An anonymous one star review, a pseudonymous forum post or a fake social media account can do as much damage as a newspaper article, and is often harder to address because no identifiable person can be sued. Australian law provides a route to identification through preliminary discovery, and the Stage 2 reforms added a statutory overlay for posters of digital matter. This article explains why identity matters, how the rules work in the main courts, what the decided cases show about platforms, what the exercise costs and when a different route is wiser. It is written for the person defamed and for the account holder whose details a platform has been ordered to hand over.
Why identity matters
A defamation action requires a defendant. Since 2021 that requirement has been sharpened: a person cannot commence defamation proceedings unless they have first given the proposed defendant a concerns notice and the period for an offer to make amends has expired.1 A notice cannot be given to a username. Nothing in the statutory process can start until the complainant knows who published the matter and where to serve them.
Identity also determines what remedy is realistic. A former customer with no assets presents a different proposition from a competitor using a false name, and the choice between defamation, injurious falsehood, consumer law and no action at all depends on who is at the other end.
The platform itself is rarely a satisfactory substitute. Under the Stage 2 reforms, many digital intermediaries are exempt from liability or have a defence if they had an accessible complaints mechanism and took access prevention steps after a complaint, as explained in the article on digital intermediaries. The person who wrote the words is usually the only viable defendant, and finding them is the first task.
Preliminary discovery: the rules
Each of the main courts has a rule allowing a prospective plaintiff to obtain information from a third party who can identify the person to be sued.
In the Federal Court, r 7.22 of the Federal Court Rules 2011 (Cth) allows a prospective applicant to apply for an order that a person discover documents relating to the description of a prospective respondent. The applicant must satisfy the court that there may be a right to obtain relief against the prospective respondent, that the applicant is unable to ascertain the respondent’s description, and that the third party knows or is likely to know the description or has or has had documents that would help ascertain it.2 The prospective applicant is not required to show a prima facie case against the person they wish to sue; it is enough that they may have a right to relief, a threshold described as “very low” and “not onerous”, although the foreshadowed claim must be a cause of action known to the law with a real rather than fanciful prospect of some remedy. Unlike its predecessor, r 7.22 does not expressly require reasonable inquiries, but the court still looks at what the applicant has done to find out.3
In New South Wales, r 5.2 of the Uniform Civil Procedure Rules 2005 applies where the applicant, having made reasonable inquiries, is unable sufficiently to ascertain the identity or whereabouts of a person for the purpose of commencing proceedings, and another person may have information or documents that tend to assist. The court may order that other person to attend for examination or to give discovery of documents relating to the identity or whereabouts of the person concerned. The application must be supported by an affidavit stating the facts relied on and specifying the information sought, and must be served personally on the third party.4
In Queensland, r 208C of the Uniform Civil Procedure Rules 1999, inserted in 2021, is in similar terms. The court may make an order if it appears that the applicant may have a right to relief against a prospective defendant, has made reasonable inquiries but is unable sufficiently to ascertain the prospective defendant’s identity or whereabouts, and another person may have information or documents that may assist. The order may require the other person to give evidence or to produce documents, and where no proceeding is on foot the application is made by originating application.5 The court may make the order conditional on the applicant giving security for the third party’s costs and expenses, and may make costs orders in favour of the person against whom the order is sought, including the costs of complying.6
The rules in each court therefore share three features. The applicant must show a possible claim, not a strong one. The applicant should first have made reasonable inquiries. The New South Wales and Queensland rules require this expressly, and the Federal Court considers it in practice. It means writing to the platform and asking for removal and for identifying information before applying to the court. And the person ordered to produce information is an innocent third party, whose reasonable costs the applicant will usually be expected to meet.
The Stage 2 overlay: s 23A
The Stage 2 reforms added a provision that overlays those rules where a person seeks preliminary discovery to identify or locate the poster of digital matter. Where the court procedure law allows such an order, s 23A requires the court, before making it, to take into account the objects of the Act and any privacy, safety or other public interest considerations that may arise if the order is made. The statutory example is evidence suggesting that the poster is in fear of domestic violence from the person seeking their address.7
The provision does not create a new power and does not limit the other matters the court may consider.7 Its practical effect is to put the poster’s interests squarely before the court. An applicant should expect to address those considerations in evidence, and a poster with a genuine safety concern should ensure that the court knows of it. Section 23A applies in New South Wales, Queensland, Victoria, Tasmania, the ACT and the Northern Territory, with the ACT provision numbered s 133A and the NT provision s 20A.8 It does not apply in Western Australia, and South Australia has enacted only part of the Stage 2 package.
