How legal hold works
Legal hold is initiated entirely by team administrators through the Wire backend or management console — individual users cannot enable legal hold for themselves. When an administrator places a user under legal hold:- The Wire backend sends a legal hold request to the affected user’s devices.
- The user’s Wire app shows a dialog asking them to accept the request.
- Once accepted, a legal hold device is silently added to the user’s client list.
- All subsequent messages in conversations that include the user are also encrypted for the legal hold device, making them readable by the administrator.
- Other participants in those conversations see a banner indicating legal hold is active.
Legal hold states
TheLegalHoldUIState sealed interface represents the three states visible to a conversation participant:
| State | Description |
|---|---|
None | Legal hold is not active for this conversation. |
Pending | A legal hold request has been received but not yet accepted by the user. |
Active | Legal hold is in effect. Messages are being retained. |
UI flows
Receiving a legal hold request
When the backend sends a legal hold request,LegalHoldRequestedViewModel detects it by observing ObserveLegalHoldRequestUseCase. The LegalHoldRequestedState.Visible state is set, which causes LegalHoldRequestedDialog to appear.
The dialog displays:
- The fingerprint of the legal hold device.
- An optional password field when the user’s account requires password confirmation (
requiresPassword = true). - A “Learn more” link to Wire’s legal hold documentation.
- Accept and Not now buttons.
User reviews the request
Wire shows the legal hold device fingerprint so the user can verify it with their administrator.
User enters password (if required)
Accounts with a password require the user to confirm their password before accepting. The Accept button is disabled until a valid password is entered.
User taps Accept
ApproveLegalHoldRequestUseCase is called. On success, the dialog is dismissed and legal hold becomes active.| Error | Cause |
|---|---|
InvalidCredentialsError | The entered password was incorrect or a password was required but not provided. |
GenericError | Any other backend or network failure. |
Being subject to legal hold
Once a user has accepted legal hold, theLegalHoldSubjectBanner appears at the top of every affected conversation. Tapping the banner opens a context-specific information dialog:
| Dialog | Shown when |
|---|---|
LegalHoldSubjectConversationDialog | Tapping the banner in a group or 1:1 conversation. |
LegalHoldSubjectConnectionDialog | Viewing a connection request with a legal-hold user. |
LegalHoldSubjectProfileDialog | Viewing a user profile when that user is under legal hold. |
LegalHoldSubjectMessageDialog | Long-pressing a message in a conversation with legal hold active. |
LegalHoldSubjectBaseDialog, which includes a standard description and a “Learn more” link.
Legal hold deactivation
When an administrator lifts legal hold from a user, the app detects this throughObserveLegalHoldChangeNotifiedForSelfUseCase. If the new state is LegalHoldState.Disabled and the user has not yet been notified, LegalHoldDeactivatedDialog is shown.
Dismissing the dialog calls MarkLegalHoldChangeAsNotifiedForSelfUseCase to record that the user has been informed, preventing the dialog from reappearing.
If the backend reports that legal hold changed to an enabled state (rather than disabled), the app silently marks the change as notified without showing a dialog — the pending/active banners already communicate this state.
Connection failed
LegalHoldSubjectConnectionFailedDialog is shown when Wire cannot establish a connection to a user who is under legal hold. The dialog explains the situation and provides a “Learn more” link. Users can dismiss it with OK.
Conversation banners
Two banner components appear at the top of conversation screens based onLegalHoldUIState:
| Component | State | Content |
|---|---|---|
LegalHoldPendingBanner | Pending | ”Legal hold is pending” with a tappable Accept link. |
LegalHoldSubjectBanner | Active | ”This conversation is subject to legal hold” with the label underlined and tappable. |
LegalHoldBaseBanner. Tapping either banner navigates the user to the relevant information dialog or the legal hold acceptance flow.
Interaction with end-to-end encryption
Legal hold introduces a deliberately trusted third party into the encryption model:- The legal hold device is added to the MLS or Proteus client list of the user.
- Wire automatically encrypts messages for this device in addition to the user’s regular devices.
- Conversations that include a legal-hold participant are clearly marked with banners to inform all conversation members.
- Users cannot send messages in a conversation with active legal hold without implicitly acknowledging that messages are being retained — the send action proceeds normally but the UI makes retention visible at all times.