Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment

Summary. When a defamatory review, a leaked document, or an infringing upload comes from an anonymous account, the route to the person behind it runs through a subpoena to a platform or internet provider, and courts will not enforce that subpoena until the plaintiff clears a First Amendment threshold. This article explains where the right to speak anonymously comes from, from Talley and McIntyre to Reno v. ACLU, and how courts turned it into the tests that govern unmasking: Seescandy, Dendrite, Cahill, Highfields, the Sony Music factors adopted in Arista Records, and the Ninth Circuit's instruction in In re Anonymous Online Speakers that the nature of the speech should drive the standard. It surveys how state appellate courts and federal circuits have chosen among those tests, what the mass BitTorrent cases did to early discovery, joinder, and personal jurisdiction, and how the Stored Communications Act, the Cable Act, Section 230, and the DMCA subpoena provision limit what a platform can hand over. It then covers procedure and timing, the statute of limitations and relation back problem, the evidence a prima facie showing requires, the anti-SLAPP overlay, and strategy for the plaintiff, the anonymous speaker, and the platform. A worked example follows a restaurant targeted by a fake review campaign from complaint to identification, and the article closes with common mistakes, an FAQ, and practical takeaways.

At 11:40 on a Tuesday night, a review account created that afternoon posts one star for Marisol's, a family restaurant: "Got food poisoning from the shrimp. Watched a rat cross the kitchen floor. The health department should shut this place down." By Friday there are nine more, each from a brand-new account, each describing a meal the restaurant has no record of serving. Reservations drop by a third. The owner wants to know who is doing this, and she wants to know this week.

The law will let her find out. But it will make her prove something first: that she has a real claim against whoever wrote those reviews, supported by evidence rather than adjectives, before a court will order the platform to give up a single name. That rule protects the anonymous critic who tells the truth as much as it frustrates the business that is being lied about, and both sides need to understand exactly how it works.

The short answer

Anonymous speech is protected speech, online and off. The Supreme Court has treated the choice to publish without a name as part of the freedom of speech since Talley v. California, 362 U.S. 60 (1960), and McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995), made the point explicit. Reno v. American Civil Liberties Union, 521 U.S. 844 (1997), extended full protection to the internet.
The protection is qualified, not absolute. Anonymity does not immunize defamation, true threats, copyright infringement, trade secret misappropriation, or breach of a confidentiality agreement. What it buys is a threshold: before a court compels disclosure, the plaintiff must show the claim is real.
There is no single national test. Dendrite International, Inc. v. Doe No. 3, 775 A.2d 756 (N.J. Super. Ct. App. Div. 2001), requires notice, the exact statements, prima facie evidence on every element, and a final balancing. Doe v. Cahill, 884 A.2d 451 (Del. 2005), requires notice and enough evidence to survive summary judgment on the elements within the plaintiff's control, and drops the separate balancing. Most courts sit somewhere between the two, and nearly all of them now demand evidence, not just a well-pleaded complaint.
The kind of speech changes the standard. Courts handling file-sharing cases apply the lighter five-factor test of Sony Music Entertainment Inc. v. Does 1-40, 326 F. Supp. 2d 556 (S.D.N.Y. 2004), adopted by the Second Circuit in Arista Records, LLC v. Doe 3, 604 F.3d 110 (2d Cir. 2010). The Ninth Circuit has said that "the nature of the speech should be a driving force" in choosing the standard. In re Anonymous Online Speakers, 661 F.3d 1168 (9th Cir. 2011).
The mechanics are federal rules and federal privacy statutes. The plaintiff files against "John Doe," asks for leave to take discovery before the Rule 26(f) conference under Fed. R. Civ. P. 26(d)(1), and serves subpoenas under Fed. R. Civ. P. 45, first on the platform and then on the internet provider behind the IP address. Cable providers may disclose subscriber identity only under a court order, 47 U.S.C. § 551(c)(2)(B). The Stored Communications Act lets providers give private litigants subscriber records but not the contents of messages, 18 U.S.C. § 2702(c)(6).
The platform is a witness, not a defendant. 47 U.S.C. § 230 generally bars treating the host as the publisher of a user's words, which is why the fight is over the subpoena rather than over the platform's liability.
The speaker usually gets a chance to fight. Most platforms notify the user and wait before producing, and the user can move to quash without revealing a name. Platforms, newspapers, and hosts are often allowed to assert their users' rights as well.
The clock does not stop while you litigate the subpoena. Most circuits hold that replacing a Doe placeholder with a real name is not a "mistake" that permits relation back under Rule 15(c). Herrera v. Cleveland, 8 F.4th 493 (7th Cir. 2021). With one-year limitations periods common for defamation, unmasking is a race.

Why the Constitution protects anonymous speakers

The tradition is older than the Republic. The Federalist Papers ran under the name "Publius," and the Court in Talley relied on that history in striking down a Los Angeles ordinance that banned handbills not identifying their author. Anonymous pamphlets, the Court observed, have played an important role in the progress of mankind, often because the people who wrote them could not safely sign them.

McIntyre turned that observation into doctrine. Margaret McIntyre handed out unsigned leaflets opposing a school tax levy, and Ohio fined her for violating its ban on anonymous campaign literature. The Court held that "an author's decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment," and it described anonymity as "a shield from the tyranny of the majority." Two later decisions applied the same principle to the mechanics of political participation. Buckley v. American Constitutional Law Foundation, Inc., 525 U.S. 182 (1999), struck down a requirement that petition circulators wear name badges, and Watchtower Bible & Tract Society of New York, Inc. v. Village of Stratton, 536 U.S. 150 (2002), invalidated a permit regime for door-to-door canvassing in part because it stripped canvassers of anonymity.

A second line of cases protects anonymity of association. In NAACP v. Alabama ex rel. Patterson, 357 U.S. 449 (1958), a state court held the NAACP in contempt for refusing to produce its membership lists, and the Supreme Court reversed because compelled disclosure would expose members to economic reprisal and hostility. Brown v. Socialist Workers '74 Campaign Committee, 459 U.S. 87 (1982), applied the same logic to a minor party whose supporters faced harassment, and Americans for Prosperity Foundation v. Bonta, 594 U.S. 595 (2021), held that compelled disclosure of donor identities must be narrowly tailored to the government's interest. The common thread matters for unmasking: the injury is the disclosure itself, and it cannot be undone on appeal.

The internet cases took this doctrine online without discounting it. Reno held that there is "no basis for qualifying the level of First Amendment scrutiny that should be applied" to the internet, a medium on which anyone "can become a town crier with a voice that resonates farther than it could from any soapbox." Courts have since applied the anonymity cases to online identifiers directly. The Ninth Circuit enjoined a California law requiring registered sex offenders to report their online identifiers within 24 hours, finding it chilled protected anonymous speech, Doe v. Harris, 772 F.3d 563 (9th Cir. 2014), while the Tenth Circuit upheld Utah's narrower version, which limited use of the identifiers to law enforcement, Doe v. Shurtleff, 628 F.3d 1217 (10th Cir. 2010). The contrast is instructive: how the identity will be used, and by whom, shapes the constitutional analysis.

Anonymity is not absolute. Doe v. Reed, 561 U.S. 186 (2010), upheld public disclosure of referendum petition signatures against a facial challenge, applying exacting scrutiny and leaving room for as-applied challenges where disclosure would invite threats or harassment. And the speech that unmasking plaintiffs target often falls outside the First Amendment's core: defamatory falsehoods, see Gertz v. Robert Welch, Inc., 418 U.S. 323 (1974); true threats, see Counterman v. Colorado, 600 U.S. 66 (2023); and copyright infringement, where fair use and the idea-expression line already supply the First Amendment's accommodations, Harper & Row Publishers, Inc. v. Nation Enterprises, 471 U.S. 539 (1985); Eldred v. Ashcroft, 537 U.S. 186 (2003).