What the cases show
Kabbabe v Google LLC is the decision most often cited. A Victorian dentist received a review on Google from a pseudonymous user alleging that a procedure had been botched and warning others to “STAY AWAY”. He asked Google to remove it and to identify the user. Google declined both requests and said it did not have “any means to investigate where and when the ID was created”.9 Dr Kabbabe applied in the Federal Court for preliminary discovery under r 7.22 and, because Google LLC is based in the United States, for leave to serve it there. In granting leave to serve, Murphy J was satisfied there was a prima facie case for preliminary discovery: a prospective applicant need only show that they may have a right to relief, the dentist had done enough by way of inquiry because he was not required to make inquiries that would be fruitless, and Google was likely to hold documents that would help identify the reviewer. Leave was granted to serve Google in California by international registered post under the Hague Service Convention.10
His Honour’s list of what Google was likely to hold is a useful guide to what can be sought: the subscriber information for the account, the names of its users, the IP addresses and associated information, any phone numbers, any location metadata, and any other accounts originating from the same IP address at around the same time.11
Colagrande v Telstra Corporation Ltd illustrates the second step. A Gold Coast surgeon was the subject of an anonymous review on a doctor rating website linking to a news report of a criminal conviction. The website was hosted in California, so he engaged a lawyer there who subpoenaed the operator and obtained the reviewer’s IP address. A public lookup showed the address belonged to Telstra, which did not respond to his request. Derrington J ordered Telstra to give discovery of documents establishing the account through which the internet was accessed on the relevant date via that IP address, the holder of that account, the identity of the person who accessed the internet through it and the location of the connection.12
Two things follow. First, identifying an anonymous poster is frequently a two stage process: the platform produces an IP address or email address, and a second application to the ISP or email provider is needed to put a name to it. Second, the process depends heavily on the cooperation of entities outside Australia. A United States platform may require formal service under the Hague Service Convention, may respond slowly and may produce less than the order contemplates.
What platforms hold and what they resist
Most major platforms hold, at a minimum, the email address or phone number used to create an account and logs of the IP addresses from which it has been accessed. Some hold payment details, device identifiers or location data. The Australian subsidiaries of overseas platforms commonly say that they do not hold user data, which is why applications are brought against the overseas entity.
There are limits to what identification achieves. An IP address identifies an internet connection, not a person. It may resolve to a household, a workplace, a public network or a mobile carrier’s shared address pool, and a poster who used a virtual private network may be untraceable. Accounts can be created with disposable email addresses. Platforms delete logs after a retention period, which is one reason to move quickly. And a platform served with an order may notify the account holder, who may then delete the material or the account; where removal rather than damages is the goal, that can be an acceptable outcome.
Platforms will resist orders broader than necessary, and courts will not make them. An application should identify precisely the publication, the account and the categories of information sought, confined to what is needed to identify and locate the poster.
Costs and when it is not worth it
Preliminary discovery is litigation in its own right. It requires affidavit evidence, a court application and usually a hearing, and where the platform is overseas it requires leave to serve abroad and the delay of formal service. The applicant will ordinarily be expected to pay the third party’s reasonable costs of compliance.6 All of this is incurred before a concerns notice can be sent, on a claim whose value is unknown because the defendant is unknown.
Three questions should be answered before starting. Is the publication actually defamatory and likely to meet the serious harm threshold? A single hostile review of a business, read by few people, may not be. Is the probable publisher worth suing, given their likely capacity to pay a judgment? If the circumstances suggest a former customer or an individual without means, the costs of identification may exceed anything recoverable. And is there a faster route to the practical objective? If removal is the real aim, a complaint to the platform may achieve it without identification at all.
The limitation period also matters. A defamation action must generally be commenced within one year of publication, and although the court may extend that period to up to three years where it is just and reasonable to do so, time spent on preliminary discovery is not automatically excused.13 An applicant should document the steps taken and the time they took in case an extension is needed.
Fake reviews and other routes
Where the publication is a review, the platform’s own processes may be more useful than a court. Review sites have policies against fake and conflicted reviews and will remove content that breaches them if the complaint is specific. The Australian Competition and Consumer Commission’s guidance states that it is against the law for a business to create fake or misleading reviews or arrange for others to do so, that reviews created by someone who has not used the product or service can mislead consumers, and that a business concerned about a false review should ask the platform to remove it and may report the matter to the ACCC.14 A report to the ACCC does not produce a remedy for the business concerned. A review amounting to misleading or deceptive conduct in trade or commerce may, however, support a claim under the Australian Consumer Law against the person who posted it, without the serious harm element or the excluded corporation limits of defamation.
When the poster turns out to be someone known
Identification frequently reveals a person with a motive: a competitor, a former employee, a former business partner or a former spouse. That changes the analysis.
A competitor who posts fake reviews is exposed not only to defamation but to injurious falsehood and consumer law claims, and a business that cannot sue in defamation because it is not an excluded corporation may find those causes of action more useful. A former employee may be bound by confidentiality or non disparagement obligations in an employment contract or deed of release that provide a more direct remedy. A former partner’s campaign may be better addressed by protective orders, discussed in the article on injunctions, than by a damages claim. In most cases, learning that the publisher is someone known to the complainant strengthens the claim, since context and motive can be proved.
For the person identified, a letter from a platform or ISP stating that a court has ordered disclosure of their details is the moment to seek advice. A concerns notice will usually follow, and the response to it, including whether to apologise, remove the material or make an offer to make amends, will shape everything that comes after.
Getting advice
Identifying an anonymous publisher is a procedural exercise with real cost and uncertain return, and should follow a candid assessment of the claim, the likely publisher and the alternatives. Early advice helps both sides: the person defamed on whether the application is worth bringing and how to frame it, and the person whose details are sought on what the court weighs under s 23A and how to respond.
About this article
This article is general information about Australian law as at the review date shown above. It is not legal advice and does not take account of any particular situation. Defamation law differs between states and territories and changes over time. Anyone considering making or defending a claim should obtain advice on their own circumstances before acting.