Identifying an Anonymous Defendant Online: A Practical Guide

Summary. This guide walks a plaintiff's lawyer, step by step, from the first screenshot of an anonymous post to an amended complaint naming a real defendant, and shows the anonymous speaker and the subpoenaed platform what to do at each stage. It starts with the threshold decision whether a name is worth pursuing, then covers evidence capture, lawful investigation without a subpoena and the ethical lines around pretexting and account access, and a map of who holds identifying data and what legal process reaches it. The core steps cover choosing the claim, court, and limitations strategy; drafting the Doe complaint; moving for early discovery under Rule 26(d)(1); serving first- and second-tier Rule 45 subpoenas on platforms, internet providers, email services, carriers, registrars, and payment processors; managing notice periods and motions to quash; and verifying, amending, and serving. Separate sections cover the DMCA subpoena, state pre-suit procedures, cross-border routes, and response protocols for the anonymous defendant and the platform. A timeline and cost table, an extended worked example involving a startup's leaked investor deck, common mistakes, an FAQ, and practical takeaways close the guide.

On a Sunday evening, the founder of a 30-person robotics startup gets a text from a board member with a link. An account with no photo, no name, and 200 followers has posted four slides from the company's confidential Series A deck, including the monthly burn rate and the name of the largest customer, with the caption "this is what they're hiding from you." By Monday morning a full copy of the deck is sitting on a file-sharing site. The founder has three questions: who did this, how fast can we find out, and what happens to us if we guess wrong?

Those questions have answers, but they come in a fixed order. Identification is a sequence of small legal steps, each with its own standard, its own clock, and its own chance for the other side to object. Skipping a step, or taking them out of order, is how plaintiffs end up with a quashed subpoena, an expired claim, or the wrong person's name in a public complaint.

The short answer

• Capture first, then decide. Preserve every post with URLs, timestamps, and account details before anything is deleted, then decide whether the goal (removal, deterrence, damages, an injunction) actually requires a name.
• Investigate within the lines. Public information, your own records, document metadata, and writing style are fair game. Fake accounts, pretext calls, guessing passwords, and "bait" links aimed at the anonymous person are not, or are close enough to the line to make them a bad idea. See Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.
• Identification usually takes two or three subpoenas. The platform gives you an email address and IP logs; the internet provider, email service, or phone carrier gives you a subscriber; corroboration tells you whether the subscriber is the speaker.
• Most of it requires a lawsuit and a court order. File against "John Doe," move for leave to serve subpoenas before the Rule 26(f) conference under Fed. R. Civ. P. 26(d)(1), and expect to make a First Amendment showing with evidence. The legal standards are explained in Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment.
• Some routes skip the lawsuit. Copyright owners can get a clerk-issued subpoena under 17 U.S.C. § 512(h); some states allow pre-suit petitions; foreign litigants can use 28 U.S.C. § 1782.
• Two clocks start on the day of the post. Providers keep IP records for limited periods, and defamation claims often expire in a year. Neither clock stops while subpoenas are litigated.
• Expect three to six months uncontested, and fees from the high four figures into five figures. Contested identification takes longer and costs more, and a meaningful share of trails end at a VPN or public Wi-Fi.

Before you start: do you actually need the name?

Identification is expensive and public. A Doe complaint quoting the offending posts can draw more attention to them than the posts ever received. Before filing, walk the client through what a name will and will not accomplish.

Takedown mechanics are covered in How to File a DMCA Takedown Notice (And Respond to One) and, for trademark infringers on marketplaces, Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide. Domain disputes have their own menu of procedures; see Choosing the Right Domain Name Dispute Procedure: A Practical Guide.

Pursue the name when the harm is serious and continuing, the claim is provable with evidence the client already has or can get, and a judgment or injunction against an individual would change the outcome. Do not pursue it to punish criticism. Courts can tell the difference, anti-SLAPP statutes impose fees on plaintiffs who cannot make the showing, and the case law in this area is full of businesses that made their critics famous.

Step 1: Preserve the evidence and stop the bleeding

Capture everything, properly. For each post, comment, review, or upload, record the full URL, the account name and any numeric account ID, the date and time displayed (with the time zone), the date and time of capture, and the surrounding context (the thread, the replies, the profile page). Use a capture method that records the URL and a hash of the captured file, and have the person who captured it sign a short declaration describing how. A screenshot with no URL bar and no capture record invites an authentication fight under Fed. R. Evid. 901. See Authenticating Website Evidence: A Practical Checklist.

Capture the account, not just the posts. Profile text, creation date, follower lists, linked accounts, profile images, and any other posts by the same account often contain the clue that matters later: a reference to a city, a time-zone pattern, a phrase the client recognizes.

Preserve the client's own data. Server logs, analytics, data-room access records, customer databases, email, and chat logs may identify or corroborate the speaker, and the client's duty to preserve relevant evidence begins when litigation is reasonably anticipated. Issue a written hold. See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Send preservation requests, but do not rely on them. A short letter to the platform identifying the account and asking that it preserve subscriber and access records costs nothing. But the statutory preservation mechanism in 18 U.S.C. § 2703(f) is available only to governmental entities, and many platforms honor civil preservation requests only once a subpoena or order arrives. The reliable preservation tool is getting a subpoena served quickly.

Use takedown tools in parallel. Removal and identification are not mutually exclusive, and removal limits damages that the client cannot recover anyway. Preserve first, then report.

Step 2: Investigate without a subpoena, and know where to stop

A surprising share of anonymous accounts can be attributed, or at least narrowed, without compulsory process. That work also supplies the evidence the court will want to see in the early-discovery motion, because Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), and the cases following it ask what the plaintiff has already done to find the defendant.

What is fair game.

• Open sources. Search the handle, the email address if one is visible, profile images (by reverse image search), and distinctive phrases across platforms. People reuse usernames and pictures.
• Document and file metadata. A leaked file may carry an author name, organization, creation software, or revision history. Platforms usually strip image metadata, but files posted to document hosts or sent as attachments often keep it.
• Your own records. A data room that watermarks each recipient's copy, view analytics showing which account opened a document from which IP address, customer databases that show whether a "customer" ever bought anything, and server logs of who visited a page shortly before it was quoted are all the client's own information.
• Writing style and timing. Repeated misspellings, unusual phrasing, posting hours that track a particular shift or time zone, and references only an insider would know. These clues rarely identify anyone by themselves, but they direct the subpoenas and later corroborate the result.
• Registration and payment trails. Domain registration data (now delivered through RDAP, the successor to WHOIS) usually shows only a privacy service, but historical records sometimes predate the privacy service; payment pages, donation links, and affiliate codes can point to a payment account.
• Licensed investigators. Private investigators can do lawful public-records and field work. Courts have accepted investigators posing as ordinary customers to detect ongoing infringement. Apple Corps Ltd. v. International Collectors Society, 15 F. Supp. 2d 456 (D.N.J. 1998); Gidatex, S.r.L. v. Campaniello Imports, Ltd., 82 F. Supp. 2d 119 (S.D.N.Y. 1999). The lawyer remains responsible for what the investigator does under ABA Model Rule 5.3.

