Preserving PPC Evidence

The order is the whole method: access, preserve, demand

Paid-search evidence has a property that makes it unlike most electronically stored information in a commercial case: a party can shorten the retention period, and the platform will then delete the data on schedule, automatically, with nobody taking any further action. Analytics data retention is a dropdown. Change history has a finite window always moving forward. Access can be revoked in a click by whoever holds the manager account.

That puts the whole problem at the front of the matter. The record degrades on a clock that started before anyone called a lawyer, and the party controlling the account controls the clock. The sequence that works is fixed:

1. Establish access. Who actually holds administrative access to every account in the stack, today.
2. Preserve. Export completely from everything access reaches, and freeze the retention settings that can be shortened.
3. Demand. Only then go after what sits on the other side, knowing what is already secured and how long the rest has to live.

Almost everything else is recoverable later. The platform record is not. An early, complete export taken while access exists is the highest-value act in the case, and costs a fraction of rebuilding the record from fragments afterward.

How access is lost, and how quickly

Four patterns account for nearly every case where a client cannot produce its own advertising data.

• The agency holds the account. It was created under the agency's own manager account and ownership never transferred. When the relationship ends the client has no login, and the account, its change history and its billing sit on the other side of the dispute.
• The manager link is severed. Google's documentation is explicit that a client account still owns its data and can remove ownership access by unlinking, and that a manager with ownership can invite users, remove users from the client account, and grant or revoke administrative access. Either side can cut the link, and the severed party sees nothing.
• An employee left. The account was tied to a departed employee's identity and nobody else holds administrative access. Routine, and it does not resolve itself.
• The account was closed. What remains accessible after closure is materially less than before, and what survives is not documented in the help material I have reviewed.

The instruction that follows is unglamorous: before a demand letter goes out, have someone log in and record which accounts, manager accounts, analytics properties and tag containers your client's credentials actually reach. A preservation demand can itself prompt the other side to reconsider a link it holds.

The retention clock, and the setting a party can shorten

Different records age out on different clocks, and the clocks run from the date the account is examined, not the date of the events in dispute. Two of these tightened within the last twelve months, so a figure learned a couple of years ago is likely wrong now. Every window below was read August 14, 2026.

Two consequences. The field-level change record in the API is gone in thirty days, and it is the only clean, machine-readable, hashable form of that record, so a programmatic pull is a thirty-day decision rather than a discovery-schedule one. And if the advertiser ran Search Ads 360, ask immediately: its change history reaches back years further than anything native.

One of those rows is not a platform decision at all. Analytics data retention is a property-level setting the administrators control, and reducing it triggers deletion in the next monthly process after a short grace period:

Analytics waits 24 hours before implementing the change. During this 24-hour period, you can revert your change and your data will be unaffected.

Two details decide how much that hurts. The setting affects explorations and funnel reports, not standard aggregated reports, so the granular, re-segmentable record disappears while the aggregate summary survives — and the granular record is what an examiner needs. And a floor overrides any setting: two months for age, gender and interest data, with signed-in Google signals capped at 26 months. So read the property's actual setting, in writing, early, and record it with the date read; the default for new properties is not stated in the documentation I have reviewed. See Google Analytics Help, Data retention (read August 14, 2026).

Paid search is a stack, not an account

A hold that names the Google Ads account will miss most of the evidence. The record is spread across systems with different owners and different clocks:

• The advertising accounts on every platform where spend ran, each with its own ID, change history and retention behavior.
• The manager account layer above them, including link history and which manager held ownership when.
• Billing on two sides: platform transactions, invoices and credits, and separately the agency's invoices and the client's payments. Reconciling those two is often the entire case in an overbilling dispute.
• Tag containers, whose version history is frequently the only record of when a conversion tag was changed, broken or removed.
• Analytics properties, their data streams, key event definitions, retention settings and the change record for those settings.
• Third-party tooling: call tracking, lead capture, the CRM, bid management and reporting platforms, and any warehouse the reporting was built on.
• Communications, where directives to pause, change budget or change targeting actually live.
• The contract stack, and any performance targets referenced in it.
• Creative and landing pages, which change without leaving a trace in the platform record.

