Harassment injunctions against anonymous Instagram and social-media users

By Yair Cohen, Solicitor specialising in internet law

Someone is harassing you online and you do not know who they are. The first question is whether there is a solution at all. The answer is yes. There are two parts to your route to safety. The first is identification, where we use open source intelligence and court orders to put a real name and address behind an anonymous account. The second is the injunction, which stops the conduct while identification runs. We cover identification in detail at our guide on how to unmask someone behind anonymous online posts. The court tool most often involved in identification is the Norwich Pharmacal order. On this page we focus on the injunction half: how the court approaches an application against an anonymous defendant, what the injunction does once we serve it, and what it does not do.

The injunction route against an anonymous defendant works in England and Wales because the courts have, over the last decade, developed what is called the persons unknown framework. The defendant is identified by description rather than by name, and the order binds the conduct rather than the person. The first UK case in which a court allowed an injunction to be served on the defendant via the social media platform itself was a case we acted in. The example below sets out how we did it.

Not knowing who the harasser is does not stop the court from protecting you.

Why an injunction works even when you do not know who the harasser is

The legal route is called the persons unknown framework. It sits in Civil Procedure Rules Part 8 and a line of authorities that has matured since the early 2010s. The court grants an injunction against a defendant identified by a description that is precise enough that anyone reading the order would know whether it applies to them. The classic formulation is along the lines of: "the persons unknown responsible for posting from the Instagram accounts listed in Schedule 1 to this order between [dates]". The judge's task is to be satisfied that the description is tight enough to be enforceable.

The high-water mark for described but unnamed defendants in the privacy context is GYH v Persons Unknown [2018] EWHC 212 (QB), another case we acted in, in which Mr Justice Warby granted a privacy injunction against persons unknown where extensive open source investigation had not been able to put a name to the harasser. The principle that emerges from this line of cases is consistent: where the conduct is sufficiently described, and the harm sufficiently real, the court can bind a defendant who has, at the moment of the order, no public identity at all.

In practice, we put in an application supported by a witness statement, exhibits showing the conduct (screenshots, message threads, account histories), and a draft order with a schedule listing the accounts the description targets. We ask the court to grant the injunction against "the persons unknown responsible for", with the conduct prohibited in the operative part of the order.

Securing the evidence: the preservation order against the platform

Before the substantive injunction is served, the platform usually needs to be put on notice to preserve the evidence. The harasser may delete the accounts the moment they hear about the case, and with the accounts go the messages, post histories, IP logs, device fingerprints, login times and email addresses on which any later identification work depends. The preservation order asks the platform to hold all of that material pending further order.

We usually seek the preservation order at the same hearing as the injunction, and sometimes as a freestanding application that runs ahead of the injunction itself where time is very short. Meta, which controls both Instagram and Facebook, generally complies once the order is in hand. X (formerly Twitter) and TikTok have similar response processes. The preservation order is the bridge between the moment we know there is a case and the moment the rest of your case can run on it.

What the platform is asked to hold typically includes: the account profile data, all posts and messages associated with the account, IP addresses used to access the account, timestamps of access, the email address and any phone number associated with registration, payment details where any have been used, device identifiers, and any associated accounts the platform's internal systems have linked. We negotiate the scope with the platform's legal team where necessary.

How we did it: the first UK case allowing service via Instagram

Our leading example is DDF v YYZ, the first UK case in which a court permitted service of a harassment injunction on the defendant via the social media platform itself. We acted for the claimant, an Instagram influencer in the entertainment industry. The conduct ran across multiple Instagram accounts operated by an anonymous user. Over the course of roughly a month, the defendant sent vile and highly offensive messages with racial, sexual and family-targeted elements, and the campaign escalated when the claimant tried to ignore it.

We acted to obtain a harassment injunction with permission to serve via Instagram, alongside reporting restrictions to protect the claimant's identity in the public record. Both parties were anonymised: the claimant is referred to in the citation as DDF, and the defendant as YYZ. The court agreed that, given the defendant existed only as an Instagram account, service via the platform itself was the only practical route, and that ordinary substituted service rules could be adapted to allow it.