Where to stop.

• No deception aimed at the person. A lawyer may not make false statements of fact to third persons (Model Rule 4.1) or engage in conduct involving dishonesty, fraud, deceit, or misrepresentation (Model Rule 8.4(c)), and cannot do through an investigator what the lawyer cannot do directly (Model Rule 8.4(a)). Bar opinions treat "friending" a witness through a fake or borrowed profile to see private content as deceptive (Philadelphia Bar Ass'n Prof'l Guidance Comm. Op. 2009-02; N.Y.C. Bar Ass'n Formal Op. 2010-2), while passive review of public content is permitted (see ABA Formal Op. 466 (2014), addressing review of jurors' public social media). Oregon's experience is the cautionary tale: its supreme court disciplined a lawyer for pretext calls in In re Gatti, 330 Or. 517, 8 P.3d 966 (2000), and the state later amended its rules to permit supervised covert investigation.
• No pretexting for records. Obtaining telephone records by false pretenses is a federal crime, 18 U.S.C. § 1039, and so is obtaining a customer's financial information from a financial institution by false pretenses, 15 U.S.C. § 6821.
• No account access. Logging into the anonymous account by guessing a password, or using credentials someone else supplies, risks liability under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the Stored Communications Act's prohibition on unauthorized access to stored communications, 18 U.S.C. § 2701. Consent procured by exploiting a known mistake (there, a patently overbroad subpoena that the provider obeyed) does not make access authorized. Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004). After Van Buren v. United States, 593 U.S. 374 (2021), the CFAA's "exceeds authorized access" clause is narrower than it once was, but the "without authorization" clause still covers entering an account that is simply not yours.
• Be wary of bait links. Sending the anonymous account a tracked link to capture its IP address involves a communication with a likely adverse party under false pretenses and may implicate federal and state interception and pen-register statutes, including 18 U.S.C. § 2511. Even when it might be lawful, it hands the defense an argument that the plaintiff's own conduct was improper. Get the IP address from the platform under a subpoena instead.
• Do not contact a represented person. If the anonymous speaker appears through counsel, communications go through counsel (Model Rule 4.2).

Write down every step taken and its result. That log becomes the "steps already taken" section of the early-discovery motion.

Step 3: Map who holds the identifying data

Every anonymous post leaves records with several companies, and each company answers to a different statute. Before drafting anything, list the possible record holders, note the legal process each one requires, and pick the shortest chain from the post to a person. The Stored Communications Act frames the whole exercise: it separates the "contents" of a communication (what was said) from non-content records (who held the account, when they logged in, from which IP address, and how they paid).

Three practical rules follow from the table.

Records, not contents. A civil litigant can get who-and-when data from a provider, never what-was-said data. If the case needs the anonymous person's private messages, the route runs through that person after identification, in party discovery under Fed. R. Civ. P. 34, not through the provider. Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010), quashed subpoenas seeking private messages from social networking sites for exactly this reason.

Timestamps are the key, not IP addresses. Residential internet providers reassign addresses, so an IP address without a precise timestamp and time zone identifies nobody. Ask the platform for login times in Coordinated Universal Time (UTC) to the second, and for source ports if it logs them.

Retention runs from the day of the post. Providers keep IP-assignment logs for limited periods, and courts treat that routine purging as a reason to allow early discovery. London-Sire Records, Inc. v. Doe 1, 542 F. Supp. 2d 153 (D. Mass. 2008). Under the cable statute's destruction requirement, an operator may lawfully discard the data unless a request or order is pending, so the order is also the best preservation tool.

The client's own systems deserve a separate warning. Company-owned devices and accounts, reviewed under a written policy, are fair game. An employee's personal email or social media account is not, even if the password is saved on a company laptop: an employer that used stored passwords to read a former employee's personal web-mail violated the Stored Communications Act. Pure Power Boot Camp v. Warrior Fitness Boot Camp, 587 F. Supp. 2d 548 (S.D.N.Y. 2008). Run any insider inquiry through counsel; see Conducting an Internal Investigation: Scope, Privilege, and Reporting.

Most chains look like one of these:

• Review or social post: platform, then internet provider (two tiers).
• Account opened with a throwaway email: platform, then email provider, then internet provider (three tiers).
• Gripe site on its own domain: registrar or privacy service, then host or payment processor.
• Marketplace seller: marketplace (often one tier, because of the verified seller data).

Step 4: Choose the claim, the court, and the clock

The claim

Unmasking standards test the merits early, so the claim you plead is the claim you will have to support with evidence in the very first motion. Pick the one the client's existing evidence proves best.

Start by triaging the content. Statements of verifiable fact can be defamatory; opinion, rhetorical hyperbole, and insults generally cannot. Milkovich v. Lorain Journal Co., 497 U.S. 1 (1990). "Overpriced and rude" is not a case. "They served me spoiled shrimp on March 3" may be, if the restaurant can prove it served no shrimp that day.

Two cautions about copyright. Suit requires a registration or a refusal first, 17 U.S.C. § 411(a); Fourth Estate Public Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. 296 (2019), although the Copyright Office's special handling service ($800 per claim) usually produces a decision within days. And a copyright claim aimed at criticism invites a fair use fight that courts take seriously at the unmasking stage. A copyright owner must consider fair use before sending a takedown notice, Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), and that notice is the predicate for the DMCA subpoena discussed below. For the underlying tort, see Defamation, Business Disparagement, and Online Reviews.

