is email and social media, extended by analogy. The most careful treatment in print, an April 2026 feature in Colorado Lawyer, says the SCA likely prohibits generative AI providers from being subject to civil subpoenas for the content of subscriber chats. The hedge is doing real work and should be preserved.
The threshold question is also genuinely open. The statute reaches providers of electronic communication service and of remote computing service to the public, both defined in 1986 terms. Whether ChatGPT is either has not been litigated. If it is neither, none of the analysis above applies and an objection would have to come from somewhere else entirely. Plan around the uncertainty rather than around a certainty that does not exist in either direction.
The statute constrains the provider, not the party. A litigant who used ChatGPT can be ordered to produce their own conversations like any other electronically stored information, and that asymmetry is the whole practical architecture of this area. Content comes from people, not from platforms.
It is worth noting what OpenAI does honor, because the contrast is instructive. Under its published policy for government requests, OpenAI states it will honor valid preservation requests under 18 U.S.C. § 2703(f), holding user data for up to 90 days and extending for a further 90 upon valid request. That is a law enforcement mechanism. There is no civil analogue. A private litigant has no statutory hook that compels a provider to freeze an account pending litigation, which means the preservation letter you send OpenAI has notice value and moral suasion and nothing else. Send it anyway. Do not rely on it.
The exception that actually works
The consent exception sits at 18 U.S.C. § 2702(b)(3): a provider may divulge content with the lawful consent of the subscriber. This is the door, and it changes what the assignment is. The task is not to compel a reluctant provider. It is to establish, document, and exercise the authority of the person entitled to consent, and to do it while the data still exists.
For a living client, this is straightforward and underused. The client exports their own archive. Counsel authenticates and preserves it. Where the client is uncooperative or the account belongs to an adverse party, the relief to seek is party-focused: an order compelling a reasonable search and production, or in appropriate cases consent-based access, rather than a subpoena that will draw a motion to quash and lose.
The decedent problem
This is the part of the practice that has no established answer, and it is the part that most of the JCCP 5431 inventory turns on.
Every state has some version of the Revised Uniform Fiduciary Access to Digital Assets Act. RUFADAA establishes who may act on a decedent’s digital accounts and under what authority, and a digital-assets clause in a will or trust can settle that question cleanly. What RUFADAA does not do is create a channel at the provider. OpenAI publishes no deceased-user process, no legacy contact, and no beneficiary designation. The nearest published intake is the privacy-rights channel, where an authorized agent presenting evidence of authority can submit a request, and where the company decides case by case what it will answer. That is a privacy channel wearing an estate hat, and it was not designed for this.
The consequence is blunt. In practice, the exports made while the account holder was alive are what preserve the record. Where no export exists, everything depends on credentials, on the device, and on how quickly counsel moves.
Which produces an intake sequence that runs opposite to instinct. Secure the device. Establish authority. Export. Only then read.
The instruction to hold off on reading deserves an honest explanation, because the usual one is wrong. A family member scrolling the history does not break a chain of custody; no chain exists before anyone is retained, and reading does not erase what sits on the provider’s servers. The reasons are more specific than that.
The first is the only one that is likely to lose a case. Someone reads something unbearable and deletes it, or closes the account outright. If the duty to preserve has attached, that is spoliation, and it will have been committed by the client. Every other concern on this list is secondary to keeping that from happening.
The second is authorship. If three relatives had the password and used the account after the death, opposing counsel has an argument that the export does not show what the decedent alone wrote and read. That is an authentication problem under Rule 901, not a custody problem, and it is avoided by recording who accessed the account and when.
The third is the witness. A family member who spent an evening reading before ever speaking to a lawyer now has testimony shaped by hours of unrecorded reading, and will be examined on it.
The fourth is mundane and still worth saying: repeated failed logins, password resets, and changes to two-factor settings can trigger security holds that make a legitimate export harder to obtain later.
Two clocks, and only one of them stopped
Practitioners who followed the copyright litigation absorbed a fact that has since expired. On May 13, 2025, Magistrate Judge Ona T. Wang ordered OpenAI to preserve and segregate all output log data that would otherwise be deleted, suspending the company’s routine deletion cycle across an enormous population of users. Deleted conversations were not deleted. For roughly four months, the delete button was a suggestion.
