Anonymous Speaker Unmasking Checklist: A Practical Checklist

Summary. This checklist turns the law of unmasking anonymous online speakers into tasks, in the order they arise, for the three participants in every identification fight: the plaintiff who wants a name, the speaker who wants to keep it, and the platform or provider that holds the records. The plaintiff's track runs from capture and preservation through the decision whether a name is worth pursuing, lawful investigation, the choice of claim, court, and limitations strategy, the evidentiary showing that the Dendrite, Cahill, Highfields, and Sony Music tests require, the Doe complaint and Rule 26(d)(1) motion, first-tier and second-tier subpoenas, and verification before amendment. Short sub-checklists cover the DMCA 512(h) subpoena, state pre-suit petitions, out-of-state platforms and the UIDDA, foreign proceedings, and domain names. The speaker's track covers the notice window, preservation, a motion to quash filed without revealing a name, arguments matched to the type of speech, and anti-SLAPP and fee-shifting tools. The platform's track covers validating and scoping legal process, the Stored Communications Act and Cable Act limits, notice to users, objections and third-party standing, and production. Red flags, an FAQ, and practical takeaways close the document.

Most unmasking motions are lost before anyone reads a First Amendment case. The screenshot has no URL, the declaration never says the reviewer was not a customer, the subpoena goes to a California company from a Nevada court, or the amended complaint arrives a week after the limitations period ran. Each of those is a skipped task. This checklist lists the tasks in the order the clock imposes them, for each of the three people in an identification fight: the plaintiff who wants a name, the speaker who wants to keep it, and the platform holding the records.

The short answer

• For the plaintiff: capture properly on day one, decide honestly whether a name is needed, investigate only by lawful means, choose a claim you can prove now and a court where a later Doe amendment will relate back, put evidence of falsity and harm into sworn declarations before you ask for anything, ask the platform for subscriber records only, and corroborate the result before you name anyone. The tests themselves are explained in Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment.
• For the speaker: do not delete anything, calendar the deadline the day the notice arrives, get counsel, move to quash in the court where compliance is required without revealing your name, attack the plaintiff's evidence statement by statement, and use the fee-shifting tools that exist.
• For the platform or provider: validate and preserve, notify the user, produce non-content records only, require a court order before disclosing a cable subscriber's identity under 47 U.S.C. § 551(c)(2)(B), and decide deliberately whether to assert your users' rights.
• For everyone: two clocks start on the day of the post, data retention and the statute of limitations, and neither one stops while the subpoena is litigated.

How to use this checklist

Phases 1 through 10 are the plaintiff's track, in chronological order and built around federal procedure; the sub-checklists after Phase 10 apply when the claim, the platform, or the case falls outside that standard path. Phases 11 and 12 are the speaker's track, and Phase 13 is the platform's. Each box is a task, and the indented note under it explains why the task matters and cites the authority. The governing test differs by state and by type of speech, so "check the local standard" is a real task here, not a disclaimer. Day counts are typical, not rules.

For the step-by-step narrative, see Identifying an Anonymous Defendant Online: A Practical Guide. For the motion, proposed order, subpoena riders, and opposition papers, see John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Phase 1: Capture and preserve in the first 72 hours (plaintiff)

• Capture each post, review, comment, or upload with its full URL, account name, numeric account ID, displayed date and time with time zone, and time of capture. Note: handles change and numeric IDs usually do not. Use a capture method that records the URL, a hash, and a timestamp, backed by the capturer's declaration under 28 U.S.C. § 1746, the usual route to authentication under Fed. R. Evid. 901. See Authenticating Website Evidence: A Practical Checklist.
• Capture the account and the context: profile, creation date, linked accounts, other posts by the account, the thread, and the replies. Note: creation dates and posting patterns become attribution evidence, and context decides fact versus hyperbole. In Krinsky v. Doe 6, 159 Cal. App. 4th 1154 (2008), a jab about a "fake medical degree" amid vulgar insults was hyperbole.
• Record the date each statement was first published. Note: under the single publication rule the limitations clock starts at first posting, Firth v. State, 98 N.Y.2d 365 (2002), and one year is a common defamation period.
• Issue a written litigation hold covering the client's logs, analytics, data-room access records, customer databases, email, chat, and the devices of anyone who had access to leaked material. Note: the client's own records often identify or corroborate the speaker, and lost electronically stored information is governed by Fed. R. Civ. P. 37(e). See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
• Ask the platform in writing to preserve subscriber information and access logs for each account pending a subpoena. Note: the statutory preservation procedure in 18 U.S.C. § 2703(f) belongs to governmental entities, so a served subpoena is the only reliable preservation tool.
• Report fake reviews, impersonation, and infringing uploads through the platform's tools only after the capture is complete, and tell the client not to reply publicly or contact the suspected author. Note: a removed post cannot be captured later, and public replies amplify the statements.