The court

• Federal court needs a federal claim. A Doe defendant defeats diversity jurisdiction, because no one can confirm complete diversity under 28 U.S.C. § 1332 without knowing the defendant's citizenship; the Seventh Circuit treats such defendants as not permitted in diversity suits. Howell v. Tribune Entertainment Co., 106 F.3d 215 (7th Cir. 1997). With a federal claim, related state claims come along under 28 U.S.C. § 1367.
• Otherwise, state court. Prefer the state where the speaker probably lives or where the harm was aimed, and one whose Doe statute allows later substitution of the true name (California Code of Civil Procedure § 474 and New York CPLR 1024 are the usual examples).
• Personal jurisdiction still matters. Posting statements that can be read in the forum is not enough. Sinclair v. TubeSockTedD, 596 F. Supp. 2d 128 (D.D.C. 2009); see Walden v. Fiore, 571 U.S. 277 (2014); compare Calder v. Jones, 465 U.S. 783 (1984). Courts expect a good-faith basis, often IP geolocation, for believing the Doe can be sued where you filed. AF Holdings, LLC v. Does 1-1058, 752 F.3d 990 (D.C. Cir. 2014). See Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.
• Plan for where the records are. A federal subpoena is enforced in the court for the district where compliance is required, Fed. R. Civ. P. 45(d)(3), and a state-court subpoena must be domesticated in the platform's home state under that state's version of the Uniform Interstate Depositions and Discovery Act (California's is Code of Civil Procedure § 2029.100 and following). The Supreme Court of Virginia vacated a contempt order against a review site because a Virginia subpoena could not reach records kept in California. Yelp, Inc. v. Hadeed Carpet Cleaning, Inc., 289 Va. 426 (2015).

The clock

A Doe complaint stops the clock only if the later amendment naming the real defendant relates back. Most circuits hold that not knowing a name is not a "mistake concerning the proper party's identity" under Fed. R. Civ. P. 15(c)(1)(C), even after Krupski v. Costa Crociere S.p.A., 560 U.S. 538 (2010). Herrera v. Cleveland, 8 F.4th 493 (7th Cir. 2021); Barrow v. Wethersfield Police Department, 66 F.3d 466 (2d Cir. 1995); Wayne v. Jarvis, 197 F.3d 1098 (11th Cir. 1999). The better route is Rule 15(c)(1)(A), which borrows a state's more generous Doe rule: California's, in Lindley v. General Electric Co., 780 F.2d 797 (9th Cir. 1986), and New York's, which requires diligence before the period runs and a description that gives fair notice, in Hogan v. Fischer, 738 F.3d 509 (2d Cir. 2013). If a federal court later dismisses the federal claim, 28 U.S.C. § 1367(d) stops the clock on the supplemental state claims while they were pending and for 30 days after dismissal. Artis v. District of Columbia, 583 U.S. 71 (2018).

The data-retention clock is almost always shorter than any limitations period. A sound rule: file within two to four weeks of discovering the post, and never let the shortest limitations period come within six months of expiring before the platform subpoena is served. For calendaring, see Statutes of Limitations, Accrual, and Tolling: The Clock That Ends Most Claims.

Step 5: Draft the Doe complaint

Federal courts permit unnamed defendants when the plaintiff cannot learn the name before filing, and they allow discovery to identify them unless discovery plainly would not uncover the name or the complaint would be dismissed anyway. Gillespie v. Civiletti, 629 F.2d 637 (9th Cir. 1980); Wakefield v. Thompson, 177 F.3d 1160 (9th Cir. 1999). The complaint is also the first exhibit to the early-discovery motion, so write it for a skeptical judge, not for the client.

1. Name each Doe by what you know. "John Doe, the person who operates the account @example (numeric account ID 1580...)" is better than "John Does 1-10," because handles change and numeric IDs do not. Use one Doe per account unless evidence shows one person runs several. Lumping unrelated Does together invites severance under Fed. R. Civ. P. 21 and the skepticism the mass file-sharing cases earned. AF Holdings.
2. Quote the exact statements and plead why each is false. The unmasking tests require the exact words, and the pleading standard requires facts rather than labels. Ashcroft v. Iqbal, 556 U.S. 662 (2009). Facts peculiarly within the Doe's knowledge may be pleaded on information and belief. Arista Records, LLC v. Doe 3, 604 F.3d 110 (2d Cir. 2010). If you claim trade libel or other special damages, state them specifically, as Fed. R. Civ. P. 9(g) requires.
3. Plead jurisdiction honestly. Identify the federal claim and the supplemental claims, and state the facts supporting personal jurisdiction: geolocation, references to local places, the forum focus of the statements. Say what discovery is expected to show.
4. Do not republish the harm. Quote only what the claim needs. Confidential financial data and trade secrets belong under seal. Before ordering disclosure of claimed trade secret information, a federal court must let the owner file a sealed submission explaining its interest in confidentiality, 18 U.S.C. § 1835(b), and Fed. R. Civ. P. 26(c) authorizes protective orders. File the motion to seal with the complaint. See Negotiating a Protective Order and Filing Under Seal: A Practical Guide.
5. Decide whether the plaintiff needs a pseudonym too. For a harassment victim, a public complaint can reproduce the injury. Fed. R. Civ. P. 10(a) presumes named parties, but courts allow pseudonymous plaintiffs after weighing the plaintiff's need against the public's and the defendant's interests under multi-factor tests. Sealed Plaintiff v. Sealed Defendant #1, 537 F.3d 185 (2d Cir. 2008); Doe v. Megless, 654 F.3d 404 (3d Cir. 2011). The motion must be filed with the complaint, not after.
6. Plead only what the evidence supports. Fed. R. Civ. P. 11(b)(3) requires factual contentions that have, or are likely to have after discovery, evidentiary support. If the client suspects a particular person, do not name or describe that person until the evidence catches up. Statements in pleadings are usually privileged against defamation claims; the same accusation repeated to employees, customers, or reporters usually is not.
7. Ask for relief that justifies the effort. Courts rarely enjoin speech before its falsity has been adjudicated, but they routinely grant interim relief against continued disclosure of trade secrets and confidential documents under Fed. R. Civ. P. 65. If a leak is ongoing, file the motion for a temporary restraining order with the complaint and ask the court to authorize notice through the platform's messaging system. See Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

The federal filing fee is $405. State fees vary but are usually lower.

Step 6: Move for early discovery

No party may seek discovery before the Rule 26(f) conference without a stipulation or court order, Fed. R. Civ. P. 26(d)(1), and a Doe cannot confer. The plaintiff therefore files a motion, usually ex parte, for leave to serve subpoenas on the record holders identified in Step 3. In state court the vehicle varies (a motion for early discovery, a commission for an out-of-state subpoena, or a pre-suit petition), but the showing is the same.