Why a private lawsuit triggers the First Amendment at all

A recurring question from business clients is why a constitutional rule restrains a private plaintiff suing a private speaker. The answer is that the compulsion comes from a court. New York Times Co. v. Sullivan, 376 U.S. 254 (1964), held that a state court applying state tort law in a civil case between private parties exercises state power subject to the First Amendment, and the order in NAACP v. Alabama was itself a judicial contempt order. A subpoena that a court enforces, or an order granting leave to serve one, is the government compelling disclosure. The Supreme Court has also recognized that pretrial discovery implicates First Amendment interests while leaving trial courts wide latitude to manage it, including through protective orders that restrict how discovered information is used. Seattle Times Co. v. Rhinehart, 467 U.S. 20 (1984). That latitude is why the unmasking tests are framed as limits on a court's discretion rather than as absolute bars, and why so many unmasking orders come with conditions attached.

How an unmasking request actually arises: the rules and statutes

Unmasking is not a cause of action. It is a discovery fight inside a lawsuit (or, in some states, a special pre-suit proceeding), and its shape depends on a handful of procedural rules and three federal privacy statutes.

The Doe complaint and the federal forum problem

Federal courts tolerate fictitious defendants when the plaintiff cannot know the name before filing and discovery is likely to reveal it. Gillespie v. Civiletti, 629 F.2d 637 (9th Cir. 1980); Wakefield v. Thompson, 177 F.3d 1160 (9th Cir. 1999). But Fed. R. Civ. P. 10 requires the complaint to name the parties, and a Doe defendant creates a jurisdictional problem in diversity cases: the court cannot confirm complete diversity under 28 U.S.C. § 1332 without knowing every defendant's citizenship. The Seventh Circuit has said flatly that "John Doe" defendants "are not permitted in federal diversity suits." Howell v. Tribune Entertainment Co., 106 F.3d 215 (7th Cir. 1997). (Removal is different; 28 U.S.C. § 1441(b)(1) disregards the citizenship of defendants sued under fictitious names.) The practical result is that a pure defamation claim against an unknown poster usually belongs in state court, while claims with a federal hook (copyright, Lanham Act false advertising, the Defend Trade Secrets Act at 18 U.S.C. § 1836, or the Computer Fraud and Abuse Act at 18 U.S.C. § 1030) can be filed in federal court against a Doe.

Early discovery under Rule 26(d)(1)

A party may not seek discovery from any source before the Rule 26(f) conference except by stipulation or court order. Fed. R. Civ. P. 26(d)(1). A Doe defendant cannot confer, so the plaintiff must move for leave. Most federal courts apply a "good cause" standard, asking whether the need for expedited discovery outweighs the prejudice to the responding party, Semitool, Inc. v. Tokyo Electron America, Inc., 208 F.R.D. 273 (N.D. Cal. 2002); a minority borrowed the preliminary-injunction-style factors of Notaro v. Koch, 95 F.R.D. 403 (S.D.N.Y. 1982), though courts increasingly prefer the flexible reasonableness approach of Ayyash v. Bank Al-Madina, 233 F.R.D. 325 (S.D.N.Y. 2005). In Doe-identification motions, those general standards are filled in with the First Amendment tests discussed below. The D.C. Circuit reversed a refusal to permit identification discovery "under any applicable standard," without deciding which one governs. Strike 3 Holdings, LLC v. Doe, 964 F.3d 1203 (D.C. Cir. 2020).

Rule 45 subpoenas and the compliance court

Leave in hand, the plaintiff serves a subpoena on the platform under Fed. R. Civ. P. 45, usually commanding production of subscriber information (name, email, phone, and IP logs) at a place within 100 miles of where the platform regularly transacts business. Motions to quash or compel are heard by "the court for the district where compliance is required," which may differ from the court hearing the case, and a transfer back to the issuing court requires the subpoenaed party's consent or exceptional circumstances. This detail decides cases. In Music Group Macao Commercial Offshore Ltd. v. Does, 82 F. Supp. 3d 979 (N.D. Cal. 2015), the Western District of Washington authorized subpoenas to Twitter, but the Northern District of California, where compliance was required, conducted its own First Amendment analysis, refused to transfer the dispute, and refused to enforce the subpoenas.

The Cable Act: a court order, not just a subpoena

Once the platform produces an IP address, the next subpoena goes to the internet provider that assigned it. For cable operators, which include the largest residential providers, 47 U.S.C. § 551(c)(2)(B) allows disclosure of subscriber identity only "pursuant to a court order authorizing such disclosure, if the subscriber is notified of such order by the person to whom the order is directed." That is why well-drafted early-discovery orders expressly state that they are court orders for purposes of § 551, and why cable providers send the subscriber a letter and wait (commonly about 30 days) before producing.

The Stored Communications Act: records yes, content no

The Stored Communications Act divides what a provider holds into contents and everything else. 18 U.S.C. § 2702(a) bars providers from voluntarily disclosing the contents of communications, and it has no exception for civil subpoenas. But § 2702(c)(6) permits a provider to disclose non-content records "to any person other than a governmental entity." The categories that matter are the ones Congress listed for government demands in 18 U.S.C. § 2703(c)(2): name, address, session times and durations, length and type of service, any temporarily assigned network address, and the means and source of payment. A civil plaintiff can get those with a subpoena. It cannot get the messages themselves. O'Grady v. Superior Court, 139 Cal. App. 4th 1423 (2006); Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010); Suzlon Energy Ltd. v. Microsoft Corp., 671 F.3d 726 (9th Cir. 2011). Overreaching carries risk: a subpoena that sweeps in private email can itself violate the Act, with a civil remedy under 18 U.S.C. § 2707. Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).

The DMCA subpoena

Copyright owners have a shortcut. Under 17 U.S.C. § 512(h), the owner files with any district court clerk a copy of a takedown notice, a proposed subpoena, and a sworn declaration that the identity will be used only to protect rights under the Copyright Act, and the clerk "shall expeditiously issue" the subpoena. No lawsuit is required. The shortcut has two limits. It reaches only providers that store or link to the material, not providers acting as mere conduits for peer-to-peer traffic. Recording Industry Ass'n of America, Inc. v. Verizon Internet Services, Inc., 351 F.3d 1229 (D.C. Cir. 2003); In re Charter Communications, Inc., Subpoena Enforcement Matter, 393 F.3d 771 (8th Cir. 2005). And courts in the Northern District of California have quashed § 512(h) subpoenas when the target raised a substantial fair use defense, applying the First Amendment analysis used in ordinary unmasking cases. In re DMCA Subpoena to Reddit, Inc., 441 F. Supp. 3d 875 (N.D. Cal. 2020); In re DMCA § 512(h) Subpoena to Twitter, Inc., 608 F. Supp. 3d 868 (N.D. Cal. 2022).

Section 230: why the platform is not the defendant

47 U.S.C. § 230(c)(1) provides that no provider of an interactive computer service shall be treated as the publisher or speaker of information provided by another. Since Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997), courts have read that sentence to bar defamation and similar claims against hosts for what their users post, subject to exceptions for providers that materially contribute to the illegality, Fair Housing Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157 (9th Cir. 2008) (en banc), and for claims, like promissory estoppel, that do not treat the provider as a publisher, Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009). The California Supreme Court has also held that a plaintiff cannot use a default judgment against the poster to force a nonparty platform to remove content. Hassell v. Bird, 5 Cal. 5th 522 (2018). Section 230 does not reach intellectual property claims, § 230(e)(2), which is why trademark and copyright plaintiffs sometimes have a platform defendant available, but for defamation the speaker is the only defendant, and the speaker's name is the whole game.