The short version of the case appears in the video below, where Yair Cohen walks through how the service mechanism worked in practice. For the longer treatment, including what the court accepted on the evidence and what the order ultimately included, see the case of DDF v YYZ.

Emergency injunctions: when you cannot wait

The standard injunction application is inter partes, which means the defendant is given notice and an opportunity to be heard. Where the conduct is escalating, or where you have reason to believe the defendant would respond to notice by deleting evidence and disappearing, we can apply without notice, on an emergency basis, sometimes within hours of you instructing us.

The court will scrutinise the without-notice route closely. It will ask whether the harm is imminent and serious enough to justify granting an order with only one side heard, whether notice has been given where practicable, and whether there are real grounds to dispense with notice in your case. We carry an unusually high duty of full and frank disclosure on a without-notice application. The court is hearing one side only, and we are expected to put the defendant's likely case as well as your own, including any facts that do not help you.

A without-notice order, if granted, is typically time-limited to a return hearing inter partes within a few days or a couple of weeks. At the return hearing, the court reviews the order with both sides present (where the defendant has by then been identified or served), and decides whether to continue, vary or discharge it.

Reporting restrictions to protect the claimant's identity

A court order is in principle public. If the case is reported by the press, the very privacy you are trying to protect can be exposed by the proceedings themselves. That is a particular concern where you are in the public eye and the harassment has involved sensitive personal material. The court can grant reporting restrictions under Civil Procedure Rules Part 39, often together with anonymisation of the parties in the public record, so that the case is reported as "X v Persons Unknown" or similar rather than by name.

The court approaches the question by balancing Article 8 of the European Convention on Human Rights, which protects private and family life, against Article 10, which protects freedom of expression. The Human Rights Act 1998 requires that balance to be performed expressly. Reporting restrictions are not automatic, and we apply for them with evidence that justifies the restriction in the case at hand.

In DDF v YYZ both parties were anonymised, which is why the case is cited that way. The anonymisation served the claimant's privacy interest, and the court was satisfied that the public interest in open reporting was met by the reporting of the principles in the case rather than the identities of the people involved.

Serving the injunction via the platform itself

Service is the moment the order takes effect against the defendant. Traditional service requires the order to be delivered to the defendant personally, by post to a known address, or by another method approved by the court. With a defendant who exists only as an Instagram account, none of those routes is available.

The mechanism we developed in DDF v YYZ, and have used since on X (Twitter), TikTok and Facebook, is to require the platform itself to deliver notice of the order to the defendant's account or accounts. The platform forwards the notice through its own messaging channels, and through the email address it has on file for the account where one exists. Service is treated as effective from the point the platform confirms delivery.

The platforms generally cooperate. Meta, X and TikTok each have UK-aware legal teams that respond to court orders directed at them in their corporate capacity. Where a platform declines or delays, the order can be enforced against the platform directly, which is one of the practical reasons cooperation tends to be the norm rather than the exception.

What the injunction does and does not do once served

What the injunction does, once served, is prohibit the specified conduct. The operative part of the order sets out the things the defendant may not do, typically including: further harassment of you, further posting about you on the named platforms, further contact with you or members of your family, and any conduct that would tend to identify you in connection with the matter. Breach of the order is contempt of court, which can be punished by imprisonment, fines, or costs against the contemnor. The injunction also provides a recoverable cost basis if the defendant is later identified and the substantive claim is pursued.

What the injunction does not do is identify the harasser. That is separate work, and we usually run it in parallel with the injunction application from day one. The most common tool for identification is the Norwich Pharmacal order, which compels the platform to disclose the data it holds about the account. The persons unknown procedure for the substantive claim sits alongside.

The injunction also does not guarantee compliance. Some harassers, particularly those operating from outside the jurisdiction, ignore court orders. In our experience, enforcement against a determined and overseas-based defendant is the hardest part. The enforcement route is committal proceedings, which require the order to have been served on a person who can be identified for committal purposes, which loops back to the identification work.