Phase 2: Decide whether you need a name at all (plaintiff)

• Write down the client's goal: removal, a correction, deterrence, damages, an injunction, or confirming whether an insider leaked. Note: removal rarely needs a name, because platform policies and DMCA notices work faster; see How to File a DMCA Takedown Notice (And Respond to One). A name matters when the harm is ongoing and an order against a person would change behavior.
• Sort every statement into fact, opinion, or hyperbole, and set the opinions aside. Note: statements that cannot reasonably be read as stating actual facts are not actionable. Milkovich v. Lorain Journal Co., 497 U.S. 1 (1990); Restatement (Second) of Torts § 566. Doe v. Cahill, 884 A.2d 451 (Del. 2005), ended by holding that no reasonable reader would take the posts as fact.
• Classify the speech (public criticism, commercial or competitor speech, infringement, breach of confidence, threats), and decide whether the speaker would be a defendant or only a witness. Note: "the nature of the speech should be a driving force in choosing a standard," In re Anonymous Online Speakers, 661 F.3d 1168 (9th Cir. 2011), and a nonparty witness gets the most protection, Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088 (W.D. Wash. 2001).
• Test whether the claim can be proved with evidence the client has now. Note: unmasking is a merits preview. If falsity depends on the speaker's own information, the motion will probably fail.
• Weigh publicity, fees, and collectability with the client, and record the decision with a budget. Note: a Doe complaint is public; anti-SLAPP states shift fees to plaintiffs who cannot make the showing (see Anti-SLAPP Statutes and Strategic Litigation Against Public Participation); defendants are often judgment-proof; and some trails end at a VPN. An uncontested two-tier identification commonly costs from the high four figures to the mid five figures in fees, and a contest can double or triple that.

Phase 3: Investigate without a subpoena, within the lines (plaintiff)

• Search the handle, the profile image (by reverse image search), distinctive phrases, domain registration history, and any payment or donation links.
• Examine leaked files for metadata (author, organization, software, revision history, watermarks), and mine the client's own records: customer databases, data-room access logs, and server logs. Note: the business in the Hadeed litigation matched negative reviews against its customer records, found no matches, and argued that the reviewers had never been customers. Yelp, Inc. v. Hadeed Carpet Cleaning, Inc., 62 Va. App. 678 (2014).
• Treat writing-style and timing comparisons as leads. Note: expert stylometry must satisfy Fed. R. Evid. 702 and works as corroboration, not identification.
• Give any investigator written instructions that forbid pretexting, fake or borrowed profiles, and account access. Note: ABA Model Rules 4.1, 5.3, and 8.4 make the lawyer answerable for an investigator's deception. Posing as an ordinary customer to detect ongoing infringement has been tolerated, Apple Corps Ltd. v. International Collectors Society, 15 F. Supp. 2d 456 (D.N.J. 1998); Gidatex, S.r.L. v. Campaniello Imports, Ltd., 82 F. Supp. 2d 119 (S.D.N.Y. 1999), but that is not a license to deceive the speaker.
• Do not access the anonymous account, send it bait links, or obtain phone or financial records by pretext. Note: see 18 U.S.C. § 1030, 18 U.S.C. § 2701, 18 U.S.C. § 2511, 18 U.S.C. § 1039, and 15 U.S.C. § 6821; access obtained by deception is not authorized, Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004). For the ethics, see Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.
• If the posts are true threats or stalking, report them to the police in parallel. Note: true threats are unprotected, Counterman v. Colorado, 600 U.S. 66 (2023); stalking through electronic services is a federal crime, 18 U.S.C. § 2261A; and police can compel records that civil litigants cannot.
• Keep a dated log of every step and its result. Note: Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), requires a description of the steps already taken. The log becomes that declaration.

Phase 4: Choose the claim, the court, and the clock (plaintiff)