State procedures, pre-suit discovery, and cross-border routes

Several states let a plaintiff seek identity before suing. Texas Rule of Civil Procedure 202 authorizes a petition to depose a person to investigate a potential claim; New York's CPLR 3102(c) permits pre-action disclosure by court order, which a model used to identify an anonymous blogger in Matter of Cohen v. Google, Inc., 25 Misc. 3d 945 (N.Y. Sup. Ct. 2009); and Illinois Supreme Court Rule 224 provides a petition for discovery to identify those who may be responsible, under which the petition must state a claim that would survive a motion to dismiss. Hadley v. Doe, 2014 IL App (2d) 130489. Virginia legislated a specific procedure for subpoenas seeking the identity of anonymous internet speakers, Va. Code Ann. § 8.01-407.1, and California lets the speaker move to quash and, when a California subpoena is used to unmask a speaker for an out-of-state case arising from online speech and the plaintiff cannot make a prima facie showing, shifts the speaker's fees to the plaintiff. Cal. Code Civ. Proc. §§ 1987.1, 1987.2. When the case is abroad, 28 U.S.C. § 1782 permits discovery in the United States for use in a foreign proceeding, subject to the discretionary factors in Intel Corp. v. Advanced Micro Devices, Inc., 542 U.S. 241 (2004) and the limit in ZF Automotive US, Inc. v. Luxshare, Ltd., 596 U.S. 619 (2022) that private commercial arbitral panels are not foreign tribunals.

The leading tests, explained

Five decisions from a seven-year window built the framework that courts still use. Each answered the same question differently: how much must a plaintiff show, and when, before a court strips a speaker of anonymity?

Seescandy (1999): the motion-to-dismiss floor

In Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), the assignee of the See's Candies marks sued unknown registrants of look-alike domain names. The court allowed pre-service discovery subject to four safeguards: the plaintiff must (1) identify the missing party with enough specificity to show it is a real person or entity that can be sued in federal court; (2) describe every step already taken to locate it; (3) show that the suit could withstand a motion to dismiss; and (4) justify the specific discovery requested and identify a limited number of persons likely to have identifying information. The court analogized the third requirement to probable cause, a protection against using an ex parte process to invade the privacy of someone who has done nothing wrong. Seescandy remains the starting point for Doe identification in federal court, especially in trademark and cybersquatting cases, but its motion-to-dismiss threshold is now widely viewed as too low where the speech is expressive.

Doe v. 2TheMart.com (2001): when the speaker is only a witness

A different calculus applies when the anonymous speaker is not a party. In Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088 (W.D. Wash. 2001), a company defending a shareholder suit subpoenaed the identities of 23 message-board critics to support one of its many affirmative defenses. The court quashed the subpoena and held that unmasking a nonparty requires that (1) the subpoena was issued in good faith and not for an improper purpose; (2) the information relates to a core claim or defense; (3) the identity is directly and materially relevant to that claim or defense; and (4) the information needed is unavailable from any other source. Because litigation can usually proceed without a witness's name, nonparty speakers get the strongest protection of all.

Dendrite (2001): notice, specificity, evidence, and balance

Dendrite arose from Yahoo! message-board posts accusing a New Jersey software company of manipulating its revenue recognition and of quietly shopping itself to buyers. The trial court allowed discovery of two posters but refused as to the third, and the Appellate Division affirmed because Dendrite had not shown that the third poster's statements harmed it at all. The court set out the test that bears its name: the plaintiff must (1) attempt to notify the anonymous posters, including by posting notice on the same message board; (2) give them a reasonable opportunity to oppose; (3) identify the exact statements alleged to be actionable; (4) show that the complaint states a claim and produce sufficient evidence supporting each element on a prima facie basis; and (5) persuade the court that, balancing the speaker's First Amendment right against the strength of the prima facie case and the necessity of disclosure, the identity should be revealed. A companion case decided the same day, Immunomedics, Inc. v. Doe, 342 N.J. Super. 160 (App. Div. 2001), applied the same test and allowed unmasking of a poster, apparently an employee, who had disclosed confidential company information in breach of a confidentiality agreement. Read together, the two cases show that the test is not hostile to plaintiffs; it is hostile to plaintiffs without evidence.

Cahill (2005): the summary judgment standard

Cahill involved a town councilman who sued an anonymous blogger for posts questioning his mental fitness, and a trial court that ordered the poster's internet provider to disclose his identity under a "good faith" standard. The Delaware Supreme Court reversed. It held that a defamation plaintiff must make reasonable efforts to notify the defendant (by posting on the same forum, where possible) and must offer enough evidence to survive a hypothetical summary judgment motion. Two refinements made the standard workable. First, the plaintiff need only produce evidence on elements within its control, so a public figure need not prove actual malice before learning who the speaker is. Second, the court dropped Dendrite's balancing step, reasoning that "the summary judgment test is itself the balance." Applying the standard, the court held that no reasonable reader of a political blog would take the posts as statements of fact and remanded for dismissal. Cahill's reasoning about why a lower bar fails has been influential: under notice pleading, even trivial libel claims survive a motion to dismiss, so a motion-to-dismiss test lets plaintiffs unmask critics with a complaint alone.

Sony Music (2004) and Arista (2010): the file-sharing factors

Peer-to-peer cases pushed courts the other way. In Sony Music, record companies sued 40 Does who shared music files. Judge Chin recognized that file sharing "qualifies as speech, but only to a degree," because the real purpose is to obtain music for free, and denied motions to quash under five factors: (1) a concrete showing of a prima facie claim of actionable harm; (2) the specificity of the discovery request; (3) the absence of alternative means to obtain the information; (4) the central need for the information to advance the claim; and (5) the speaker's expectation of privacy, which was minimal because the provider's terms of service prohibited infringement and warned that identities could be disclosed. The Second Circuit adopted those factors as "an appropriate general standard" in Arista Records, affirmed the denial of a university student's motion to quash, and held that a complaint may plead facts on information and belief where they are peculiarly within the defendant's knowledge.

Highfields (2005): evidence first, then a weighing of harms

Highfields Capital Management, L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005), involved a Yahoo! poster who adopted a screen name resembling a hedge fund's and posted sardonic commentary about a company in which the fund invested. The fund sued for trademark infringement and defamation. The court adopted a two-step test: the plaintiff must first produce competent evidence supporting every fact essential to at least one cause of action, and if it does, the court compares the harms that a ruling for each side would cause. Finding the posts to be obvious parody and the fund's evidence of confusion lacking, the court quashed the subpoena, observing that "anonymity liberates." Highfields became the dominant federal test in the Ninth Circuit's district courts for expressive speech.

Test	Origin	Notice to speaker	Plaintiff's showing	Separate balancing
Good faith (AOL)	Va. Cir. Ct. 2000	Not required	Legitimate, good faith basis	No
Seescandy	N.D. Cal. 1999	Not required	Survive a motion to dismiss	No
Sony Music / Arista	S.D.N.Y. 2004; 2d Cir. 2010	Through provider, in practice	Concrete prima facie showing, plus four other factors	Built into the factors
Dendrite	N.J. App. Div. 2001	Required, including posting	Exact statements, prima facie evidence on each element	Yes
Highfields	N.D. Cal. 2005	Through provider, in practice	Competent evidence on every essential fact	Yes, a weighing of harms
Cahill	Del. 2005	Required where practicable	Survive summary judgment on elements within plaintiff's control	No
2TheMart (nonparty)	W.D. Wash. 2001	Through provider	Good faith, core claim, direct relevance, no other source	Implicit

The "good faith" test of In re Subpoena Duces Tecum to America Online, Inc., 52 Va. Cir. 26 (2000), rev'd on other grounds, 261 Va. 350 (2001), is now largely of historical interest; the Washington Court of Appeals, for example, rejected both it and the motion-to-dismiss standard as inadequate to protect noncommercial speech. Thomson v. Doe, 189 Wash. App. 45 (2015). The treatise discussion of these tests in 1 Robert D. Sack, Sack on Defamation (5th ed.), and the annotation at 120 A.L.R.5th 195 (right of a corporation to disclosure of the identity of an anonymous internet user) are good starting points for jurisdiction-specific research.

How the state appellate courts have chosen

Most unmasking law is state law, because most defamation cases are state cases. The decisions below are the ones lawyers cite most, and the pattern across them is clearer than the labels suggest: nearly every court requires notice and evidence, and the debate is mostly about whether to add a final balancing step.