The standard

Most federal courts apply a "good cause" test, Semitool, Inc. v. Tokyo Electron America, Inc., 208 F.R.D. 273 (N.D. Cal. 2002), and treat identifying a Doe as the classic example of good cause, because the defendant "must be identified before this suit can progress further." Arista Records LLC v. Does 1-19, 551 F. Supp. 2d 1 (D.D.C. 2008). The good-cause inquiry then absorbs the forum's First Amendment test: the four safeguards of Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999); the five factors of Sony Music Entertainment Inc. v. Does 1-40, 326 F. Supp. 2d 556 (S.D.N.Y. 2004), in the Second Circuit; the evidence-then-balancing test of Highfields Capital Management, L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005), for expressive speech; or Dendrite and Cahill in state courts that follow them. The differences among those tests are explained in the companion article, Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment. The most persuasive sentence in the motion is usually some version of "the result is the same under any of them," followed by the evidence that makes it true.

Judges do not have unlimited discretion to say no. The D.C. Circuit reversed a refusal to allow a single-Doe identification subpoena because the refusal rested on distaste for the plaintiff's business and speculation about its motives rather than the governing standard. Strike 3 Holdings, LLC v. Doe, 964 F.3d 1203 (D.C. Cir. 2020).

The evidence

Every declaration should be signed under penalty of perjury, 28 U.S.C. § 1746, by someone with personal knowledge.

Courts deny motions supported only by the complaint. The District of Arizona refused early discovery where the complaint did not identify a single false statement or misuse of the mark. Best Western International, Inc. v. Doe, No. CV-06-1537 (D. Ariz. July 25, 2006).

The proposed order

The order does more work than the brief. Draft it to cover every tier, so that the case does not need a new motion each time a production points to a new provider.

1. Leave to serve Rule 45 subpoenas on named providers, for named accounts and date ranges.
2. Scope limited to subscriber identity and the non-content records listed in 18 U.S.C. § 2703(c)(2): name, address, session times, IP addresses, length of service, and means of payment. No contents.
3. Follow-on subpoenas: leave to serve the same limited subpoena on any provider identified in an earlier production.
4. Cable Act language: a statement that the order is a court order authorizing disclosure under 47 U.S.C. § 551(c)(2)(B). Without it, cable operators decline to produce.
5. Notice to the user: each provider must notify the affected user or subscriber within a set time (seven days is common), enclosing the order and subpoena, and must withhold production for a set period (often 30 days) so the user can move to quash. Courts favor making the subpoenaed provider the messenger, because it has the contact information. Mobilisa, Inc. v. Doe, 217 Ariz. 103 (Ct. App. 2007); Solers, Inc. v. Doe, 977 A.2d 941 (D.C. 2009).
6. Preservation of responsive data while any dispute is pending.
7. Use restriction: information produced may be used only for this litigation, with an optional attorneys'-eyes-only period. Courts have broad power to restrict the use of discovered information. Seattle Times Co. v. Rhinehart, 467 U.S. 20 (1984).
8. Notice by posting, where the forum allows it: a message on the same board or thread describing the motion, as Dendrite contemplates and as the plaintiffs did in Doe I v. Individuals, 561 F. Supp. 2d 249 (D. Conn. 2008).

Unopposed motions are typically decided in one to four weeks, sometimes after a short hearing. If the motion is denied, read the order closely: most denials identify the missing evidence, and a supplemented motion often succeeds. Model motion papers, a proposed order, and subpoena riders are collected in John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Step 7: Serve the subpoenas and follow the trail

The first tier: the platform

Serve the platform the day the order issues. A good platform subpoena has these features:

• Form and signature. A Rule 45 subpoena may be issued by the clerk or signed by an attorney authorized to practice in the issuing court, Fed. R. Civ. P. 45(a)(3). Attach the order.
• A precise target. The account URL, the handle, and the numeric account ID; the date range; and the data categories copied word for word from the order. Ask that timestamps be produced in UTC.
• A place of compliance within 100 miles of where the platform regularly transacts business in person, Fed. R. Civ. P. 45(c)(2)(A). In practice production arrives electronically, but the stated place determines which court hears any dispute.
• A business-records certification. Request a certification under Fed. R. Evid. 902(11) so the production is admissible as a business record under Fed. R. Evid. 803(6) without a custodian at trial.
• Proper service. Serve the platform's registered agent unless it has agreed in writing to accept service another way. Many large platforms publish legal-process guidelines; read them, because they say what the platform keeps and for how long. A state-court subpoena must first be domesticated in the platform's state.
• Notice to parties. A subpoena for documents must be noticed to the other parties before service, Fed. R. Civ. P. 45(a)(4). Before any Doe appears there is no one to notify, but once a Doe appears through counsel, every later subpoena must be noticed.

For the mechanics of nonparty subpoenas generally, see Rule 45 Subpoenas to Nonparties: Service, Objections, and Motions to Quash.

The notice window and motions to quash

After service, the platform's legal team checks the subpoena and the order, emails the user at the registration address, and sets a deadline, commonly 10 to 30 days. Three things can happen.

Nothing. The deadline passes and the platform produces. This is the most common outcome.

The platform objects. Written objections are due before the earlier of the compliance date or 14 days after service, and an objection suspends the duty to comply until a court orders it. Fed. R. Civ. P. 45(d)(2)(B). Meet and confer first; most objections are about breadth and can be cured by narrowing. Otherwise, move to compel in the court for the district where compliance is required. That court may transfer the motion to the issuing court only with the platform's consent or in exceptional circumstances, Fed. R. Civ. P. 45(f), and it may redo the First Amendment analysis itself. Music Group Macao Commercial Offshore Ltd. v. Does, 82 F. Supp. 3d 979 (N.D. Cal. 2015). Platforms generally have standing to assert their users' rights. Enterline v. Pocono Medical Center, 751 F. Supp. 2d 782 (M.D. Pa. 2008); Glassdoor, Inc. v. Superior Court, 9 Cal. App. 5th 623 (2017).

The user moves to quash. The motion is filed anonymously in the compliance court, often with a pseudonymous declaration about the speech and the harm disclosure would cause. The plaintiff responds with the same evidence that won the order. Courts can grant, deny, or split the difference. In a § 512(h) dispute over a pseudonymous Reddit user who posted a religious organization's advertisement to criticize its fundraising, a magistrate judge found that the balance of harms tipped sharply toward the user, then ordered disclosure only to the copyright owner's attorneys of record, barred them from sharing the name even with their client without leave, and directed that any lawsuit be filed under the pseudonym. In re DMCA Subpoena to Reddit, Inc., 383 F. Supp. 3d 900 (N.D. Cal. 2019). A plaintiff who offers that kind of restriction up front often avoids the fight.