• Choose claims you can prove now: defamation, trade libel, interference, breach of confidence, trade secret misappropriation, copyright, false advertising, or computer intrusion. Note: federal options include 18 U.S.C. § 1836, 17 U.S.C. § 501, 15 U.S.C. § 1125(a), and 18 U.S.C. § 1030(g). A copyright suit needs a registration or a refusal first, 17 U.S.C. § 411(a); Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019).
• Do not bring a state-law-only Doe case to federal court on diversity. Note: complete diversity under 28 U.S.C. § 1332 cannot be confirmed against an unknown defendant, Howell v. Tribune Entertainment Co., 106 F.3d 215 (7th Cir. 1997). Use a federal question under 28 U.S.C. § 1331, or file in state court.
• Pick a forum with personal jurisdiction over the likely speaker, and write down the basis. Note: content readable in the forum is not enough, Sinclair v. TubeSockTedD, 596 F. Supp. 2d 128 (D.D.C. 2009); Walden v. Fiore, 571 U.S. 277 (2014). The D.C. Circuit requires a good-faith basis, such as geolocation, for each Doe. AF Holdings, LLC v. Does 1-1058, 752 F.3d 990 (D.C. Cir. 2014). See Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.
• Calendar each limitations period from first publication, with a working deadline for naming the speaker four to eight months before it. Note: see Statute of Limitations Diary Checklist: A Practical Checklist.
• Confirm that an amendment substituting the true name will relate back. Note: most circuits hold that not knowing a name is not a "mistake" under Rule 15(c)(1)(C), even after Krupski v. Costa Crociere S.p.A., 560 U.S. 538 (2010). Herrera v. Cleveland, 8 F.4th 493 (7th Cir. 2021); Barrow v. Wethersfield Police Department, 66 F.3d 466 (2d Cir. 1995). Use Rule 15(c)(1)(A) with a state Doe statute: California's Code of Civil Procedure § 474, Lindley v. General Electric Co., 780 F.2d 797 (9th Cir. 1986), or New York's CPLR 1024, which requires diligence and a fair description, Hogan v. Fischer, 738 F.3d 509 (2d Cir. 2013).
• Identify the state's unmasking standard and any statute. Note: New Jersey and Maryland require notice, the exact statements, prima facie evidence, and a balancing, Dendrite International, Inc. v. Doe No. 3, 775 A.2d 756 (N.J. Super. Ct. App. Div. 2001); Independent Newspapers, Inc. v. Brodie, 407 Md. 415 (2009). Delaware and the District of Columbia use a summary judgment standard, Cahill; Solers, Inc. v. Doe, 977 A.2d 941 (D.C. 2009), and Arizona adds a balancing step, Mobilisa, Inc. v. Doe, 217 Ariz. 103 (Ct. App. 2007). California requires a prima facie showing that includes falsity, ZL Technologies, Inc. v. Does 1-7, 13 Cal. App. 5th 603 (2017). Illinois applies a pleading standard under Supreme Court Rule 224, Hadley v. Doe, 2014 IL App (2d) 130489, and Virginia has a statute, Va. Code Ann. § 8.01-407.1. The annotation at 120 A.L.R.5th 195 collects the cases.
• Check whether the state anti-SLAPP statute applies in the chosen court. Note: the Ninth Circuit applies California's statute in diversity cases, United States ex rel. Newsham v. Lockheed Missiles & Space Co., 190 F.3d 963 (9th Cir. 1999); the D.C., Second, Fifth, Tenth, and Eleventh Circuits do not apply state special-motion procedures, Abbas v. Foreign Policy Group, LLC, 783 F.3d 1328 (D.C. Cir. 2015); La Liberte v. Reid, 966 F.3d 79 (2d Cir. 2020). See Filing an Anti-SLAPP Motion: A Practical Guide.
• Leave the platform out as a defendant on defamation claims. Note: 47 U.S.C. § 230(c)(1) bars treating a host as the publisher of its users' words, Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997), though § 230(e)(2) leaves intellectual property claims untouched. See Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops.

Phase 5: Build the evidentiary showing before you file (plaintiff)

• Chart each actionable statement verbatim, with its URL, account, and date, and list the evidence on each element: publication, falsity, fault where reachable, and harm. Note: Dendrite requires the exact statements, and courts reject complaints offered as evidence. Best Western International, Inc. v. Doe, No. CV-06-1537 (D. Ariz. July 25, 2006), denied early discovery where the complaint identified no false statement.
• Get a falsity declaration from someone with knowledge: a records search showing no matching transaction, an inspection report, payroll records. Note: ZL Technologies requires evidence of falsity at this stage, and where the speech is on a matter of public concern the plaintiff will usually carry that burden at trial anyway. Philadelphia Newspapers, Inc. v. Hepps, 475 U.S. 767 (1986) (newspaper defendant).
• Get a harm declaration with numbers measured against a baseline. Note: Dendrite and Pilchesky v. Gatelli, 12 A.3d 430 (Pa. Super. Ct. 2011), turned on missing harm evidence, and presumed damages require a showing of actual malice where the speech involves a matter of public concern, Gertz v. Robert Welch, Inc., 418 U.S. 323 (1974).
• Gather circumstantial evidence of a campaign: same-day accounts, bursts of posts, reviewers who were never customers. Note: a public figure need not prove actual malice before learning who the speaker is, Cahill, but this evidence helps any balancing. The FTC's fake-review rule, 16 C.F.R. Part 465, effective October 2024, creates no private right of action, but a documented scheme recasts the case as commercial deception rather than criticism.
• For confidential information, identify it with particularity and document its secrecy. Note: the employer in Glassdoor, Inc. v. Superior Court, 9 Cal. App. 5th 623 (2017), lost because it could not show that the review disclosed anything confidential. See 18 U.S.C. § 1839 and Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue.
• For copyright, document ownership, registration, and copying, and assess fair use honestly. Note: a substantial fair use question defeated disclosure in Art of Living Foundation v. Does 1-10, No. 10-cv-05022 (N.D. Cal. Nov. 9, 2011). See 17 U.S.C. § 107 and Copyright Infringement Claim Evaluation Checklist: A Practical Checklist.
• Prepare declarations on the steps already taken (attach the Phase 3 log) and on jurisdiction (geolocation, the speaker's own statements, forum-directed content).
• Put every declaration in admissible form, signed under penalty of perjury with authenticated exhibits. Note: platform records produced later can come in under Fed. R. Evid. 803(6) with a certification under Fed. R. Evid. 902(11).