Arizona. Mobilisa, Inc. v. Doe, 217 Ariz. 103 (Ct. App. 2007), involved an anonymous email, sent through an anonymizing service, that forwarded a private message from the CEO's account to company employees. The court adopted Cahill's summary judgment standard but kept a balancing step, and it approved placing the burden of notifying the Doe on the email provider. A decade later the same court applied Mobilisa to grant relief to a blogger whose identity a company had subpoenaed. Doe v. Mahoney, 244 Ariz. 240 (Ct. App. 2018).
California. Krinsky v. Doe 6, 159 Cal. App. 4th 1154 (2008), required a prima facie evidentiary showing of the elements of libel, declined to require a separate balancing, and held that a message-board post ridiculing a company officer's "fake medical degree" amid vulgar insults was hyperbole rather than fact. ZL Technologies, Inc. v. Does 1-7, 13 Cal. App. 5th 603 (2017), confirmed that the showing must include evidence of falsity, that complaint allegations alone are not enough, and that reasonable efforts must be made to notify the speaker, often most effectively by the platform itself. Platforms have standing to assert their users' rights, Glassdoor, Inc. v. Superior Court, 9 Cal. App. 5th 623 (2017), and the results track the evidence: in Glassdoor the employer lost because it could not show the review disclosed anything confidential, while in Yelp Inc. v. Superior Court, 17 Cal. App. 5th 1 (2017), the plaintiff won because it made a prima facie showing that the review was defamatory.
Maryland. Independent Newspapers, Inc. v. Brodie, 407 Md. 415 (2009), adopted the full five-step Dendrite test and vacated an order identifying five newspaper-forum commenters. Three of them had been sued but had not made the actionable statements; the two who had made them were never sued, and the one-year limitations period had run before the court ordered disclosure. Brodie is the cautionary tale on timing.
District of Columbia. Solers, Inc. v. Doe, 977 A.2d 941 (D.C. 2009), arose from an anonymous tip to a software industry association's piracy hotline accusing a government contractor of using unlicensed software. The court adopted a five-part test that "closely resembles" Cahill: an adequately pleaded claim, reasonable efforts at notice, a reasonable delay to allow a motion to quash, evidence creating a genuine issue of material fact on each element within the plaintiff's control, and a determination that the information is important to the plaintiff's ability to proceed. It also observed that the subpoena recipient is often the simplest and most effective messenger.
Pennsylvania. Pilchesky v. Gatelli, 12 A.3d 430 (Pa. Super. Ct. 2011), requires notice, prima facie evidence of every element including actual harm (which, the court said, is the same as the summary judgment test in Pennsylvania), an affidavit that the information is sought in good faith and is unavailable by other means, and a final balancing. The court later applied the same protection to pseudonymous letters sent to federal contracting officers, treating them as political speech. Kuwait & Gulf Link Transport Co. v. Doe, 92 A.3d 41 (Pa. Super. Ct. 2014).
Illinois. Identification proceeds by a pre-suit petition under Supreme Court Rule 224, and the petition must state a claim that would survive a motion to dismiss. In Hadley v. Doe, a newspaper commenter's statement that a county board candidate was a notorious child abuser "waiting to be exposed" imputed a crime and could reasonably be read as fact, so the court affirmed an order requiring the internet provider to identify the commenter; the Illinois Supreme Court affirmed in 2015. Illinois is the main outlier in using a pleading standard rather than an evidentiary one.
Washington. Thomson v. Doe held that the evidentiary standard should match the First Amendment interest at stake, adopted a prima facie standard where the speaker had not yet appeared, and affirmed the denial of a lawyer's motion to compel a ratings site to identify a former client who posted a critical review.
Virginia. Virginia has a statute, Va. Code Ann. § 8.01-407.1, prescribing notice and showings for subpoenas seeking the identity of anonymous internet speakers. In the Hadeed carpet-cleaning litigation, the business matched negative reviews against its customer records, found no matching customers, and argued that the reviews were therefore false statements of fact by people posing as customers; the Court of Appeals affirmed a contempt order against the review site. Yelp, Inc. v. Hadeed Carpet Cleaning, Inc., 62 Va. App. 678 (2014). The Supreme Court of Virginia vacated that judgment on a different ground: a Virginia court had no power to enforce a subpoena against a California company for records kept in California. Yelp, Inc. v. Hadeed Carpet Cleaning, Inc., 289 Va. 426 (2015). The plaintiff should have domesticated the subpoena in California under the Uniform Interstate Depositions and Discovery Act.
Texas. Texas litigants use pre-suit depositions under Rule 202. In Glassdoor, Inc. v. Andra Group, LP, 575 S.W.3d 523 (Tex. 2019), an employer sought the identities of anonymous reviewers to investigate defamation and business disparagement claims; by the time the case reached the Supreme Court of Texas, the limitations periods on those claims had run, so the court dismissed the proceeding as moot without deciding whether the Texas Citizens Participation Act applies to Rule 202 petitions.

New Hampshire adopted Dendrite in Mortgage Specialists, Inc. v. Implode-Explode Heavy Industries, Inc., 160 N.H. 227 (2010), and New Jersey still applies its own test. The practical summary for a plaintiff's lawyer: assume you will need admissible evidence on every element you can reach, a plan for notice, and a timeline that leaves room for a contested motion.

The federal appellate picture and the circuit differences

No federal court of appeals has adopted a single unmasking test for all cases, and the Ninth Circuit has expressly declined to. In In re Anonymous Online Speakers, a multilevel marketing company alleged that a rival orchestrated an internet smear campaign through anonymous posts and videos. The district court applied Cahill, the most demanding test, and ordered three of five speakers identified. On mandamus petitions from both sides, the Ninth Circuit found no clear error, observed that commercial speech receives less protection than political, religious, or literary speech, and said that "the nature of the speech should be a driving force in choosing a standard." District courts in the circuit have since applied Highfields to expressive criticism and lighter standards to commercial disputes and infringement.

The Second Circuit's Arista Records decision makes the Sony Music factors the general standard in that circuit, at least for infringement claims, and treats the speaker's expectation of privacy as a factor shaped by the provider's terms of service.

The D.C. Circuit has policed the plaintiff's side of the ledger. In AF Holdings, LLC v. Does 1-1058, 752 F.3d 990 (D.C. Cir. 2014), it vacated an order authorizing subpoenas for more than a thousand subscribers, holding that a plaintiff must have a good-faith basis to believe each Doe is subject to personal jurisdiction in the forum (geolocation services make that easy to check) and that sharing the same file in the same BitTorrent swarm at different times does not satisfy the joinder rule. Six years later, in Strike 3, it reversed the other way: a district court abused its discretion by refusing a single-Doe identification subpoena based on distaste for the plaintiff's adult films, an unduly skeptical view of whether the subscriber could plausibly be the infringer, and unsupported inferences about the plaintiff's litigation tactics. The district court decision it reversed, Strike 3 Holdings, LLC v. Doe, 351 F. Supp. 3d 160 (D.D.C. 2018), remains a useful catalog of the concerns that drive skeptical judges.

The Ninth Circuit added a merits limit in Cobbler Nevada, LLC v. Gonzales, 901 F.3d 1142 (9th Cir. 2018): a bare allegation that the defendant is the subscriber of an IP address used to infringe does not state a claim for direct or contributory infringement where the connection was open to many users, there the residents and visitors of an adult care home. The point generalizes. An account holder is a lead, not a defendant.

The Sixth Circuit addressed the end of the case. In Signature Management Team, LLC v. Doe, 876 F.3d 831 (6th Cir. 2017), a blogger who posted a link to a company's copyrighted book litigated anonymously to judgment and lost; the district court had earlier ordered him to disclose his identity to the court and the plaintiff's lawyers under a protective order, but refused to unmask him publicly after judgment. The Sixth Circuit held that, once a plaintiff wins, there is a presumption in favor of unmasking, rooted in the presumption of open judicial records. The strength of the presumption depends on the public interest in the case and the plaintiff's need to enforce its remedy; the Doe can rebut it by showing that he engages in substantial protected speech that unmasking would chill, and a court may condition continued anonymity on prompt satisfaction of the judgment.

