Google disclosure request
If someone has posted about you anonymously on Blogger, in a Google Review, on YouTube, on Google Maps or from a Gmail address, you can often find out who is behind it. This page sits alongside our wider note on how to unmask someone behind anonymous online posts. The route on Google specifically runs through three things. The first is open-source intelligence on what the poster has already put in public; for the full method, see our note on how we identify anonymous internet users using open-source intelligence. The second is a Norwich Pharmacal application in England. The third is a US subpoena.
One point worth understanding before anything else. Google does not volunteer user data to private litigants. The US Stored Communications Act, 18 U.S.C. § 2702, prevents Google from disclosing customer data to civil parties without a court order, a subpoena or the user's own consent. The equivalent rules under the UK and EU GDPR pull in the same direction.
What Google holds on an account
Every account behind a Blogger blog, a YouTube channel, a Google Review, a Maps contribution or a Gmail address sits on a single Google account record. That record carries the user's chosen display name, the recovery email address, the recovery telephone number, the account creation IP, recent login IPs and, where the user has paid Google for anything, the payment card on file. Older accounts often carry more identifying detail than newer ones: users in the late 2000s were generally less guarded than today's users, and many early Blogger accounts still have a real name on the recovery contact and a payment card on file from a one-off Google purchase years ago.
Open-source intelligence: what the poster has already given away
Often, the most cost-efficient and perhaps the quickest way to find out who is behind an anonymous Google post is open-source intelligence, or OSINT. It is the analysis we do before any court papers are drafted, drawing on what is already public. A Blogger blog typically carries an author profile page with a Google account identifier. That identifier can be cross-referenced against other places the same account has been used: YouTube channels, Google Reviews left by the same account, Maps contributions, Play Store reviews. Once two or three breadcrumbs are tied to the same identifier, the picture of the person behind it sharpens quickly. Older Blogger blogs sometimes include the author's real first name in a sidebar widget or in early posts that were never tidied up.
Gmail headers, where you can read them legitimately, carry the originating IP unless the sender routed through a privacy service. Header analysis on emails our client has lawfully received is sometimes enough on its own to point at a country, an ISP and an approximate time zone, with no need to involve Google. Google Maps reviews and Maps timeline entries tie reviewers to physical locations: a reviewer who has left negative reviews of a competitor and positive reviews of their own business in the same town tends to surface quickly. YouTube comments can reveal interests, affiliations and habits that point at a smaller pool of candidates.
The OSINT pass also tells us which court route makes sense. If the user has clearly used a burner SIM and a fresh Gmail address with no other Google activity, the trail will dead-end at the SIM and the matter moves to a separate disclosure target. If the user has years of activity tied to one identity, the court application against Google has a much higher chance of producing a meaningful name.
The Norwich Pharmacal application in England
It was in 2012 that Yair Cohen took on and pursued the first social media disclosure case in England, the case of Nicola Brookes, in which the English court ordered a major social platform to identify anonymous users for the first time. Getting disclosure from Google about Blogger has followed the same pattern. The route runs through a Norwich Pharmacal order, drawing on the principle in Norwich Pharmacal Co. v Customs and Excise Commissioners [1974] AC 133. We file the application under Part 8 of the Civil Procedure Rules, supported by a witness statement, exhibits and a draft order. It identifies the content, sets out the legal grounds for disclosure and asks for the specific account data needed to take the matter forward.
Over the years and across dozens of applications against Google for Blogger and other Google services, we have built a working relationship with Google's legal team. The cost of these applications has come down substantially, and many of them now move on paper without a contested hearing in person. Where Google's view of the application is that the legal grounds are properly made out, Google consents and the order is granted on the documents.
The English route has clear advantages. It is faster where Google consents, it costs less than a contested hearing, and the underlying claim stays in the English court for everything that follows. The disadvantages and risks are also worth knowing. The order does not always reach every piece of data Google holds in California, so a US subpoena may still be needed. Where Google contests, the application proceeds to a hearing and the timeline lengthens. The user is generally notified that the application has been received, which gives them a window to remove the content or, in some matters, to act tactically against the claimant.
The US subpoena where the English order does not reach
Some of what Google LLC holds in California sits outside what an English order can directly compel. Where the disclosure needed for the substantive claim is not available through the English route alone, a US subpoena opens up. The route takes one of two shapes. The first is a direct US subpoena in existing American proceedings, used where the claimant already has, or is willing to begin, an action in a US court. The second is an application under 28 U.S.C. § 1782(a) in the United States District Court for the Northern District of California, which is the federal mechanism that takes the English Norwich Pharmacal order and supports it with US legal process directed at Google LLC.