Phase 6: File the Doe complaint and the early discovery motion (plaintiff)

• Name each defendant as "Doe [number]," identified by account name, ID, URL, and the statements attributed to it. Note: Fed. R. Civ. P. 10(a) requires the parties to be named, but fictitious names are allowed where discovery is likely to reveal the identity. Gillespie v. Civiletti, 629 F.2d 637 (9th Cir. 1980). Sue the people who made the actionable statements; Brodie unraveled because the named Does had not made them.
• Plead each statement verbatim and each Doe's jurisdictional facts, pleading facts peculiarly within the defendant's knowledge on information and belief. Note: Arista Records, LLC v. Doe 3, 604 F.3d 110 (2d Cir. 2010), approved that practice under Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007). See Drafting a Complaint That Survives a Motion to Dismiss.
• File the motion for leave to serve subpoenas before the Rule 26(f) conference together with the complaint and declarations. Note: Fed. R. Civ. P. 26(d)(1) requires a stipulation or court order. Courts ask for good cause, Semitool, Inc. v. Tokyo Electron America, Inc., 208 F.R.D. 273 (N.D. Cal. 2002), or reasonableness, Ayyash v. Bank Al-Madina, 233 F.R.D. 325 (S.D.N.Y. 2005), filled in with the First Amendment test.
• Show that the motion meets the most demanding test that could apply, not just the one you prefer. Note: the D.C. Circuit reversed a denial because the plaintiff met "any applicable standard." Strike 3 Holdings, LLC v. Doe, 964 F.3d 1203 (D.C. Cir. 2020).
• Name each subpoena recipient and the exact categories of records sought. Note: Seescandy asks for a limited number of recipients, and Sony Music Entertainment Inc. v. Does 1-40, 326 F. Supp. 2d 556 (S.D.N.Y. 2004), weighs specificity.
• Submit a proposed order that requires notice to the account holder, a waiting period, preservation, and use limits, and that recites § 551(c)(2)(B) for cable operators only. Note: Digital Sin, Inc. v. Does 1-176, 279 F.R.D. 239 (S.D.N.Y. 2012), used that structure. Arista Records LLC v. Does 1-19, 551 F. Supp. 2d 1 (D.D.C. 2008), reissued an order without its § 551 reference because the subpoenaed university was not a cable operator.
• Offer an attorneys'-eyes-only period or other limits on use of the identity where the speech is expressive. Note: Fed. R. Civ. P. 26(c); Seattle Times Co. v. Rhinehart, 467 U.S. 20 (1984). See Protective Order and Sealing Checklist: A Practical Checklist.
• Give the speaker notice where the test requires it, on the same forum or by message to the account. Note: Dendrite and Cahill require reasonable efforts at notice, and Solers observed that the subpoena recipient is often the best messenger. The plaintiffs in Doe I v. Individuals, 561 F. Supp. 2d 249 (D. Conn. 2008), posted notice on the forum itself.
• If a magistrate judge rules, calendar 14 days to object. Note: Fed. R. Civ. P. 72(a); 28 U.S.C. § 636(b)(1)(A). In Art of Living, the district judge reversed a magistrate judge's disclosure order.