Court	Leading decision	What it adds
2d Cir.	Arista Records v. Doe 3 (2010)	Sony Music five factors as the general standard
6th Cir.	Signature Management Team v. Doe (2017)	Post-judgment presumption in favor of unmasking
7th Cir.	Howell v. Tribune Entertainment (1997)	No Doe defendants in diversity cases
8th Cir.	In re Charter Communications (2005)	No § 512(h) subpoenas to conduit providers
9th Cir.	In re Anonymous Online Speakers (2011); Cobbler Nevada (2018)	Nature of speech drives the standard; subscriber is not necessarily the infringer
D.C. Cir.	RIAA v. Verizon (2003); AF Holdings (2014); Strike 3 (2020)	§ 512(h) limits; jurisdiction and joinder screens; no denial based on distaste

The nature of the speech changes the answer

The tests are frameworks; outcomes turn on what the speaker said and why. Four categories account for most cases.

Criticism and commentary on matters of public interest. This is where anonymity is strongest. In Art of Living Foundation v. Does 1-10, No. 10-cv-05022 (N.D. Cal. Nov. 9, 2011), a former member blogged sharply about a large spiritual organization and posted some of its teaching materials. The organization's defamation claims had already been dismissed as nonactionable opinion, leaving copyright and trade secret claims. A magistrate judge applied the Sony Music factors and ordered disclosure; the district judge reversed, held that Highfields governed because the blog was critical speech on a public issue and fair use was a substantial question, and stressed that the blogger was litigating actively through counsel, so the plaintiff did not need his name to proceed. Courts have quashed subpoenas aimed at a gripe site using a company's name, SaleHoo Group, Ltd. v. ABC Co., 722 F. Supp. 2d 1210 (W.D. Wash. 2010), and at an investor who called a CEO a "known liar" while explaining why, USA Technologies, Inc. v. Doe, 713 F. Supp. 2d 901 (N.D. Cal. 2010). In both, the plaintiff rested on its pleading and offered no evidence of confusion, falsity, or harm.

Commercial speech and competitor conduct. The Ninth Circuit's suggestion in Anonymous Online Speakers that commercial speech warrants a lighter standard matters most when the anonymous speaker is a competitor or acting for one. Fake reviews are the modern example. A review is ordinarily the reviewer's opinion, not commercial speech, Thomson v. Doe, but a review written by someone who was never a customer contains an implied false statement of fact, as the Virginia Court of Appeals reasoned in Hadeed, and if a competitor is behind it the speech begins to look like commercial advertising. The Federal Trade Commission's Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, effective in October 2024, now prohibits fake and incentivized-but-undisclosed reviews. The rule gives private parties no cause of action, but a plaintiff who can show a fake-review scheme is no longer asking a court to unmask a critic.

Infringement. Copying and distributing someone else's work is "speech only to a degree," and courts applying Sony Music unmask infringers routinely. Expression returns to the analysis when the use is plausibly fair: commentary, criticism, or reporting that incorporates the work. That was the turning point in Art of Living and in the Northern District of California's § 512(h) decisions involving Reddit and Twitter users. Where the defendant has been adjudicated an infringer, the post-judgment presumption of Signature Management takes over.

Breach of confidence and threats. Anonymity does not protect an employee who posts the company's confidential information in breach of a contract, Immunomedics, but the plaintiff must actually show the information was confidential and was disclosed, as the employer in Glassdoor v. Superior Court learned. Speech that threatens or sexually harasses identifiable people gets little protection; in Doe I v. Individuals, 561 F. Supp. 2d 249 (D. Conn. 2008), two law students targeted by sexually explicit and threatening posts on a law school discussion board defeated a poster's motion to quash after posting notice on the forum and making a prima facie showing of defamation.

The platform's position: standing, notice, and what it will produce

Platforms are nonparties, but they are rarely passive ones. Courts generally allow a website operator, newspaper, or internet provider to assert its users' First Amendment rights under third-party standing principles, because the users cannot defend their anonymity without giving it up. Enterline v. Pocono Medical Center, 751 F. Supp. 2d 782 (M.D. Pa. 2008), recognized a newspaper's standing to protect its online commenters; McVicker v. King, 266 F.R.D. 92 (W.D. Pa. 2010), followed it and refused to compel a newspaper to identify commenters who were only witnesses; and the California Court of Appeal recognized the same standing for Glassdoor and Yelp. A publisher may also have its own protection: O'Grady held that California's reporter's shield law covered an online news site's sources.

In practice, the platform's choices shape the case before any judge rules.

Notice. Most large platforms tell the user about a civil subpoena and give a short window, often 10 to 30 days, to file a motion to quash before they produce. In USA Technologies, the message-board operator told the poster it would release his IP address unless he moved to quash within 15 days; in SaleHoo, the domain registrar forwarded the subpoena to the anonymous site owner. That practice satisfies, or substitutes for, the notice step in Dendrite and Cahill, and several courts now direct the subpoenaed party to give notice.
Scope. A platform will produce basic subscriber information and access logs: the registration email and phone number, account creation date and IP address, and login IP addresses with timestamps. It will not produce private messages or other contents without the user's consent, because 18 U.S.C. § 2702(a) forbids it.
Position on the merits. Some platforms defend their users vigorously; others, as Twitter did in Music Group, take no position but ask the court to apply the correct First Amendment standard and promise to comply if the plaintiff meets it. Either way, the plaintiff should expect the court to scrutinize the showing even if no one opposes it.
Cost and burden. Rule 45(d)(1) obliges the issuing party to avoid imposing undue burden or expense and authorizes sanctions, including lost earnings and attorney's fees, for violating that duty. Providers commonly charge modest per-account fees for subscriber lookups.
Liability exposure. Providers have reasons for caution. A cable operator that discloses subscriber identity without the court order § 551 requires faces a civil action with liquidated damages, 47 U.S.C. § 551(f), and a provider that discloses contents in violation of the Stored Communications Act faces suit under 18 U.S.C. § 2707.

Retention is the hidden variable. Platforms keep login records for limited periods, and internet providers keep records of which subscriber held which dynamic IP address at a given moment for periods that range from weeks to a year or so. Mobile carriers that share addresses among many customers through carrier-grade network address translation need the source port as well as the address and timestamp to identify a subscriber. Civil litigants have no statutory right to compel preservation before a subpoena issues (the preservation-letter procedure in 18 U.S.C. § 2703(f) belongs to governmental entities), so speed is the only reliable preservation tool. For a fuller treatment of what platforms do when the demand comes from a government rather than a private litigant, see Cross-Border Government Demands for Data: The Stored Communications Act, the CLOUD Act, and MLATs.

What the mass BitTorrent cases taught courts

Most federal decisions on Doe identification come from copyright cases against file sharers, first by record companies and later, at enormous scale, by adult film producers. Those cases shaped the procedure every unmasking plaintiff now encounters.

Joinder. Early plaintiffs sued hundreds or thousands of Does in a single case for one filing fee, alleging that they participated in the same BitTorrent "swarm." Some courts allowed it at the discovery stage, Call of the Wild Movie, LLC v. Does 1-1,062, 770 F. Supp. 2d 332 (D.D.C. 2011); Digital Sin, Inc. v. Does 1-176, 279 F.R.D. 239 (S.D.N.Y. 2012); Patrick Collins, Inc. v. John Does 1-21, 282 F.R.D. 161 (E.D. Mich. 2012). Others severed all but one Doe under Fed. R. Civ. P. 20 and Fed. R. Civ. P. 21. Hard Drive Productions, Inc. v. Does 1-188, 809 F. Supp. 2d 1150 (N.D. Cal. 2011); On The Cheap, LLC v. Does 1-5011, 280 F.R.D. 500 (N.D. Cal. 2011). The D.C. Circuit's AF Holdings decision largely settled the question against swarm joinder.

Jurisdiction before discovery. Courts came to require a good-faith basis, usually geolocation of the IP address, for believing each Doe could be sued in the forum. Nu Image, Inc. v. Does 1-23,322, 799 F. Supp. 2d 34 (D.D.C. 2011), accepted geolocation placing the address in or within 30 miles of the District, and AF Holdings made the screen a condition of discovery. The same logic applies to a defamation plaintiff: an early-discovery motion should say where the speaker probably is and why the forum has jurisdiction. Posting statements on the internet that can be read in the forum is not enough. Sinclair v. TubeSockTedD, 596 F. Supp. 2d 128 (D.D.C. 2009); see Walden v. Fiore, 571 U.S. 277 (2014); Calder v. Jones, 465 U.S. 783 (1984).