On October 9, 2025, Wang terminated that obligation. With limited exceptions, OpenAI was released from preserving output log data going forward, and was not required to hold data past September 26, 2025. Logs already captured under the order remain in existence, and accounts specifically flagged by the news plaintiffs remain subject to preservation. Everything else returned to ordinary retention.
So there are two populations of evidence and the boundary is a date. Conduct falling inside the preservation window sits in a corpus OpenAI retained under court compulsion. Conduct after late September 2025 is governed by the company’s ordinary practice, under which deleted conversations are removed on a routine cycle measured in days. For a 2026 intake concerning 2026 conduct, the second regime is the one that applies, and the clock has been running the entire time the family was deciding whether to call a lawyer.
One further wrinkle deserves attention because it defeats an otherwise careful export. ChatGPT runs two stores, not one. Conversations are the transcript. Saved memories are a separate set of distilled facts the system chose to keep about the user, and OpenAI’s own documentation states that they sit apart from chat history, so that deleting a chat leaves any memory drawn from it intact and still in use.
That separation cuts both ways, and the second direction is the one that matters here. A complete export of conversation history does not contain the memory store. The account data export is built around chats; memories live in their own settings surface, where they are managed entry by entry rather than downloaded. Counsel should assume memory capture is a manual step and confirm the current mechanics at the time of collection, because the interface has changed more than once.
It is worth the trouble, because in an injury case the memory store may be the more probative artifact. The transcript shows what was said across hundreds of separate sessions. The memory store shows what the system concluded was true about this user and carried forward into every conversation that followed. That is the closest thing in the record to the product’s own working model of the person it is alleged to have harmed, and it is written in the system’s voice rather than the user’s. An export that leaves it behind produces a transcript without the thread running through it.
The stay that does not stop the clock
Add-on practice in a coordination introduces a trap that is easy to miss and specific to this posture.
Staying cases pending coordination has been this proceeding’s default from the beginning. OpenAI moved on January 23, 2026 for a stay of all related actions pending coordination, a motion that went off calendar only because coordination was granted before it could be heard. Since then, new cases noticed for coordination have been stayed by stipulation as a matter of routine, and the courts encourage it. The Jean Doe notice filed on August 20 does exactly that, invoking Code of Civil Procedure section 404.5 and California Rules of Court 3.544(c) and 3.515(a), and citing Keenan v. Superior Court for the proposition that the coordination judge may stay an action while deciding whether coordination is appropriate. The parties there agreed that efficiency warranted it. In the ordinary case they are right.
But note what a stay does and does not reach. It halts proceedings in the stayed action, which means no discovery, no motions, no subpoenas, and no ability to seek relief from the court about evidence. It has no effect whatsoever on OpenAI’s retention cycle, which is a private business practice and not a proceeding. The provider keeps deleting on schedule throughout.
The result is a window, potentially of months, in which counsel has a filed case, a stayed docket, no discovery tools, and a running clock on the evidence. Nothing about the stay prevents client-side preservation, because exporting your own client’s account is not discovery and requires no leave of court. That is the point. During a stay, client-side capture is not merely the better route described earlier in this article. It is the only route operating at all.
A related caution about what the stipulation preserves. In the Jean Doe notice, OpenAI expressly reserved the right to demur, move to strike, and challenge venue and forum, and stated that agreeing to coordination is not to be used against those challenges. Coordination is an administrative determination about where cases are managed. It concedes nothing on the merits, and counsel should not read a defendant’s stipulation as a signal about anything else.
What the 20 million logs did and did not establish
On January 5, 2026, Judge Sidney H. Stein affirmed Wang’s orders compelling OpenAI to produce a sample of 20 million de-identified consumer conversation logs to the news and class plaintiffs in the consolidated copyright MDL. OpenAI had proposed running search terms across the sample and producing only conversations implicating plaintiffs’ works. Stein rejected it, holding that no authority required the least burdensome means of production, and distinguished the Second Circuit’s Rajaratnam decision on the ground that OpenAI’s ownership of the logs is uncontested and users voluntarily transmitted their communications to the company.
That ruling gets cited as though it settled whether chat logs are discoverable. Read carefully, it establishes something narrower and more useful. OpenAI was a party producing its own business records under a protective order, in de-identified form, at population scale, to prove a claim about model behavior in the aggregate. None of those features describe a plaintiff seeking one named user’s conversations. The case confirms that the logs are records rather than sanctuaries. It does not supply a mechanism.