Server and CDN logs deserve separate mention: usually the longest-lived record in the matter, entirely within the advertiser's control, and cheap to hold. In an invalid-traffic dispute they are the only place anyone can independently observe the traffic that arrived.

What exporting it actually means, record by record

"Export the account" is not an instruction anyone can execute. Each record type comes out differently, and some do not come out cleanly.

Change history

In the interface it is viewable by user and by campaign, with a performance overlay mapping changes against impressions, clicks, conversions and cost. Google's help pages do not document a download control for that page, so treat a clean CSV of native change history as unproven until tested in the live product, and plan for full-fidelity capture of every filtered view alongside a programmatic pull. The API feed returns old and new values, the user email, the client type and the timestamp — but only for the past 30 days, capped at 10,000 rows, and Google warns it may not include every row the interface shows.

Reporting

Export performance at the finest granularity and widest date range available, in one pass, at every level to be relied on later: campaign, ad group, keyword, ad, device, day. Re-exporting a narrower view later is fine; recovering a granularity that has aged out is not. Search terms exports are inherently incomplete, because low-volume queries are withheld, so rows will not sum to campaign totals — expected behavior, and it belongs in the report before anyone alleges tampering.

Billing, tags and analytics

Take platform transaction history and invoices as issued documents, not screen readings. Export tag container version history. For analytics, capture the retention setting itself, then the explorations, because the aggregated reports outlive them.

Two export traps

A download captures only the columns currently visible, so a narrow layout silently omits fields that existed in the record. And Search Ads 360 shows times in the browser's time zone while converting downloaded timestamps to GMT, so an export compared against a screenshot of one screen shows two times for one event.

When the account is already on the other side

Losing access is not the same as losing data, but it behaves the same way for a client who cannot produce its own records. The data exists in someone else's custody, and getting it depends on discovery rather than an export your client can run.

More can be done from outside the account than most people expect. Payments and invoices sit on the client's side. Server and CDN logs belong to the advertiser. Call tracking and CRM records are usually in the client's own tooling. Email and chat carry the directives. And a folder of monthly agency reports is a set of contemporaneous records.

That reconstruction is why this page carries the verdict it does. The record is not sitting in one place waiting to be printed; it is rebuilt from logs, billing and third-party systems. Where the rebuild disagrees with the eventual production, the disagreement is itself a finding worth documenting, with export dates and methods for both.

What preservation does not accomplish

Four things people reasonably assume, which do not hold:

• A hold letter does not stop platform deletion. Serving a preservation demand changes no retention setting and extends no change-history window. No platform's public documentation says a retention period is extended by a hold, so assume it is not. Changing the setting and exporting is what changes the outcome.
• Nothing recovers data past the window. There is no backup an advertiser can request. Google's published language for reporting beyond the cap is that the data is not accessible through the interface or the APIs — a statement about access rather than destruction, so be precise about which is claimed.
• Screenshots do not preserve the record. They preserve a rendering at one moment, without metadata, the full date range or the ability to re-segment.
• An export is not self-proving. A CSV downloaded from a platform is a file the producing party generated. Whether it can be authenticated is a separate question from whether the data is accurate, and belongs to a different discipline.

There is a limit, too, on what a perfectly preserved record shows: change history records the email attached to a change, not who was at the keyboard.

Where the description stops and the legal question starts

I am not an attorney, and I do not advise on preservation obligations. I describe what the record is, where it lives, who controls it and how fast it disappears. What follows from that is counsel's to decide.

For orientation, and as the rule reports itself: FRCP 37(e) addresses electronically stored information that should have been preserved in the anticipation or conduct of litigation and is lost because a party failed to take reasonable steps to preserve it. It provides for measures no greater than necessary to cure prejudice on a finding of prejudice, and reserves the severe measures — adverse presumption, adverse-inference instruction, dismissal or default — for a finding that the party acted with the intent to deprive another party of the information's use (full text, read August 14, 2026).

Two observations about the terrain, not about any case. The rule speaks of a party's steps rather than an act of deletion, and paid-search data is deleted by settings and schedules rather than by anyone pressing a key. And no reported opinion has been located applying it to an advertising platform's automatic deletion or to a shortened analytics retention setting. My contribution is a dated record of what existed, what was exported, when, and what had already aged out by the time anyone looked.

Frequently Asked Questions

Published 2026-08-14