Phase 7: Serve the first-tier subpoena on the platform (plaintiff)

• Find the platform's process requirements: registered agent, legal-process portal, fees, and user-notice policy.
• Identify the place of compliance and the court that will hear any motion. Note: compliance must be within 100 miles of where the recipient resides, is employed, or regularly transacts business in person, and motions go to the court for the district where compliance is required. Fed. R. Civ. P. 45(c), (d). That court does its own analysis: Music Group Macao Commercial Offshore Ltd. v. Does, 82 F. Supp. 3d 979 (N.D. Cal. 2015), declined a Rule 45(f) transfer and refused to enforce subpoenas another district had authorized.
• In state court, domesticate the subpoena where the platform keeps its records. Note: a Virginia court could not enforce a subpoena against a California company for records kept in California. Yelp, Inc. v. Hadeed Carpet Cleaning, Inc., 289 Va. 426 (2015). Most states use the Uniform Interstate Depositions and Discovery Act; California's version is Cal. Code Civ. Proc. §§ 2029.100 to 2029.900.
• Attach the order, and limit the rider to non-content records for the listed accounts and dates, with a Rule 902(11) certification. Note: providers may give private parties non-content records, 18 U.S.C. § 2702(c)(6), in categories that track 18 U.S.C. § 2703(c)(2). Contents are off limits, Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010), and an overbroad subpoena can create liability, Theofel; 18 U.S.C. § 2707.
• Offer reasonable lookup costs, confirm the notice period in writing, and calendar the objection deadline (the earlier of the compliance date or 14 days after service). Note: Rule 45(d)(1) requires the issuing party to avoid undue burden or expense; Rule 45(d)(2)(B) sets the objection deadline.
• Answer objections by narrowing the request rather than defending its full breadth. See Rule 45 Subpoenas to Nonparties: Service, Objections, and Motions to Quash.

Phase 8: Follow the trail with second-tier subpoenas (plaintiff)

• Convert every timestamp to UTC, pair each IP address with its exact time, and identify each address's holder: cable or fiber provider, mobile carrier, university, employer, host, or VPN. Note: addresses are reassigned constantly, and a one-hour error can identify the wrong household.
• Serve the provider subpoenas at once, under the existing order or a short supplemental motion; retention runs from weeks to about a year.
• For a cable operator, confirm that the order authorizes disclosure under 47 U.S.C. § 551(c)(2)(B), and expect notice to the subscriber and a wait of about 30 days.
• For a mobile carrier or other shared-address network, supply the source port and ask only for subscriber identity. Note: carriers treat call details as customer proprietary network information under 47 U.S.C. § 222, which they may disclose without the customer's approval only as required by law.
• For a university, expect advance notice to the student before compliance. Note: 20 U.S.C. § 1232g; 34 C.F.R. § 99.31(a)(9). FERPA did not bar court-ordered disclosure of directory information in Arista Records LLC v. Does 1-19.
• For an email provider, request subscriber and login records only; for a payment processor, tie the request to specific transactions. Note: financial institutions may disclose customer information to respond to judicial process. 15 U.S.C. § 6802(e)(8).
• When the trail ends at a VPN, public Wi-Fi, or Tor, document it and dismiss those Does without prejudice under Fed. R. Civ. P. 41(a).

Phase 9: If the speaker or the platform moves to quash (plaintiff)

• Answer statement by statement: why each one is a factual assertion and what evidence shows it is false.
• Do not spend the brief contesting the platform's standing. Note: courts let websites and newspapers assert their users' rights. Enterline v. Pocono Medical Center, 751 F. Supp. 2d 782 (M.D. Pa. 2008); McVicker v. King, 266 F.R.D. 92 (W.D. Pa. 2010).
• Dismiss any Doe who shows that the statement was true or an honest account of a real experience.
• If the speaker is litigating through counsel, explain concretely why the name is still needed. Note: active participation through counsel undercut the claimed need in Art of Living.
• Offer narrower relief in the alternative: fewer accounts, shorter date ranges, attorneys'-eyes-only disclosure, or in camera review. Note: London-Sire Records, Inc. v. Doe 1, 542 F. Supp. 2d 153 (D. Mass. 2008), quashed subpoenas pending in camera review of the provider's terms of service and its list of matching subscribers, and allowed the plaintiffs to renew.
• Recalculate the limitations deadline against the possibility of appellate review. Note: speakers seek mandamus under 28 U.S.C. § 1651 and Fed. R. App. P. 21, as in In re Anonymous Online Speakers, and state writs or collateral-order appeals, as in Pilchesky and Doe v. Mahoney, 244 Ariz. 240 (Ct. App. 2018).