Our colleagues in California handle the US filing on a referral basis. We supply the supporting English witness statement, the order from the English court and the disclosure schedule. Once the order is granted, the subpoena is served on Google LLC and the account data comes back through the US court. For a fuller treatment of the US-side mechanics, see our note on disclosure from USA websites and companies.
Where Google consents and where Google contests
People sometimes call this the "cooperative" route, which can mislead. It is not Google waiving the data-protection rules. It is Google agreeing not to contest a properly framed court application, so the order is made by consent rather than after a hearing. The application still has to be filed.
Google's stance within a properly framed application tends to be consistent. Where the legal grounds are clearly made out, the identification is specific (a particular URL, post or account), and the disclosure sought is proportionate to the underlying claim, Google tends to consent. Where the application is broad, where it appears to be on a fishing expedition, or where the user has a clear privacy or free expression interest that has not been engaged with, Google contests. Our drafting reflects that: we engage with the user's privacy interest expressly, we keep the disclosure sought narrow, and we tie each category of data to the specific legal claim that requires it.
Google's policy is to notify the affected user that a disclosure request has been received, unless legally prohibited from doing so. The notification is often part of what resolves the underlying problem. Once the user realises that a formal court process is moving against them, the calculation shifts. We see content removed, accounts taken down and apologies offered before any order has been granted.
Examples of disclosure across the three routes
Clients often ask for examples. The three matters below cover what each route can look like in practice.
An OSINT-led identification on Blogger
A client of ours, a psychotherapist, was defamed across a number of sites by a single anonymous poster. The most damaging material sat on a Blogger blog set up specifically to attack her professionally. The OSINT pass identified the Google account associated with the blog and tied it to a YouTube channel and a small number of Google Reviews under the same identifier. That work narrowed the candidate field enough to be confident we were dealing with a real and locatable person rather than a burner setup.
We then filed a Norwich Pharmacal application directed at Google. Once Google notified the blog owner that a disclosure application had been received, the blogger removed the offending posts on his own initiative. The application never had to reach a contested hearing, and the matter resolved without identification reaching the stage of a letter before action.
A consent-based disclosure on a Google Review
The second matter involved a dentist who had received an anonymous Google Review that told only part of the story. Dentists are bound by the General Dental Council's Standards for the Dental Team, in particular Principle 4 on patient confidentiality. The effect of those duties is that a dentist cannot respond to an online review by setting out the clinical record, even where doing so would show that the complaint was without foundation. Solicitors and other regulated practitioners face similar restraints.
We applied to court for an order requiring Google to disclose the reviewer's details. Google consented and the order was made on paper. Rather than press straight to a defamation claim, we wrote a measured letter to the reviewer setting out what the review had said, the wider clinical picture that had been left out, and the implications of the matter proceeding to a hearing at which the full dental record would be in evidence. The reviewer accepted that the review had been incomplete and removed it. A standalone case study of this matter is at how we identified the person behind an anonymous Google review of a dental practice.
A US subpoena that brought down a seven-year fraud-allegation blog
An entrepreneur we acted for had been falsely accused of fraud on a Blogger blog after his company went into administration. The administration had no fault attached to him personally and the allegations were untrue, but the blog was carefully written to imply otherwise. For nearly seven years he had tried to have the content removed or to identify the person behind it, through Google's standard complaint channels and through informal approaches. Nothing moved.
By the time the matter reached us, the blog had sat in Google search results long enough to cause ongoing harm to his new business and his personal reputation. We took the view that an English application alone was unlikely to produce a different result, and we served legal papers on Google through the US-side procedure. Rather than respond to the proceedings, the entire blog went down. The practical result for the client was that nearly seven years of online defamation ended in a matter of weeks.
What it costs
The figures below are the floors we work to across our disclosure cluster. Every matter varies, and a precise quote follows the initial assessment with you.
| Stage | From | What it covers |
|---|---|---|
| Initial assessment | Fixed fee on enquiry | A one-hour call (or video call) with a solicitor: what has happened, what you have tried, what the realistic options are, an honest costs range and a recommendation on whether to proceed. |
| OSINT identification work | £2,500 | Structured open-source pass on what is publicly available: usernames, profile footprints, reverse image, public registers, Companies House, regulated investigative databases. |
| Disclosure application where the platform or institution does not oppose | £5,000 | Drafting and filing of the Norwich Pharmacal application, engagement with the platform or institution's legal-process team and progression to a consent order on paper. |
| Contested Norwich Pharmacal application | £10,000 | Part 8 application, witness statement, exhibits, draft order, contested hearing, service on the platform or institution. |
| US side: § 1782(a) or direct subpoena | £12,000 | Coordination with our US counsel in the relevant District, supporting English witness statement, downstream English action plan once the US disclosure is received. |
You will usually also pay the platform's or institution's reasonable costs of compliance on top of our fees, which is worth factoring into the budget at the outset.