The issuing party must also avoid imposing undue burden or expense on the platform, Fed. R. Civ. P. 45(d)(1), and a court ordering compliance over objection must protect the nonparty from significant expense. Narrow requests are cheaper, faster, and harder to quash.

The second tier: the providers behind the data

The platform's production is usually a spreadsheet: a registration email, perhaps a phone number, and a list of IP addresses and timestamps. Read it like an investigator.

1. Classify each IP address. Public registry data shows which company holds each address block and whether it is residential, mobile, a hosting company, or a known VPN or Tor exit. Residential addresses from the relevant nights are the best leads.
2. Normalize the timestamps. Convert everything to UTC and note daylight saving changes. An hour's error can identify the wrong household.
3. Pick the next subpoena. A residential cable address goes to the cable operator under the § 551 language in the order; the operator notifies the subscriber and usually produces after about 30 days. A mobile address goes to the carrier, but only with a source port, which many platforms do not log. An email address goes to the email provider, which produces its own IP logs and starts another tier. A phone number goes to the carrier, or to the app that issued a virtual number. Payment data goes to the processor or bank.
4. Recognize dead ends early. Commercial VPNs that keep no logs, Tor, public Wi-Fi, prepaid phones, and providers outside the United States end most trails that do end. Tell the client promptly, and look for a slip: one login without the VPN is often all it takes.
5. Stay inside the order. A subpoena that exceeds the authorization or demands contents creates liability for the plaintiff and its lawyers, Theofel v. Farey-Jones; 18 U.S.C. § 2707, and abusive identification campaigns have produced sanctions under 28 U.S.C. § 1927, as in Lightspeed Media Corp. v. Smith, 761 F.3d 699 (7th Cir. 2014).

Step 8: Verify, amend, and serve

Treat the subscriber as a lead, not a defendant. The person who pays for an internet connection may be a parent, a roommate, a landlord, an employer, or a café. The Ninth Circuit held that alleging someone is the subscriber of an IP address used to infringe does not, without more, state a claim against that person when many people used the connection. Cobbler Nevada, LLC v. Gonzales, 901 F.3d 1142 (9th Cir. 2018). Courts in the file-sharing cases put it bluntly: the infringer could be the subscriber, a family member, an employee, a guest, or a neighbor. K-Beech, Inc. v. John Does 1-37, 296 F.R.D. 80 (E.D.N.Y. 2012). In one case the plaintiff's own counsel estimated that about 30 percent of the names internet providers produced were not the people who downloaded the work. Digital Sin, Inc. v. Does 1-176, 279 F.R.D. 239 (S.D.N.Y. 2012).

Corroborate with independent facts. Who lives or works at the service address; whether that person has a connection to the plaintiff (a former employee, a competitor, an ex-partner); whether the content reflects knowledge only that person had; whether posting times match that person's schedule; whether the plaintiff's own logs place that person near the material. Writing-style comparisons help, but an expert's stylometric opinion must satisfy Fed. R. Evid. 702, and courts treat it as corroboration rather than proof. See Expert Witnesses After the 2023 Amendment to Rule 702: Daubert, Disclosure, and Cross-Examination. When the subscriber is a household or business, a courteous letter to the subscriber, or a short deposition limited to who used the connection, can resolve the question; seek leave first if the order does not cover it.

Amend and clean up. Substitute the real name by amendment under Fed. R. Civ. P. 15, and dismiss Does who turned out to be innocent or untraceable by notice under Fed. R. Civ. P. 41(a)(1)(A)(i). Keep the relation-back analysis from Step 4 in the file; the defendant's first motion may raise it.

Serve within the time allowed. Fed. R. Civ. P. 4(m) presumptively allows 90 days from filing and requires an extension for good cause. Identification often takes longer, so move to extend before the period runs, with a declaration showing diligence. Ask the newly named defendant to waive service under Rule 4(d). A defendant abroad must be served under Rule 4(f), which is exempt from the 90-day limit, usually through the Hague Service Convention when the defendant's country is a party; when international agreements do not forbid it, courts may authorize service by email under Rule 4(f)(3). Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002). See Service of Process: Domestic and International Methods That Work.

Decide how public the name should be. A protective order under Fed. R. Civ. P. 26(c) can keep the identity among counsel while the merits are tested. If the plaintiff wins, the Sixth Circuit recognizes a presumption in favor of unmasking the defendant publicly, which the defendant can rebut by showing that disclosure would chill substantial protected speech. Signature Management Team, LLC v. Doe, 876 F.3d 831 (6th Cir. 2017).

Expect the merits fight to begin immediately. In states with strong anti-SLAPP statutes, the named defendant may file a special motion to strike that stays discovery and shifts fees (California's is Code of Civil Procedure § 425.16). Whether those statutes apply in federal court depends on the circuit. The Ninth Circuit applies California's statute to state-law claims, United States ex rel. Newsham v. Lockheed Missiles & Space Co., 190 F.3d 963 (9th Cir. 1999), testing the motion under federal pleading and summary judgment standards, Planned Parenthood Federation of America, Inc. v. Center for Medical Progress, 890 F.3d 828 (9th Cir. 2018), while the D.C. and Second Circuits decline to apply state special-motion procedures in federal court. Abbas v. Foreign Policy Group, LLC, 783 F.3d 1328 (D.C. Cir. 2015); La Liberte v. Reid, 966 F.3d 79 (2d Cir. 2020). The good news for a plaintiff who did Step 6 properly is that the same evidence answers both motions. For the defense side, see Filing an Anti-SLAPP Motion: A Practical Guide.

Routes that skip or supplement the lawsuit

The DMCA subpoena

A copyright owner, or its authorized agent, can ask the clerk of any federal district court to issue a subpoena to a service provider without filing a lawsuit. 17 U.S.C. § 512(h). The request consists of three documents: a copy of a takedown notice that meets 17 U.S.C. § 512(c)(3)(A), a proposed subpoena, and a sworn declaration that the purpose is to obtain the identity of an alleged infringer and that the information will be used only to protect rights under the Copyright Act. If the papers are in order, the clerk "shall expeditiously issue" the subpoena, and the provider must expeditiously disclose information sufficient to identify the alleged infringer, to the extent it has that information.