Phase 10: Verify, amend, and serve (plaintiff)

• Corroborate the subscriber with independent facts (household, relationship to the client, writing style, timing, motive), and write a verification memo before naming anyone. Note: being the account holder is not enough, Cobbler Nevada, LLC v. Gonzales, 901 F.3d 1142 (9th Cir. 2018), and plaintiff's counsel in Digital Sin estimated that 30 percent of the names providers produce are not the people who did it. Fed. R. Civ. P. 11(b)(3) requires evidentiary support.
• Amend to substitute the true name, invoking the state Doe statute if relation back depends on it.
• Serve within the period set by Fed. R. Civ. P. 4(m), presumptively 90 days after filing, or move to extend before it runs. Note: a pro se plaintiff may ask the court for help identifying a Doe. Valentin v. Dinkins, 121 F.3d 72 (2d Cir. 1997). See Service of Process: Domestic and International Methods That Work.
• Decide the endgame: removal by the author, a correction, a stipulated injunction, or damages. Note: an injunction binds the author, not the nonparty platform, Hassell v. Bird, 5 Cal. 5th 522 (2018). After judgment, the Sixth Circuit presumes in favor of unmasking an anonymous defendant, Signature Management Team, LLC v. Doe, 876 F.3d 831 (6th Cir. 2017), and Fed. R. Civ. P. 69 supports discovery in aid of execution.

Special routes (plaintiff)

Copyright owners: the DMCA subpoena

• Confirm that the provider stores or links to the material; a conduit is outside 17 U.S.C. § 512(h). Recording Industry Ass'n of America, Inc. v. Verizon Internet Services, Inc., 351 F.3d 1229 (D.C. Cir. 2003); In re Charter Communications, Inc., Subpoena Enforcement Matter, 393 F.3d 771 (8th Cir. 2005).
• Send a notice that meets § 512(c)(3)(A), then file with the clerk the notice, a proposed subpoena, and a sworn declaration that the identity will be used only to protect rights under the Copyright Act. See Filing a DMCA Takedown Notice: A Practical Checklist.
• Assess fair use first. The Northern District of California has quashed § 512(h) subpoenas over substantial fair use defenses, In re DMCA Subpoena to Reddit, Inc., 441 F. Supp. 3d 875 (N.D. Cal. 2020); In re DMCA § 512(h) Subpoena to Twitter, Inc., 608 F. Supp. 3d 868 (N.D. Cal. 2022). The subpoena needs no lawsuit, but a later infringement suit needs a registration.

State pre-suit petitions and out-of-state subpoenas

• Consider Texas Rule of Civil Procedure 202, New York CPLR 3102(c) (as in Matter of Cohen v. Google, Inc., 25 Misc. 3d 945 (N.Y. Sup. Ct. 2009)), or an Illinois Rule 224 petition, which must state a claim that would survive a motion to dismiss, Hadley.
• Do not assume a pre-suit petition stops the clock: the employer in Glassdoor, Inc. v. Andra Group, LP, 575 S.W.3d 523 (Tex. 2019), lost its claims to limitations while it litigated a Rule 202 petition. In federal court, Fed. R. Civ. P. 27 perpetuates testimony at risk of loss; it is not a tool for finding defendants.
• Domesticate subpoenas where the records are, as Yelp v. Hadeed requires. In California, the speaker may move to quash under Cal. Code Civ. Proc. § 1987.1, and if the case is pending in another state, arises from the speaker's online speech, and lacks a prima facie showing, a speaker who prevails recovers fees under § 1987.2.

Foreign proceedings, foreign platforms, and domain names

• For a foreign case, apply under 28 U.S.C. § 1782 and address the factors in Intel Corp. v. Advanced Micro Devices, Inc., 542 U.S. 241 (2004); records are available, contents are not, Suzlon Energy Ltd. v. Microsoft Corp., 671 F.3d 726 (9th Cir. 2011). See Section 1782 Application Checklist.
• For a platform abroad, consider the local remedy, such as a Norwich Pharmacal order in England and other common-law jurisdictions (Norwich Pharmacal Co. v. Customs & Excise Commissioners, [1974] A.C. 133 (H.L.)). A foreign defamation judgment against a U.S. speaker must satisfy First Amendment standards to be enforced here. 28 U.S.C. § 4102.
• For a domain name, subpoena the registrar and any privacy service; if the registrant cannot be found, consider an in rem action under 15 U.S.C. § 1125(d)(2). See Choosing the Right Domain Name Dispute Procedure: A Practical Guide.

Phase 11: When the notice arrives (anonymous speaker)

• Calendar the deadline the day the notice arrives. Note: platforms commonly allow 10 to 30 days; in USA Technologies, Inc. v. Doe, 713 F. Supp. 2d 901 (N.D. Cal. 2010), the board operator gave the poster 15 days. The notice window is usually the whole defense.
• Do not delete, edit, or repost the content, and preserve your drafts, receipts, and messages. Note: deletion after notice invites a spoliation finding, and your own records may prove the post was true.
• Do not contact the plaintiff or post about the subpoena, and ask the platform in writing to hold production while you move to quash.
• Get the complaint, motion, order, and subpoena, identify the compliance court, and find counsel at once: a First Amendment lawyer, a public interest organization, or a law school clinic.
• Decide with counsel whether you are a defendant or a witness; whether each statement was true, opinion, or your own experience; and whether a confidentiality agreement covers what you posted.