The subscriber is not necessarily the speaker. The person who pays for the account may be a parent, a landlord, a coffee shop, or a business with guest Wi-Fi. A magistrate judge in the Eastern District of New York put it memorably: the alleged infringer "could be the subscriber, a member of his or her family, an employee, invitee, neighbor or interloper." K-Beech, Inc. v. John Does 1-37, 296 F.R.D. 80 (E.D.N.Y. 2012) (reported as In re BitTorrent Adult Film Copyright Infringement Cases). In Digital Sin, the plaintiff's own counsel acknowledged that roughly 30 percent of the names internet providers turn over are not the people who downloaded the work. Cobbler Nevada turned that reality into a pleading rule.

Abuse and its correction. The worst actors used unmasking as a settlement machine, counting on the embarrassment of an adult film lawsuit to extract payments regardless of guilt. Courts responded with protective orders that let Does proceed anonymously, bar settlement calls for a period after identification, and require the plaintiff to send a court-approved notice. The lawyers behind the Prenda Law operation were sanctioned under 28 U.S.C. § 1927, and the Seventh Circuit affirmed. Lightspeed Media Corp. v. Smith, 761 F.3d 699 (7th Cir. 2014); see also Ingenuity 13 LLC v. John Doe, No. 2:12-cv-8333, 2013 WL 1898633 (C.D. Cal. May 6, 2013). Every unmasking plaintiff inherits the skepticism those cases created, and the most effective response is a motion that looks nothing like them: one Doe, one forum with a stated jurisdictional basis, specific statements or works, evidence, and a narrow request.

Procedure and timing: from complaint to a name

A typical sequence in federal court looks like this.

Investigate and capture (days 1 to 10). Preserve the posts with URLs, timestamps, and account details; document harm; check whether the plaintiff's own records (customer lists, server logs, document-sharing analytics) narrow the field.
File the Doe complaint and the early-discovery motion together (days 10 to 20). Plead the specific statements or works, the claims, and the facts supporting jurisdiction. Attach declarations supplying the evidence the governing test requires. The motion is usually heard ex parte and decided in one to four weeks.
Serve the platform subpoena (week 4 to 6). The platform notifies the user and waits. Objections are due before the earlier of the compliance date or 14 days after service. Fed. R. Civ. P. 45(d)(2)(B).
Contest, if any (weeks 6 to 16). The user may move to quash anonymously in the compliance court; the platform may object or move for a protective order under Fed. R. Civ. P. 26(c).
Second-tier subpoena (weeks 8 to 20). The platform's production usually yields an email address and IP logs, not a name. The plaintiff then subpoenas the email provider or internet provider, which sends its own notice and waits again.
Identify, verify, amend, and serve (months 3 to 8). Confirm the identification with independent facts, amend the complaint, and serve within the time the court allows under Fed. R. Civ. P. 4(m), which presumptively allows 90 days after filing and must be extended for good cause.

Uncontested, the process takes three to six months. Contested, it can take a year or more, especially if the losing side seeks appellate review. Because an order compelling disclosure cannot be undone, speakers seek stays and immediate review: by mandamus in federal court under 28 U.S.C. § 1651 and Fed. R. App. P. 21, as in In re Anonymous Online Speakers; by collateral-order appeal in Pennsylvania, as in Pilchesky; by special action in Arizona, as in Mahoney; and by writ petition in California, as in Krinsky. The plaintiff should build that possibility into the limitations calculus.

The statute of limitations and the relation back trap

Defamation limitations periods are short (one year in many states, including California, New York, Texas, and Maryland), and most courts apply the single publication rule, so the clock starts when the post goes up, not each time someone reads it. See Firth v. State, 98 N.Y.2d 365 (2002). Filing a Doe complaint does not solve the problem by itself, because the eventual amendment substituting a real name must relate back to the original filing.

Under Fed. R. Civ. P. 15(c)(1)(C), an amendment changing the party relates back only if, within the Rule 4(m) period, the new defendant received notice of the action and knew or should have known that it would have been sued "but for a mistake concerning the proper party's identity." Most circuits hold that not knowing a defendant's name is not a mistake. Barrow v. Wethersfield Police Department, 66 F.3d 466 (2d Cir. 1995); Jacobsen v. Osborne, 133 F.3d 315 (5th Cir. 1998); Wayne v. Jarvis, 197 F.3d 1098 (11th Cir. 1999). Krupski v. Costa Crociere S.p.A., 560 U.S. 538 (2010), shifted the inquiry to what the new defendant knew rather than what the plaintiff knew, and some plaintiffs argued that it rescued Doe substitutions. The Seventh Circuit disagreed: a plaintiff who knowingly sues a placeholder has not made a mistake. Herrera. The Third Circuit has been the outlier, having allowed a Doe substitution to relate back in Varlack v. SWC Caribbean, Inc., 550 F.2d 171 (3d Cir. 1977), and having suggested in Singletary v. Pennsylvania Department of Corrections, 266 F.3d 186 (3d Cir. 2001), that the rule should be amended to treat lack of knowledge as a mistake.

The more reliable escape is Rule 15(c)(1)(A), which allows relation back whenever the law supplying the limitations period allows it. California's Code of Civil Procedure § 474 lets a plaintiff who was genuinely ignorant of a defendant's name substitute the true name later, and federal courts apply it. Lindley v. General Electric Co., 780 F.2d 797 (9th Cir. 1986). New York's CPLR 1024 does the same if the plaintiff exercised due diligence to learn the name before limitations expired and described the Doe well enough to give fair notice. Hogan v. Fischer, 738 F.3d 509 (2d Cir. 2013). Pre-suit procedures do not help: a Texas Rule 202 petition does not toll limitations, which is how the employer in Glassdoor lost its claims while it litigated the petition, and the Maryland plaintiff in Brodie lost his because he never sued the posters who made the actionable statements. For a calendaring framework, see Statute of Limitations Diary Checklist: A Practical Checklist.

Evidence: what a prima facie showing actually looks like

The phrase "prima facie showing" frightens clients more than it should. It means evidence that, if believed, would support each element of the claim, presented in admissible form, before the defendant has been identified. Courts consistently reject complaints and briefs offered in place of evidence. The Arizona federal court in Best Western International, Inc. v. Doe, No. CV-06-1537 (D. Ariz. July 25, 2006), denied early discovery because the complaint did not identify a single false statement, confidential item, or misuse of the mark; the plaintiffs in SaleHoo and ZL Technologies relied on their pleadings and lost the first round for that reason.

A workable evidentiary package for a defamation plaintiff usually contains:

The statements, authenticated. A declaration from the person who captured each post, with the URL, date, and account name, satisfies Fed. R. Evid. 901. The post itself is not hearsay when offered as the defamatory statement rather than for its truth. Platform records obtained later can come in as business records under Fed. R. Evid. 803(6) with a certification under Fed. R. Evid. 902(11). For capture methods that hold up, see Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.
Evidence of falsity. This is the element courts most often find missing. It comes from people with knowledge: an owner who searched the customer database and found no matching transaction, a health inspection report contradicting a claim of vermin, payroll records disproving a claim about wages. ZL Technologies requires it even where the defendant would bear the burden of proving truth at trial. Unsworn statements can be made under penalty of perjury under 28 U.S.C. § 1746.
Evidence of fault, where reachable. Following Cahill, courts do not require a public figure to prove actual malice before learning who the speaker is. But circumstantial evidence of knowing falsity (a reviewer who was never a customer, a cluster of accounts created the same afternoon) helps the balancing.
Evidence of harm. Dendrite and Pilchesky both turned on its absence. Where the statement is defamatory per se, presumed damages may substitute for proof of loss unless the speech involves a matter of public concern, in which case Gertz requires actual malice for presumed damages. The safer course is to prove something concrete: lost bookings, canceled contracts, a measurable drop in inquiries.
The jurisdictional basis. Geolocation of available IP data, the speaker's own statements about where they live, or the forum-directed nature of the statements. See Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.
The steps already taken. Seescandy asks for them expressly, and every court wants to know that the plaintiff tried public sources first.