The privilege point rides along with it and is worth stating plainly to clients. No recognized privilege attaches to a user’s conversations with a commercial chatbot. Case facts a client typed into a consumer AI tool are not protected, and depending on the circumstances may support a waiver argument as to the same subject matter discussed with counsel.
Authentication, before you need it
An export is a JSON archive produced by a system the proponent does not control. Rule 901(b)(9) and its state analogues address evidence describing a process or system, and Rules 902(13) and 902(14) permit self-authentication of machine-generated records and copies of electronic data through certification. Whether a certification is available for an OpenAI export as a practical matter is an open question that varies with cooperation.
The defensive work is inexpensive and should be routine. Hash the archive at collection and record the hash. Document who performed the export, from what device, under whose credentials, and on what date. Preserve the device image alongside the export rather than treating the archive as sufficient. Screenshots are supplementary, not primary; they carry no metadata and invite a foundation fight the export can win.
Spoliation runs in both directions
JCCP 5431 is a state coordination, so Federal Rule 37(e) and its safe harbor do not govern. California addresses spoliation through evidentiary and issue sanctions and the willful suppression instruction, and the duty attaches when litigation is reasonably anticipated. A grieving family that closes a decedent’s accounts after retaining counsel has created a problem that no amount of good faith cures. The preservation instruction to the client is not a formality in this docket. It is the first substantive document in the file.
Defense discovery in these cases has been correspondingly aggressive. In the Raine matter, according to reporting on documents obtained by the Financial Times, OpenAI requested materials relating to memorial services for the decedent, including attendance lists and eulogies, which plaintiffs’ counsel characterized as harassment. Whatever one makes of that request, it indicates the posture. Counsel should assume that everything surrounding the client’s loss is a discovery target and that the client’s own preservation conduct will be examined closely.
What is unsettled
Four things remain genuinely open. Anyone relying on this piece should confirm them against the current docket and current policy rather than treat them as fixed.
The appellate posture of the production orders in the copyright MDL. Objections were denied at the district level in January 2026; whether and how the issue reaches the Second Circuit affects nothing about the SCA analysis but shapes how much of the preserved corpus ever becomes public.
When the coordinated proceeding will adopt its own rules for electronic evidence. This is the one most likely to change what a practitioner actually does, so it is worth spelling out.
In a coordinated proceeding the judge issues case management orders in sequence, and they build on one another. CMO No. 1 did the organizational work: who leads, who speaks for the plaintiffs, how the cases are administered. What it did not do is set rules for evidence. Courts handling large coordinated dockets typically enter a separate order, often called an ESI protocol, that governs electronic evidence across every case in the group. Such an order can specify what each side must preserve and from when, what format productions take, which metadata fields travel with a document, how privilege is logged, and who pays for what.
Everything this article recommends is what a lawyer should do in the absence of such an order. If Judge Schulman enters one, it is no longer a matter of judgment. The protocol becomes the governing procedure, it may call for collection or formatting done differently than described here, and compliance is measured against its terms rather than against ordinary practice. A protocol entered after you have already collected can also require you to redo work.
As of late August 2026 no such order exists. The full register of actions confirms it, and that absence is itself the reason the rest of this article matters. But the next case management conference is September 23, and an evidence order is precisely what follows a leadership order. Check the docket before building a collection protocol from this piece, and check it again before producing.
OpenAI’s current consumer retention schedule, which has changed more than once and is a published policy rather than a stable fact.
Whether a federal MDL forms. As of this writing there is none for the AI injury cases, and the liaison duties in CMO No. 1 contemplate coordination with one that does not yet exist.
The takeaway
The evidence in these cases is unusually good. It is contemporaneous, verbatim, timestamped, and it records the very interaction alleged to have caused the harm. Almost no tort produces a record like it.
It is also uniquely fragile, held by a third party the SCA forbids you from subpoenaing, subject to a deletion cycle nobody controls, in an account that may belong to someone who has died and for whom the provider offers no process. The preservation order that briefly made all of this moot ended in September 2025.
Which means the most consequential thing a lawyer does in one of these cases happens before the complaint, before the retainer is countersigned, in the first conversation with a family who does not yet know that the record can disappear.
The claims described in this article are allegations by the parties and have not been adjudicated. This piece is editorial analysis of litigation practice and is not legal advice. Court status is current as of publication.