The shortcut has hard edges:

• Hosts, not pipes. It reaches providers that store material or link to it. It does not reach an internet provider acting only as a conduit. Recording Industry Ass'n of America, Inc. v. Verizon Internet Services, Inc., 351 F.3d 1229 (D.C. Cir. 2003); In re Charter Communications, Inc., Subpoena Enforcement Matter, 393 F.3d 771 (8th Cir. 2005). So when the host produces only an IP address, the second tier usually requires a Doe lawsuit and a court order after all.
• Copyright purposes only. The sworn declaration limits use of the identity to protecting copyright. Using a DMCA subpoena to find a critic for a defamation suit is an abuse that courts and opposing counsel will notice.
• Fair use comes first. The predicate takedown notice requires a good-faith consideration of fair use, Lenz, and a target who moves to quash will get a First Amendment analysis, as the Reddit user did. In re DMCA Subpoena to Reddit, Inc..

For the takedown notice itself, see How to File a DMCA Takedown Notice (And Respond to One) and the Copyright Enforcement and DMCA Toolkit: A Roadmap and Research Guide.

State pre-suit procedures

Several states let a prospective plaintiff seek identity before filing a complaint.

Federal practice has no true equivalent. Fed. R. Civ. P. 27 allows a petition to perpetuate testimony that might otherwise be lost, and courts generally refuse to let it serve as a device for finding out whom to sue.

Cross-border routes

A foreign plaintiff and a U.S. platform. 28 U.S.C. § 1782 lets a district court order a person who resides or is found in the district to produce documents for use in a foreign proceeding, which need only be within reasonable contemplation. Courts weigh the discretionary factors of Intel Corp. v. Advanced Micro Devices, Inc., 542 U.S. 241 (2004), and private commercial arbitration does not qualify. ZF Automotive US, Inc. v. Luxshare, Ltd., 596 U.S. 619 (2022). Applicants have used § 1782 to seek subscriber records about anonymous reviewers and posters from U.S. platforms for defamation cases abroad, but the Stored Communications Act still bars contents, Suzlon Energy Ltd. v. Microsoft Corp., 671 F.3d 726 (9th Cir. 2011), and a resulting foreign defamation judgment is unenforceable here unless it satisfies U.S. free-speech standards, 28 U.S.C. § 4102. See Seeking or Opposing Section 1782 Discovery: A Practical Guide.

A U.S. plaintiff and a foreign record holder. A provider based abroad usually answers only to process from its own courts. The options are a letter of request under the Hague Evidence Convention, transmitted under 28 U.S.C. § 1781 (the Convention is not mandatory for discovery from parties before a U.S. court, Société Nationale Industrielle Aérospatiale v. United States District Court, 482 U.S. 522 (1987), but it is often the only practical route to a foreign nonparty), or a proceeding in the provider's home courts. In England and Wales, Ireland, and other common-law jurisdictions, that proceeding is an application for a Norwich Pharmacal order, which compels an innocent party "mixed up in" wrongdoing to identify the wrongdoer. Norwich Pharmacal Co. v. Customs & Excise Commissioners [1974] AC 133 (HL). Canadian courts issue similar orders and let internet providers recover their reasonable compliance costs. Rogers Communications Inc. v. Voltage Pictures, LLC, 2018 SCC 38. European data protection law does not forbid disclosure needed to bring legal claims, but providers there usually insist on a local order. Budget months, local counsel, and translation. The Cross-Border Discovery Toolkit: 1782 Applications, Hague Requests, and Blocking Statute Analyses has the forms.

Response protocols for the anonymous speaker and the platform

If you are the anonymous speaker

The notice email from the platform is the most important document you will receive. Most speakers who lose their anonymity lose it by doing nothing.

1. Calendar the deadline at once. Count from the date of the notice, not the date you read it. If you do nothing, the platform will produce.
2. Preserve everything; delete nothing. Deleting or editing the post after notice invites sanctions for lost electronic evidence under Fed. R. Civ. P. 37(e) and looks like consciousness of guilt.
3. Stay quiet. Do not contact the plaintiff, post about the subpoena, or ask friends to weigh in. Each message can identify you or create a new claim.
4. Get a lawyer fast. Public-interest organizations and law school clinics take some of these cases, and the fee-shifting tools below make others economical.
5. Ask the platform in writing to hold production while your motion is pending, and send it a file-stamped copy of the motion before the deadline.
6. Move to quash in the right court, under a pseudonym. File in the court for the district where compliance is required. Show that the statements are opinion, hyperbole, or true; that the plaintiff has no admissible evidence of falsity or harm; and that the speech addresses a matter of public concern. If the plaintiff's real need is to litigate, offer to participate through counsel: in Art of Living Foundation v. Does 1-10, No. 10-cv-05022 (N.D. Cal. Nov. 9, 2011), the blogger's active participation through counsel undercut the claimed need for his name.
7. Use the fee-shifting tools. California's anti-SLAPP statute (Code of Civil Procedure § 425.16), California's provision awarding fees to a speaker who quashes a California subpoena issued for an out-of-state case when the plaintiff fails to make a prima facie showing (§ 1987.2), and sanctions under Fed. R. Civ. P. 45(d)(1). See Anti-SLAPP Statutes and Strategic Litigation Against Public Participation.
8. Know what whistleblower law does and does not cover. Trade secret immunity protects confidential disclosures to government officials or a lawyer to report a suspected violation of law, and disclosures in sealed court filings, 18 U.S.C. § 1833(b); it does not protect a public post. Reports to the SEC are protected by 15 U.S.C. § 78u-6, and the SEC's rules forbid anyone from impeding them, 17 C.F.R. § 240.21F-17. Employees discussing working conditions may be engaged in protected concerted activity under 29 U.S.C. § 157. See Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law.
9. If you lose, seek a stay before production. Disclosure cannot be undone, so ask for a stay and immediate review: in federal court by mandamus under 28 U.S.C. § 1651 and Fed. R. App. P. 21, the route the speakers took, without success, in In re Anonymous Online Speakers, 661 F.3d 1168 (9th Cir. 2011).
10. Consider a negotiated exit. A plaintiff whose real goal is removal will often withdraw the subpoena if the post comes down or is corrected. Get the agreement in writing, with no admission.

