The short answer. You usually file a lawsuit against a "Doe" defendant, then subpoena the website for account records and the internet provider for the subscriber behind an IP address. California courts require you to show real evidence of a valid claim before the poster can be identified. Act fast, because records are not kept forever.
Why anonymous speech is protected
The First Amendment protects the right to speak anonymously. Courts are careful not to let anyone unmask a critic just by filing a lawsuit. But anonymity does not protect defamation, threats or harassment, so California courts have developed a test to separate the two.
The Krinsky standard
In Krinsky v. Doe 6, 159 Cal.App.4th 1154 (2008), a California Court of Appeal held that before an anonymous speaker is identified, the plaintiff must make a prima facie showing of the elements of the claim. For defamation, that means evidence that the statements are factual, false and defamatory. Courts also expect reasonable efforts to notify the anonymous poster so they have a chance to respond.
In practice, you should be ready to show the court exactly which statements are false and why, with documents, not just your word.
How the process usually works
- Preserve the records. Your lawyer sends preservation letters to the platform and, later, the internet provider, asking them to keep logs and account data.
- File a Doe lawsuit. The complaint names "Doe 1" as the defendant and lays out the false statements and the harm.
- Subpoena the platform. The subpoena asks for account information such as email addresses and the IP addresses used to post. If the platform is outside California, the subpoena usually has to go through the courts of the state where it is located.
- The poster may object. Many platforms notify the user, who can file a motion to quash the subpoena (Code of Civil Procedure section 1987.1). This is where the Krinsky showing matters.
- Subpoena the internet provider. An IP address leads to an internet provider, which can identify the subscriber who used it at that time. Providers generally require a subpoena or court order and notify their customer first.
- Name the defendant. Once identified, the complaint is amended to name the real person.
What platforms can and cannot hand over
The federal Stored Communications Act generally prevents platforms from disclosing the contents of private messages in civil cases. It does allow them to disclose non content records, such as account details and IP logs, to private parties with proper legal process. That is why most unmasking cases focus on account records and IP addresses.
The realities
- The process can take months and usually requires a lawyer.
- Records may already be deleted, which is why preservation letters should go out early.
- Filing a lawsuit can trigger an anti SLAPP motion once the poster is involved.
- The one year deadline for defamation keeps running while you try to identify the poster.
What we want to change
Our proposal asks for a defined, fast procedure for identifying anonymous attackers once a person shows a real, supported claim of defamation, doxxing or harassment, with clear protections for lawful anonymous speech.