Phase 12: Move to quash without giving up your name (anonymous speaker)

• File before the deadline in the right court; in federal cases, that is the court for the district where compliance is required. Note: Fed. R. Civ. P. 45(d)(3) is the vehicle, and the First Amendment test supplies the standard. See 9A Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 2463.1 (3d ed.).
• Move to proceed anonymously and to file identifying material under seal, and notify the platform or provider the day you file. Note: for pseudonymous plaintiffs, courts balance the interest in anonymity against the public interest and prejudice to the other side, Sealed Plaintiff v. Sealed Defendant #1, 537 F.3d 185 (2d Cir. 2008); Doe v. Megless, 654 F.3d 404 (3d Cir. 2011). A Doe resisting a subpoena has a stronger claim because anonymity is the thing at stake, and the Digital Sin order invited requests to litigate anonymously and required movants to notify the providers.
• Support the motion with a declaration that proves facts without identifying you, and offer identifying exhibits for in camera review only.
• Argue for the most protective test that fits the speech, statement by statement: opinion, hyperbole, truth, and no evidence of falsity or harm. Note: Highfields Capital Management, L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005), demands evidence first and then a weighing of harms; the plaintiffs in SaleHoo Group, Ltd. v. ABC Co., 722 F. Supp. 2d 1210 (W.D. Wash. 2010), and USA Technologies rested on their pleadings and lost.
• Add the arguments specific to the speech: fair use, as in Art of Living; nothing confidential disclosed, as in Glassdoor v. Superior Court; protected concerted activity, 29 U.S.C. § 157; immunity under 18 U.S.C. § 1833(b) for a confidential report of suspected illegality to an official or a lawyer (not a public post); and, in file-sharing cases, that someone else used the connection, K-Beech, Inc. v. John Does 1-37, 296 F.R.D. 80 (E.D.N.Y. 2012). See Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law.
• Raise personal jurisdiction if the forum has no connection to you, knowing that some courts defer it until you are identified. Note: Arista Records LLC v. Does 1-19 and London-Sire deferred it, while AF Holdings requires a jurisdictional basis before discovery.
• Ask in the alternative for a protective order: disclosure to counsel only, use limited to the case, and sealed filings. See Confidentiality Toolkit: Protective Orders, Designation Challenges, and Sealing Motions.
• Evaluate an anti-SLAPP motion, which can be filed through counsel without a name, and any other fee-shifting. Note: Cal. Code Civ. Proc. § 425.16 stays discovery and awards fees to a prevailing defendant, and ZL Technologies observed that the unmasking and anti-SLAPP showings overlap. Consider § 1987.2 and sanctions under Rule 45(d)(1). See Publicity and Free Speech Toolkit: Transformative Use Memos, Newsworthiness Analyses, and Anti-SLAPP Motions.
• If disclosure is ordered, seek a stay the same day; disclosure cannot be undone.
• If you are identified, insist on limits and plan for judgment. Note: in Signature Management, the trial court limited pre-judgment disclosure to the court and plaintiff's counsel; after judgment, a Doe can rebut the presumption of unmasking by showing that it would chill substantial protected speech.

Phase 13: Respond to the demand (platform or provider)

• Log the demand (receipt date and method, issuing court, accounts, compliance date, objection deadline), and preserve the covered records at once.
• Validate it: a court with power over you (domesticated if it came from another state), proper service, compliance within 100 miles, and a reasonable time. Note: Yelp v. Hadeed. See Rule 45 Subpoena Response Checklist: A Practical Checklist.
• Identify the kind of process: a civil subpoena, a court order, a clerk-issued § 512(h) subpoena, or government process, which follows different rules. See Cross-Border Data Demand Response Checklist: A Practical Checklist.
• Produce no message contents to private litigants, 18 U.S.C. § 2702(a), and limit production to non-content records under § 2702(c)(6). Note: unlawful disclosure exposes the provider to suit under § 2707.
• Require a court order, and notify the subscriber, before disclosing a cable subscriber's identity. 47 U.S.C. § 551(c)(2)(B), (f).
• Apply sector rules: FERPA for student records, the Gramm-Leach-Bliley Act for financial information, and § 222 for telephone records.
• Notify the user promptly with copies of the papers and the date you will produce absent a motion. Note: platform notice satisfies or substitutes for the notice step in Dendrite and Cahill; in SaleHoo, the registrar forwarded the subpoena to the site owner.
• Decide whether to assert your users' rights, and decide consistently. Note: third-party standing is available, Enterline; Yelp Inc. v. Superior Court, 17 Cal. App. 5th 1 (2017). In Music Group, Twitter took no position but asked the court to apply the correct standard.
• Serve objections before the earlier of the compliance date or 14 days after service, Rule 45(d)(2)(B), and negotiate scope down to named accounts, dates, and categories.
• Produce only after the notice period and any motion, with a Rule 902(11) certification and an invoice for reasonable costs.
• Keep a legal-process log and a published policy. See Running a Platform That Hosts User Content: A Practical Guide.