If you are the platform or provider

1. Log the dates: service, the 14-day objection deadline, the compliance date, and the user notice period.
2. Check validity: a proper issuing court and signature; domestication for another state's subpoena; a court order (not just a subpoena) for cable subscriber data; for a DMCA subpoena, the clerk's signature and an attached notification.
3. Preserve the specified data immediately, so a dispute over production never becomes a dispute over destruction.
4. Notify the user under your published policy, enclosing the subpoena and order and stating the date you will produce absent a motion.
5. Object in writing within 14 days to overbreadth, to any request for contents, which 18 U.S.C. § 2702(a) forbids you to produce, and to undue burden. Decide whether to assert your users' First Amendment rights; courts recognize your standing to do so. McVicker v. King, 266 F.R.D. 92 (W.D. Pa. 2010).
6. Produce only non-content records, with a certification under Fed. R. Evid. 902(11), and keep an exact copy of the production.
7. Know your protections and exposure. Good-faith reliance on a court order is a complete defense to civil and criminal claims under the Stored Communications Act, 18 U.S.C. § 2707(e); producing cable subscriber data without the order § 551 requires exposes an operator to actual or liquidated damages, 47 U.S.C. § 551(f).
8. Do not treat a subpoena as a takedown demand. Section 230 generally keeps the host out of the merits, 47 U.S.C. § 230, and California's Supreme Court refused to let a plaintiff use a default judgment against a reviewer to order the nonparty platform to remove the reviews. Hassell v. Bird, 5 Cal. 5th 522 (2018) (plurality opinion).

The compliance side is covered in more depth in Responding to a Third-Party Subpoena: A Practical Guide for Businesses and Running a Platform That Hosts User Content: A Practical Guide.

Timeline and cost realities

Uncontested, the whole process usually takes three to six months and costs from the high four figures to the mid five figures. A contested motion can double or triple both numbers. Three realities belong in the first client meeting: a meaningful share of trails end at a VPN or a foreign provider; the person at the end of the trail may be judgment-proof; and identification by itself often ends the dispute, because a speaker who learns that a court has found a prima facie case usually takes the post down.

Worked example: the leaked investor deck

Return to the robotics startup from the opening. Call it Kestrel Robotics, an Oakland company with 30 employees, a Series A round in progress, and a confidentiality agreement signed by every employee.

Sunday night and Monday: capture and takedown. Counsel captures the four slides, the caption, the account's profile (created nine days earlier, a stock-photo avatar, 200 followers), and the file-sharing page, with URLs, timestamps, and file hashes, and the paralegal who made the captures signs a declaration. Kestrel owns the copyright in its deck. Before sending takedown notices, counsel considers fair use, as Lenz requires, and concludes that verbatim copying of an unpublished confidential document with a one-line caption is a weak fair use case. Both sites remove the material within two days. A litigation hold covers the data room, the shared drive, email, and company laptops.

Days 2 to 6: the view from inside. The data room shows that investors received version 8 of the deck. The leaked file is version 7, which differs in one slide: the runway figure was corrected between versions. Version 7 existed only on the internal drive, and the drive's audit log shows that six employees opened it in the ten days before the post. The leaked PDF's metadata shows that it was created with a print-to-PDF function at 11:52 p.m. on the Saturday before the post. Counsel interviews the six employees with Upjohn warnings (the lawyer represents the company, not the employee), using the Internal Investigation and Upjohn Warning Checklist: A Practical Checklist. No one admits anything.

The founder wants to fire the most likely suspect. Counsel says no, and answers the founder's third question from the opening. Guessing wrong is expensive: firing an innocent employee invites a wrongful termination claim, firing an employee who had raised concerns about investor disclosures invites a retaliation claim under state whistleblower law, and an accusation repeated around the office is not privileged. Counsel also declines to look at anyone's personal email or social media accounts, Pure Power Boot Camp, and sticks to company systems reviewed under the written device policy.

Week 2: filing. The customer identity, contract terms, and burn data are protectable trade secrets if Kestrel took reasonable measures to keep them secret and they derive economic value from not being generally known, 18 U.S.C. § 1839(3), and its confidentiality agreements, access controls, and watermarked data room are those measures. The trade secret claim supplies federal jurisdiction, and the contract claim rides along under 28 U.S.C. § 1367. Counsel files in the Northern District of California against "John Doe, the operator of the account" identified by handle and numeric ID, with the deck and the four slides lodged under seal. The early-discovery motion carries five declarations (capture, the CFO on confidentiality and authenticity, investor relations on harm, IT on the version history, and counsel on the steps taken). The proposed order covers the platform and the file host, authorizes follow-on subpoenas, includes the Cable Act paragraph, and requires seven days' notice to the user and a 30-day hold. The court grants it in nine days. Because Kestrel and the platform are both in the Northern District of California, the issuing court and the compliance court are the same, which removes one avenue of delay.

Weeks 3 to 6: the first tier. The platform notifies the account holder, who does not move to quash. The production shows a registration email at an encrypted email service based in Switzerland, no phone number, and eleven logins: nine through a commercial VPN and two from a residential cable address, at 11:58 p.m. Saturday and 12:04 a.m. Sunday (UTC times converted to Pacific). The file host's production shows the same email address and the same VPN.

Weeks 6 to 11: the second tier. The Swiss email provider is a dead end without Swiss process, and counsel advises against spending months on it. The cable operator receives a subpoena with the order attached, notifies its subscriber, waits 30 days, and produces a name: a woman at an Oakland duplex who has never worked for Kestrel.

Week 12: verification. Counsel does not amend yet. Public records and a public social media profile show that one of the six employees lives at the same address. His company laptop, reviewed under the device policy, shows version 7 printed to PDF at 11:52 p.m. that Saturday, matching the leaked file's metadata to the minute. A subscriber, a shared address, and a device-level match on a company computer: that is corroboration.

Months 3 and 4: resolution. Counsel amends to name the employee, and his lawyer accepts a waiver of service. The lawyer says his client believed the corrected runway figure in version 8 understated the burn and that investors were being misled. Trade secret immunity does not reach a public post, 18 U.S.C. § 1833(b), but the employee could have reported his concern to the SEC, and Kestrel may not impede that kind of report. 17 C.F.R. § 240.21F-17. The case settles: a stipulated injunction against further disclosure, a sworn deletion certification verified by a neutral forensic examiner, the employee's resignation, and a clause expressly preserving his right to communicate with any government agency. The board's audit committee reviews the runway figure independently. Time to a verified name: about twelve weeks. Cost through settlement: roughly $60,000, most of it spent on the early-discovery motion and verification. The trade secret side of this kind of case is covered in Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide.

What would have changed the outcome. If both late-night logins had gone through the VPN, the trail would have ended at the Swiss email service, and Kestrel would have had its takedowns, tighter controls, and a case it could revive if the account resurfaced, but no name. If the founder had fired the first suspect in week one, Kestrel could easily have become a defendant itself. And if the deck had revealed actual fraud, the public interest in the speech would have weighed heavily against unmasking, and Kestrel's problem would have been regulatory rather than reputational.