What happens after disclosure
Once Google's disclosure comes back, the matter moves into the substantive route. If the disclosed name leads to an identifiable person, the next step is a letter before action under the relevant claim. The choice of claim depends on the harm the post has done.
Where the post damages reputation, the route is usually a defamation claim under the Defamation Act 2013. The claim turns on the meaning of the post, the harm to reputation and whether any of the statutory defences are open to the poster.
Where the conduct is part of a wider course of distress, the route is a harassment claim under the Protection from Harassment Act 1997. The Act covers conduct that amounts to harassment on at least two occasions, and the remedies include damages and a restraining injunction.
Where the post is being used to extract money or behaviour from the client, the route is a blackmail and extortion claim. That route can also involve the police where the conduct meets the criminal threshold.
If the disclosed data leads to a pay-as-you-go SIM rather than a person, the next disclosure target is the mobile carrier that issued the SIM. The carrier will hold the activation data, the top-up history and any registered subscriber information. The approach is the same in shape as the one we use on following the money through UK banks and payment processors.
If the disclosed data leads nowhere recognisable, the persons-unknown route remains open. We can pursue a harassment injunction against anonymous internet users, or its equivalent for the platform we are dealing with, even where identification has stalled.
Where the immediate priority is the content coming down rather than identification, Google's right to be forgotten and search-removal channels often run in parallel with the disclosure application. The wider pattern of choosing the right instrument for the platform is in our note on how to unmask someone behind anonymous online posts.
Frequently asked questions
Will Google tell me who is behind an anonymous Blogger blog?
Google will disclose the account holder data behind a Blogger blog where a court has ordered it to do so. The application is an English Norwich Pharmacal order, followed where needed by a US subpoena for any data the English order does not reach. The disclosure typically includes the registered name, the recovery email, the recovery telephone, the account creation IP and a recent login IP. Where the user took precautions to obscure their identity at the point the account was opened, the data Google holds will only get you part of the way.
Do I have to go to court before approaching Google?
Yes. Google is bound by the US Stored Communications Act and by the equivalent UK and EU GDPR rules, which together prevent Google from disclosing user data to private litigants without legal process. What is sometimes called the "cooperative" route is not a court-free channel. It is Google agreeing not to contest a properly framed Norwich Pharmacal application, so the order is made by consent rather than after a contested hearing.
How long does Google disclosure take?
An English Norwich Pharmacal application that proceeds by consent typically reaches an order within six to ten weeks of issue. A contested application takes longer because of court availability for a hearing. A US subpoena under § 1782(a) adds further time on top because it runs in a US court, although the actual disclosure once the order is granted comes back quickly because Google complies directly under US legal process.
Does Google tell the user that a disclosure application has been made?
Google's policy is to notify the affected user that a disclosure application has been received, unless legally prohibited from doing so. The notification is often what causes the user to remove the offending content on their own. That is a feature of the process, not a bug. It creates a window in which the matter can resolve without further proceedings.
What if the account was opened with a pay-as-you-go SIM?
If the recovery number on the Google account is a pay-as-you-go SIM purchased in cash, Google's disclosure will lead to the SIM rather than to a person. The next disclosure target is the UK mobile carrier that issued the SIM. In practice some users register the SIM under a name that itself leads to identification, while others register it anonymously and the trail dead-ends. The OSINT work we do alongside the Google application often narrows the field even where the SIM itself does not.
Can I get content removed without going through disclosure?
Yes, in some matters. Google's complaint channels accept removal requests on specific legal grounds, including defamation where the claimant has a judgment or undertaking in hand, and certain privacy-based removal grounds. The removal route does not identify the poster, and the content can resurface on a different service if the user is motivated. Disclosure and removal sometimes run in parallel.
What happens if Google contests my application?
The application proceeds to a contested hearing. The court will weigh the legal grounds, the user's privacy interest and the proportionality of the disclosure sought. Where the drafting on our side is solid and the underlying claim is well evidenced, contested applications still tend to succeed.
Does the cost of a Google disclosure include the substantive claim that follows?
No. The disclosure cost covers the work to identify the poster. The substantive claim, whether defamation, harassment, blackmail or another route, is a separate engagement once identification is achieved.