Red flags that should change the plan

• Plaintiff: most statements are opinion; no witness can speak to falsity; limitations runs out within six months; the platform is in another state and the case is in state court; the IP addresses belong to a VPN; the speaker looks like a journalist, whistleblower, or genuine customer; the client mostly wants to punish criticism.
• Speaker: the statements were factual and you cannot show they were true; you signed a confidentiality agreement that covers what you posted; you posted from a work account or device; the court applies a pleading standard, as Illinois does.
• Platform: the subpoena seeks message contents; a cable subscriber's identity is requested without a court order; an out-of-state subpoena was never domesticated; the request covers hundreds of accounts or years of logs.

Frequently asked questions

How long does the whole sequence take? Three to six months uncontested through two tiers of subpoenas; a year or more if contested, and longer with appellate review.

Can a plaintiff skip the platform and go straight to the internet provider? Only with an IP address and an exact timestamp already in hand, which usually come from the platform's production or the plaintiff's own server logs.

What happens if a platform ignores the subpoena? The plaintiff moves to compel in the court for the district where compliance is required, which can hold a person in contempt for failing without adequate excuse to obey a subpoena. Fed. R. Civ. P. 45(g). In practice platforms respond, and the fight is over scope and standards.

Does a VPN make a speaker unidentifiable? Often, at least through civil discovery, but not always: a login from another network, a registration phone number, or a payment method can still lead to a person.

Practical takeaways

• Capture and calendar on day one; both clocks are already running.
• The early discovery motion is a merits motion. Bring evidence of falsity and harm, statement by statement.
• Ask the platform for non-content records only, for named accounts and dates.
• Recite § 551 only for cable operators, and domesticate state subpoenas where the records are kept.
• An IP subscriber is a lead, not a defendant. Corroborate before naming anyone.
• For speakers, the notice window is the defense: preserve, get counsel, and move to quash anonymously.
• For platforms, a written policy applied consistently protects against both sides.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment: the doctrine behind every item in this checklist.
• Defamation, Business Disparagement, and Online Reviews: whether the post is actionable at all.
• Anti-SLAPP Statutes and Strategic Litigation Against Public Participation: the fee-shifting motion that follows a weak unmasking effort.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: why the platform is a witness, not a defendant.
• Rule 45 Subpoenas to Nonparties: Service, Objections, and Motions to Quash: the subpoena mechanics behind Phases 7, 8, and 13.
• Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue: how precisely a leak plaintiff must describe the secret before it can take discovery.

Related Guides

• Identifying an Anonymous Defendant Online: A Practical Guide: the same process told step by step, with timelines and costs.
• Filing an Anti-SLAPP Motion: A Practical Guide: the speaker's strongest procedural tool where it applies.
• Responding to a Third-Party Subpoena: A Practical Guide for Businesses: the recipient's side of compliance.
• Choosing the Right Domain Name Dispute Procedure: A Practical Guide: when the anonymous actor is a domain registrant.

Related Checklists

• Authenticating Website Evidence: A Practical Checklist: captures that survive an authentication challenge.
• Statute of Limitations Diary Checklist: A Practical Checklist: calendaring the deadline that unmasking does not stop.
• Protective Order and Sealing Checklist: A Practical Checklist: limits on how a disclosed identity may be used.
• Rule 45 Subpoena Response Checklist: A Practical Checklist: the recipient's deadlines and objections.
• Section 1782 Application Checklist: identification discovery for a foreign proceeding.
• Copyright Infringement Claim Evaluation Checklist: A Practical Checklist: testing an infringement claim before seeking a name.

Related Toolkits

• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: templates for the motion, proposed order, subpoena riders, and motion to quash.
• Publicity and Free Speech Toolkit: Transformative Use Memos, Newsworthiness Analyses, and Anti-SLAPP Motions: motion papers for speech-based defenses.
• Confidentiality Toolkit: Protective Orders, Designation Challenges, and Sealing Motions: protective order and sealing papers for identity information.
• Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses: the platform's terms and legal-process procedures.