And the injunction does not substitute for the substantive case. It is a tool for stopping the conduct quickly. The substantive harassment claim under sections 1 and 3 of the Protection from Harassment Act 1997, a defamation claim under the Defamation Act 2013 where the conduct includes publication of defamatory material, and any blackmail proceedings where threats have been used to extract money or behaviour, are all separate pieces that follow once identification is complete. We cover them in the section below.

After the injunction: identifying and pursuing

The injunction buys time. The next phase is identification, which is where our open source intelligence work and court-ordered disclosure run together. Our position, which we set out at how to unmask someone behind anonymous online posts, is that OSINT comes first and the order comes second. OSINT often resolves the identification before any court application is needed, and where it does not, the order is sharper for the work that has already been done. Where the harasser's trail runs through a US-based platform, the US disclosure route under 28 U.S.C. § 1782(a) sits alongside the UK Norwich Pharmacal order.

Once the harasser is identified, the substantive claim is the next step. Where the conduct meets the test for harassment, a substantive claim under the Protection from Harassment Act 1997 follows. Where the conduct included defamatory publication, a defamation claim under the Defamation Act 2013 follows. Where the conduct included threats designed to extract money or behaviour, a blackmail claim is the right route.

The injunction sits inside this broader workflow as the rapid-response tool. It is the thing that stops the harm while the rest of your case runs. In our experience, it is also the moment at which you feel the protection of the court for the first time.

Frequently asked questions

Can I get a harassment injunction if I do not know who is harassing me?

Yes. The persons unknown framework allows the court to grant an injunction against a defendant identified by a description rather than by name. The conduct is what the order prohibits, and the defendant is bound by the description from the moment they have notice of the order. The framework sits in Civil Procedure Rules Part 8, and we have used it in cases including DDF v YYZ and GYH v Persons Unknown.

How quickly can the court grant an injunction?

An emergency without-notice application can be heard within hours of you instructing us, where the court is satisfied that the harm is imminent and serious enough to justify it. An inter partes application, where the defendant is given notice, runs to a few days or a couple of weeks depending on the court's diary and the strength of the case. The pace is driven by the urgency and the conduct, rather than by the procedure.

Does the harasser have to be in the UK?

No. The court has jurisdiction over conduct that affects a person in the UK, and the injunction can issue against a defendant whose physical location is unknown or overseas. Enforcement against an overseas-based defendant is harder than enforcement against a UK-based one, which is why we run identification, and the cross-border tools that sit with it, alongside the injunction application from the start.

Will the harasser find out from the court that I have applied?

Only if the application is made inter partes, in which case the defendant is given notice as part of standard procedure. On a without-notice application, the court grants the order before the defendant is notified, and service follows once the order is in hand. We reserve the without-notice route for cases where giving notice would defeat the purpose of the application, for example because the harasser would delete the accounts the moment they heard about the case.

What happens if the harasser ignores the injunction?

The enforcement route is contempt of court. The court can impose a custodial sentence, a fine, or a costs order against the contemnor. Practically, contempt proceedings require the order to have been served on a person who can be identified for committal purposes, which is why we run identification in parallel with the injunction from day one. Where the harasser is determined and operating from outside the jurisdiction, enforcement is harder, and the practical effect of the order is often the deterrence and the protection it offers you rather than committal.

Can the same order also stop the press from reporting the case?

Yes, where the court is satisfied that the privacy interest in restricting reporting outweighs the public interest in open reporting. The court grants reporting restrictions under Civil Procedure Rules Part 39 and may anonymise the parties in the public record. The balance is between Article 8 (privacy) and Article 10 (expression) of the European Convention on Human Rights, performed under the Human Rights Act 1998. DDF v YYZ is an example: both parties were anonymised in the citation and in the reporting of the case.

Will Instagram or another platform actually enforce the injunction?

In practice, yes. Meta (which operates Instagram and Facebook), X (formerly Twitter) and TikTok each have UK-aware legal teams that respond to UK court orders. The platform is bound by the order in the same way any UK-jurisdiction-aware company is, and cooperation tends to be the norm. Where a platform does not cooperate, the court can enforce the order against the platform directly, which is one of the practical reasons cooperation is the standard response.