Attribution evidence (writing style, shared phrasing, timing patterns, reused profile images) helps persuade the court that discovery will lead somewhere, but it is not a substitute for the subpoena. Expert stylometry must pass the reliability inquiry of Fed. R. Evid. 702, and courts treat it as corroboration rather than identification.

The anti-SLAPP overlay

In states with strong anti-SLAPP statutes, the unmasking fight is often a preview of a second fight the plaintiff can lose with fees. California's statute, Cal. Code Civ. Proc. § 425.16, lets a defendant sued over speech on a public issue file a special motion to strike that stays discovery and requires the plaintiff to show, with evidence, a probability of prevailing; a successful defendant recovers attorney's fees. An anonymous defendant can bring that motion through counsel without revealing a name. The California Court of Appeal drew the connection explicitly in ZL Technologies, noting that the unmasking burden is "neither heavy nor unfamiliar" because the anti-SLAPP statute already demands a similar showing. A plaintiff who cannot make the unmasking showing will almost certainly lose the anti-SLAPP motion too.

Whether those statutes apply in federal court depends on the circuit. The Ninth Circuit applies California's statute in diversity cases, United States ex rel. Newsham v. Lockheed Missiles & Space Co., 190 F.3d 963 (9th Cir. 1999), but evaluates legal challenges under Rule 12(b)(6) and factual challenges under Rule 56, with discovery allowed. Planned Parenthood Federation of America, Inc. v. Center for Medical Progress, 890 F.3d 828 (9th Cir. 2018). The D.C., Second, Fifth, Tenth, and Eleventh Circuits hold that state special-motion procedures conflict with the Federal Rules and do not apply. Abbas v. Foreign Policy Group, LLC, 783 F.3d 1328 (D.C. Cir. 2015); La Liberte v. Reid, 966 F.3d 79 (2d Cir. 2020); Klocke v. Watson, 936 F.3d 240 (5th Cir. 2019); Los Lobos Renewable Power, LLC v. AmeriCulture, Inc., 885 F.3d 659 (10th Cir. 2018); Carbone v. Cable News Network, Inc., 910 F.3d 1345 (11th Cir. 2018). For the mechanics, see Anti-SLAPP Statutes and Strategic Litigation Against Public Participation and Filing an Anti-SLAPP Motion: A Practical Guide; for model motion papers in the speech context, see Publicity and Free Speech Toolkit: Transformative Use Memos, Newsworthiness Analyses, and Anti-SLAPP Motions.

Strategy for each side

For the plaintiff: the business, the harassed individual, the rights owner

Decide whether you need the name at all. Platform reporting tools remove fake reviews and impersonation faster than any court. Copyright and trademark owners have takedown channels. A name is worth pursuing when the harm is ongoing, the claim is strong, and a judgment or injunction against the person would change behavior.
Pick the claim and the forum deliberately. Choose the claim you can prove with evidence you already have. Prefer a federal question if you want federal court; otherwise file in state court where the speaker probably lives or where the harm was aimed, in a state whose law lets a Doe amendment relate back.
Build the evidence before you file. The early-discovery motion is the merits motion in disguise. Falsity and harm declarations should be ready on day one.
Ask for little. Subpoena subscriber information only, for specific accounts and date ranges. Offer a protective order limiting use of the identity to the litigation and, if helpful, an initial attorneys'-eyes-only period. Narrow requests win; broad ones invite Theofel problems.
Move fast and calendar everything. Retention periods and limitations periods both run against you. Serve the platform the day the order issues.
Verify before you name. An IP subscriber is a lead. Corroborate before amending, both to satisfy Fed. R. Civ. P. 11 and because naming the wrong person is itself actionable and ruinous in front of a jury.

For the anonymous speaker: the critic, the reviewer, the whistleblower

Do not delete, edit, or repost. Deleting the post after learning of the suit invites a spoliation finding and looks like consciousness of guilt. Preserve your own records.
Use the notice window. When the platform's notice arrives, the clock is usually two to four weeks. Get counsel and move to quash in the court for the district where compliance is required; ask the platform to hold production while the motion is pending.
Attack the showing, not the plaintiff. Show that the statements are opinion, hyperbole, or true; that the plaintiff has no evidence of falsity or harm; that the speech addresses a public issue. If you will participate in the case anonymously, say so: in Art of Living, the blogger's active participation through counsel defeated the claimed need for his name.
Use fee-shifting tools. Anti-SLAPP motions, California's subpoena fee provision, and sanctions under Rule 45(d)(1) can shift costs to a plaintiff who overreached. Public interest organizations sometimes take strong cases; Public Citizen argued the Virginia Hadeed appeal for the review site, and the Electronic Frontier Foundation appeared as amicus in Signature Management.
Whistleblowers have additional protections. Disclosures of trade secrets made in confidence to government officials to report suspected violations of law are immune under 18 U.S.C. § 1833(b), and employees' online discussion of working conditions may be protected concerted activity under 29 U.S.C. § 157. See Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law.

For the platform: the review site, host, forum, or provider

Publish and follow a legal-process policy. State what you require (a valid subpoena, a § 551 order for cable subscriber data), what you will produce, how long you will wait after notifying the user, and what you charge.
Separate contents from records. Produce non-content records under § 2702(c)(6) when properly compelled; refuse contents absent consent or a lawful exception.
Decide when to stand up for users. Third-party standing is available, and some platforms assert it routinely; others take no position but insist that the court apply the right standard.
Preserve on receipt. Once a subpoena or order arrives, freeze the account data it covers so that the dispute over production does not become a dispute over destruction.

For the platform-side operational picture, see Running a Platform That Hosts User Content: A Practical Guide and Responding to a Third-Party Subpoena: A Practical Guide for Businesses.

Costs and practical realities

An uncontested identification through two tiers of subpoenas typically costs a plaintiff somewhere between the high four figures and the mid five figures in legal fees, plus modest provider charges. A contested motion to quash with an evidentiary record can double or triple that, and an interlocutory appeal or mandamus petition adds tens of thousands more. On the other side, defending a motion to quash costs the speaker a meaningful fraction of the same amount, which is why fee-shifting provisions and pro bono counsel matter so much.

Three realities temper the economics. First, the person behind the account is often judgment-proof, and homeowner's and business liability policies frequently exclude intentional torts like knowing defamation. Second, identification itself frequently ends the dispute: a reviewer who learns that a court has found a prima facie case of falsity usually agrees to remove the posts. Third, about one subpoena in several leads to a VPN, a public Wi-Fi network, or a deleted account, and the trail ends. Clients should hear all three before they authorize the first filing. For broader context on the underlying tort, see Defamation, Business Disparagement, and Online Reviews.

Common mistakes

Treating the complaint as the evidence. Every leading test requires proof, and the courts that unmasked speakers (Immunomedics, Doe I v. Individuals, Yelp v. Superior Court) were given it.
Suing the wrong Does. Brodie unraveled because the defendants named were not the ones who made the actionable statements.
Letting limitations run during pre-suit maneuvering. Glassdoor shows how a Rule 202 petition can outlast the claim it was meant to investigate.
Serving a home-state subpoena on an out-of-state platform. Domesticate it where the records are, as Yelp v. Hadeed requires.
Forgetting the compliance court. Leave from your judge does not bind the judge where the platform sits. Music Group.
Filing a Doe defamation case in federal court on diversity. Howell and § 1332 make that a jurisdictional defect.
Seeking contents. The Stored Communications Act forbids it, and an overbroad subpoena creates liability.
Naming the account holder without corroboration. Cobbler Nevada and K-Beech explain why.
For speakers: ignoring the notice or deleting the post. Silence usually means production, and deletion is evidence.
For providers: producing cable subscriber data without the court order § 551 requires, or producing contents at all.

A worked example: Marisol's and the review campaign

Return to the restaurant from the opening. Marisol's is a California corporation with one location; the review platform is headquartered in California. Here is how a disciplined unmasking effort unfolds, and where it stops.