Common mistakes

• Capturing badly. Screenshots without URLs, timestamps, or a capture declaration start an authentication fight the plaintiff should never have.
• Crossing the investigation line. Fake profiles, pretext calls, borrowed passwords, and bait links turn the plaintiff into a defendant and hand the speaker a sympathetic story.
• Writing letters while the logs expire. A demand letter to an anonymous account rarely works, and every week spent on letters is a week of retention gone. File.
• Suing over opinion. If the posts are insults and hyperbole, no test will be met, and the motion will publicize the posts.
• A proposed order with gaps. No Cable Act paragraph means the cable operator declines; no follow-on authority means a new motion for every tier.
• Overbroad subpoenas. "All documents relating to the account" invites a quash order and, if it reaches contents, liability under the Stored Communications Act.
• Sloppy timestamps. Times without time zones, and mobile IP addresses without source ports, identify the wrong household or nobody.
• The wrong court for the subpoena. A home-state subpoena served on an out-of-state platform is unenforceable until domesticated, and the compliance court may take its own view of the First Amendment.
• Naming or firing the subscriber on sight. A subscriber is a lead. Corroborate first.
• Losing track of the deadlines. The Rule 4(m) period and the limitations period keep running while the subpoenas are pending, and relation back may not save a late amendment. Calendar both with the Statute of Limitations Diary Checklist: A Practical Checklist.
• For speakers: silence. Ignoring the platform's notice is the most common way to lose anonymity, and deleting the post is the most common way to make the case worse.
• For platforms: missed objections and overproduction. The 14-day objection window is short, and producing message contents in response to a civil subpoena is never permitted.

Frequently asked questions

How long until I know who is behind the account? Usually three to six months if no one objects and the trail runs through one or two providers. A contested motion to quash, a foreign provider, or a VPN can stretch that to a year or end the trail.

Can the platform just tell me if I ask? Almost never. The Stored Communications Act would permit a provider to give non-content records to a private party, 18 U.S.C. § 2702(c)(6), but platform policies require legal process. The exceptions are the DMCA subpoena for copyright owners and the state pre-suit procedures described above.

Should I go to the police instead? If the posts involve threats, stalking, extortion, or a hacked account, report them. Law enforcement can ask providers to preserve records, 18 U.S.C. § 2703(f), and can compel more than a civil litigant can. But you will not control the timing, and investigators may not share what they learn. Victims often pursue both tracks.

Will the person know I am trying to identify them? Almost always. Platforms notify their users, the Cable Act conditions disclosure on notice to the subscriber, and many courts require the plaintiff to post notice of the motion. Plan for the speaker to learn of the effort, and possibly to publicize it.

What if the person used a VPN? Look for the slip: one login without the VPN, a reused email address, a payment record, a recovery phone number. If every record points to a provider that keeps no logs, the trail may end, and an honest lawyer will say so early.

Can I get the person's private messages? Not from the provider. The Stored Communications Act bars providers from disclosing contents in response to a civil subpoena. O'Grady v. Superior Court, 139 Cal. App. 4th 1423 (2006). Once the person is a named party, you can seek relevant messages from that person through ordinary discovery.

I was harassed. Do I have to put my own name on the complaint? Not necessarily. Courts allow pseudonymous plaintiffs when the need for privacy outweighs the public's interest in open proceedings, but you must ask with the complaint. Sealed Plaintiff v. Sealed Defendant #1.

I posted the review and just got a notice from the platform. What now? Calendar the deadline, preserve the post, say nothing publicly, and call a lawyer the same day. The protocol above lists the steps; the motion to quash must be on file in the right court before the platform's deadline.

Practical takeaways

• Decide what the name is for before spending money to get it. Removal and takedowns often solve the problem without one.
• Capture first, properly, and keep a log of every lawful investigative step; it becomes evidence.
• Map the record holders and pick the shortest chain. Records are available to civil litigants; contents are not.
• File early. Data retention is usually the shortest clock, and most federal courts will not let a Doe amendment relate back.
• Win the early-discovery motion with evidence of falsity and harm, and with a proposed order that covers every tier, the Cable Act, notice, and use restrictions.
• Serve the platform the day the order issues, read its production like an investigator, and stay within the order.
• Corroborate before naming anyone. The subscriber is a lead.
• If you are the speaker, the notice window is your whole defense. If you are the platform, the 14-day objection window is yours.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment: the constitutional framework and the competing unmasking tests behind every step in this guide.
• Defamation, Business Disparagement, and Online Reviews: whether the anonymous post is actionable in the first place.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: why the host usually cannot be sued over a user's words, which is why identification matters.
• Rule 45 Subpoenas to Nonparties: Service, Objections, and Motions to Quash: service, objections, and the compliance-court rules that govern every tier.
• Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor: the forum analysis an early-discovery motion has to get right.
• Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue: what a leak plaintiff must identify, and how to keep it sealed.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: capture methods that survive an authentication challenge.
• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: the in rem ACPA action and other remedies that work without a registrant's name.

Related Guides

• Filing an Anti-SLAPP Motion: A Practical Guide: the speaker's strongest procedural response where a statute applies.
• Responding to a Third-Party Subpoena: A Practical Guide for Businesses: a recipient's playbook for deadlines, objections, and production.
• Running a Platform That Hosts User Content: A Practical Guide: the policies a host needs before the first subpoena arrives.
• Seeking or Opposing Section 1782 Discovery: A Practical Guide: the route for foreign litigants seeking records from U.S. platforms.
• Service of Process: Domestic and International Methods That Work: serving the defendant once you have a name.
• Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide: when the anonymous actor is a counterfeit seller.
• Choosing the Right Domain Name Dispute Procedure: A Practical Guide: when the problem is a domain rather than an account.

Related Checklists

• Anonymous Speaker Unmasking Checklist: A Practical Checklist: the same process as check-off tasks for each side.
• Authenticating Website Evidence: A Practical Checklist: the foundation for every capture declaration.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: preserving the client's own logs and records.
• Rule 45 Subpoena Response Checklist: A Practical Checklist: the recipient's deadlines and objections.

Related Toolkits

• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: model early-discovery motions, proposed orders, platform subpoena riders, and motion-to-quash papers.
• Cross-Border Discovery Toolkit: 1782 Applications, Hague Requests, and Blocking Statute Analyses: forms for evidence that sits abroad.
• Publicity and Free Speech Toolkit: Transformative Use Memos, Newsworthiness Analyses, and Anti-SLAPP Motions: anti-SLAPP and newsworthiness papers for the speaker's side.
• Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses: terms of service, user-notice procedures, and litigation defenses for hosts.