Week 1: capture and triage. Counsel captures all ten reviews with URLs, account names, account creation dates (all within the same four days), and timestamps, using a forensic capture tool and a declaration from the person who made the captures. The owner flags the reviews through the platform's reporting tool; the platform's filter hides three of them within a day. Counsel sorts the remaining text. Three reviews say things like "overpriced," "the server rolled her eyes," and "worst tiramisu in the county." Those are opinion, and no court will unmask anyone over them. Seven make factual claims: food poisoning from a specific dish on a specific day, a rat in the kitchen, a lunch on a Tuesday, a birthday party for twelve.

Week 2: the falsity file. The owner's point-of-sale export shows no order of the shrimp dish on the dates two reviewers described. The restaurant does not open for lunch on Tuesdays. No party of twelve was seated in the relevant month. The county's routine inspection three weeks earlier found no evidence of vermin, and a pest-control log shows monthly service. Reservations for the following two weeks are down 34 percent from the same weeks last year, and a corporate client canceled a catering order, attaching a screenshot of the reviews. The owner also mentions a former chef who left on bad terms to open a restaurant nearby and texted, "You'll regret this." Counsel notes the lead but does nothing with it except preserve the text: no fake accounts, no messages to the reviewers, no pretexting. (On the ethics of investigation, see Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.)

Week 3: the filing. Because the claims are state-law defamation and trade libel and the likely defendant is local, counsel files in superior court against Does 1 through 7, each identified by account name, quoting each review verbatim. California's Doe statute, Code of Civil Procedure § 474, will allow later substitution if the restaurant is genuinely ignorant of the names. With leave of court, counsel serves a records subpoena on the platform limited to subscriber information, registration and login IP addresses, and timestamps for seven accounts over a 30-day window. The declarations supporting the motion lay out falsity, harm, and the account-creation pattern, applying the prima facie standard of Krinsky and ZL Technologies.

Weeks 4 to 9: notice and the contested motion. The platform notifies all seven users and objects, asserting their First Amendment rights, as Yelp v. Superior Court allows. One reviewer appears through counsel with a credit-card receipt showing a delivery order on the night in question; the dish was not the shrimp, but she did order from the restaurant and did fall ill. Counsel dismisses that Doe. Her review was a real customer's account of a real experience, and the unmasking framework did exactly what it is supposed to do. The court grants the motion to compel as to the remaining six, finding a prima facie showing of falsity and harm.

Weeks 10 to 18: the second tier. The platform's production shows that four of the six accounts were created from the same residential IP address within two days and the other two from a commercial VPN. Counsel subpoenas the cable provider that assigned the residential address, under an order reciting that it is a court order for purposes of 47 U.S.C. § 551(c)(2)(B). The provider notifies its subscriber, waits 30 days, and produces a name: the former chef's spouse. Counsel does not amend yet. A follow-up records subpoena and public records confirm the chef lives at the address; one review uses an unusual phrase that appears in the chef's text; the review timestamps cluster within an hour after the chef's own restaurant closed each night. The VPN accounts lead nowhere, and those Does are dismissed.

Months 5 and 6: resolution. Counsel amends to name the chef as to four reviews. His counsel considers an anti-SLAPP motion but recognizes that the evidence that won the motion to compel would also defeat it. The case settles: the reviews come down, the chef stipulates to an injunction against further false statements about the restaurant, and he pays a modest sum. Because the platform was never a party, the stipulation binds only him, consistent with Hassell v. Bird. The total cost to the restaurant was roughly the price of a used delivery van. The process worked for the restaurant because it had evidence, and it protected the customer whose bad night was real because it required that evidence.

Change one fact and the outcome changes. If the restaurant had been in Nevada and served a Nevada subpoena on the California platform, it would have faced the Yelp v. Hadeed problem and needed to domesticate the subpoena in California. If it had waited eleven months to file, a one-year limitations period would have run before the cable provider produced a name. For the step-by-step version of this process, see Identifying an Anonymous Defendant Online: A Practical Guide; for a task list, see Anonymous Speaker Unmasking Checklist: A Practical Checklist; and for the motion, order, and subpoena templates, see John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Frequently asked questions

Can I make a platform tell me who posted something without a lawsuit? Usually not. The Stored Communications Act permits providers to disclose non-content records to private parties, 18 U.S.C. § 2702(c)(6), but platforms' own policies almost always require legal process. The exceptions are state pre-suit procedures (Texas Rule 202, New York CPLR 3102(c), Illinois Rule 224) and, for copyright owners, the clerk-issued subpoena under 17 U.S.C. § 512(h).

Will the anonymous person find out that I am trying to identify them? Almost always. Courts applying Dendrite, Cahill, and their successors require reasonable notice efforts; platforms commonly notify users before producing; and the Cable Act conditions disclosure on notice to the subscriber.

Can the anonymous speaker fight back without giving up their name? Yes. Courts routinely allow a Doe to move to quash through counsel or under a pseudonym, and some cases proceed to judgment with the defendant still anonymous, as in Art of Living and Signature Management.

Which test will my court apply? Start with your state's appellate decisions and your federal district's recent orders. In practice, expect to need notice, the exact statements, and admissible evidence on every element you can reach. If the speech is commercial or infringing, the standard may be lighter; if it is political criticism, expect a balancing step or a summary-judgment-level showing.

Can I sue the platform instead? For defamation, almost never: 47 U.S.C. § 230 bars treating the host as the publisher of a user's words. For intellectual property claims, § 230 does not apply, and the analysis turns on secondary liability and the DMCA safe harbors. See Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops and Trademark Liability Online: Keyword Advertising, Marketplaces, and Contributory Infringement After Tiffany v. eBay.

If I am identified, will my name become public? Not necessarily. Courts can limit disclosure to the plaintiff's lawyers or the court under Fed. R. Civ. P. 26(c), as the district court did in Signature Management before judgment, and Seattle Times confirms the court's power to restrict how discovered information is used. See Protective Orders, Confidentiality Designations, and Sealing: Secrecy and Its Limits in Federal Court.

What if the speaker or the platform is outside the United States? A U.S. plaintiff must still establish personal jurisdiction and serve the defendant abroad, often under the Hague Service Convention; see Service of Process: Domestic and International Methods That Work. A foreign plaintiff can seek identifying records from a U.S. platform under 28 U.S.C. § 1782, but not message contents, Suzlon, and a foreign defamation judgment against a U.S. speaker is unenforceable here unless it satisfies First Amendment standards, 28 U.S.C. § 4102. See Section 1782 Discovery in Aid of Foreign Proceedings: Who Can Ask, What They Get, and What ZF Automotive Changed.

The anonymous account is using a domain name, not a social media handle. Is the process different? The target is the registrar or privacy proxy service rather than a platform, and the cybersquatting statute supplies an in rem alternative when the registrant cannot be found, 15 U.S.C. § 1125(d). See Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking.

Someone leaked our confidential documents through an anonymous account. Is that a speech case? It is a speech case with a stronger claim. Breach of a confidentiality agreement and trade secret misappropriation are not protected speech, and Immunomedics allowed unmasking on that theory. But the plaintiff must show the information was actually secret and actually disclosed, and must be prepared to identify it with particularity; see Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue.

Practical takeaways

Unmasking is a merits preview. The plaintiff who wins it is the plaintiff who could already prove falsity and harm on the day of filing.
Notice, specificity, and evidence are close to universal requirements; the remaining disagreement is about a final balancing step.
The nature of the speech drives the standard: criticism on public issues gets the most protection, infringement and fake commercial speech the least.
The platform is a witness with its own interests and standing. Ask it for little, and expect it to tell the user.
Subscriber records are available to private litigants; message contents are not. Cable subscriber identity requires a court order.
Two clocks run from the day of posting: data retention and the statute of limitations. Neither stops while the subpoena is litigated, and most federal courts will not let a Doe amendment relate back.
An IP subscriber is a lead, not a defendant. Corroborate before naming anyone.
For the speaker, the notice window is the whole defense. Use it.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.