Norwich Pharmacal orders: how to compel a platform to reveal an anonymous user

By Yair Cohen, Solicitor specialising in internet law

When someone is attacking you anonymously online and the open-source work has run its course without producing a name, the Norwich Pharmacal order is the court's mechanism for asking the platform directly: who is this user? It is a disclosure order made against a third party. The third party, usually a social media platform, a hosting provider or a domain registrar, has not done anything wrong itself, but it holds the information that would identify the person who has. The court compels disclosure where the case for it is made out.

The order is one route among several. Where the platform cooperates, much of the court work is done on paper. The application itself still needs to go in, but the order can be made on the documents rather than requiring the parties to physically attend a hearing, saving time and cost. Google and Meta both run legal-team channels that handle disclosure requests on agreed terms, often within weeks, frequently without anyone attending court. Where the open-source investigation has already produced a confident identification, the order may not be needed in the first place. The court application becomes the right next step when those quieter routes do not close the question, and it is in that narrower set of cases that the firm tends to reach for it. The broader picture of how identification work runs is set out in our guide on how to unmask someone behind anonymous online posts.

The Norwich Pharmacal order is the court's tool for asking a platform "who is this user?" – not the only tool, and rarely the first one we reach for.

Where the Norwich Pharmacal jurisdiction comes from

The jurisdiction is named after the 1974 decision of the House of Lords in Norwich Pharmacal Co. v Customs and Excise Commissioners [1974] AC 133. The case had nothing to do with the internet. Norwich Pharmacal held a patent on a chemical compound, and infringing imports were arriving in the UK in commercial quantities. Customs knew who the importers were because they had handled the paperwork at the border. Norwich Pharmacal did not. The Lords held that where a third party has become innocently mixed up in a wrong, the court can compel that third party to disclose the identity of the wrongdoer, so that the rights-holder can sue.

Half a century later, the principle is doing the same work against social media platforms. The wrong is online defamation, harassment, blackmail or impersonation. The third party is the platform that hosts the account. The information sought is whatever the platform holds that would identify the person behind it. The court will make the order where three conditions are met:

• A wrong has been committed, or is arguable. The applicant has to show the court there is an actionable claim against the unknown wrongdoer.
• The third party is mixed up in that wrong. The platform does not need to be at fault. The mere fact that it hosted the content, or holds the registration data, is usually enough.
• The disclosure sought is necessary, proportionate and the only realistic way to obtain the information. If there is another route, the court expects it to have been tried first.

When a Norwich Pharmacal order is the right next step

Open-source intelligence and cooperative platform disclosure resolve a meaningful share of identification work without a court order. The Norwich Pharmacal route comes into its own where those routes have run their course or were never going to apply. Three situations come up most often.

The platform will not engage on a voluntary basis. Some platforms have no formal legal-team channel. Others have one but apply a high threshold before they will release user data without an order. Smaller forums, niche social platforms and platforms operated by individuals tend to fall into this group. The Norwich Pharmacal application is what moves the question from "we would rather not" to "you are now required to".

The conduct is serious enough that the platform expects a court order anyway. Even cooperative platforms like Meta and Google often prefer to act on the back of an order, particularly where the underlying matter is sensitive or where the disclosure could prompt a complaint from the user. A Norwich Pharmacal order gives them the cover they want and gives the applicant a clean record of how the data was obtained.

The open-source trail has narrowed the field but not closed it. Sometimes the investigation produces a small set of plausible candidates without identifying the right one. A Norwich Pharmacal order can put a name to a specific account in that set, and the open-source work then converts the disclosure into a real person at a real address.

What the court actually requires

The application is usually made under Part 8 of the Civil Procedure Rules. The evidence package put before the court covers the wrong itself, the platform's involvement, the steps already taken to try to identify the wrongdoer, and the reasons disclosure is necessary. The applicant signs a witness statement supported by exhibits: the offending posts, the correspondence with the platform, any open-source work that has narrowed the field, and the substantive claim that the disclosure will enable.

Where the platform consents to the order, the hearing is short and may be dealt with on paper. Where the platform takes a position, the hearing is contested and the timetable and cost rise accordingly. The court considers whether the order is necessary and proportionate, and may set conditions on the use of the disclosed information.

Cooperative versus contested applications

Where the platform engages, the workflow is well-worn. Google and Meta both have legal teams that respond to disclosure requests on a defined timetable. They will ask for the same information the court will: the wrong, the URL or account identifier, the basis on which disclosure is being sought, and confirmation that the data will only be used for the purposes of the substantive claim. Where the request meets their internal threshold, they will indicate that they will not oppose an order. The order is then made, often without attendance at court, and the disclosure follows within weeks. Our experience with the Google route in particular is set out in get disclosure from Google.

Where the platform pushes back, the application becomes contested. The cost rises because counsel is more deeply involved and the court time is longer. The timetable lengthens because the platform's evidence has to be served and answered. The court still tends to grant the order in clear cases, and the lighter-touch route remains available on the next application against the same platform once the principle is established.

When the court grants the order

The disclosure is rarely a single tidy name and address. The platform may hold only an email account, an IP address, a sign-up timestamp and a device fingerprint. The IP can resolve to a coffee shop, a residential broadband connection, a VPN exit node or a mobile carrier's NAT range. The email may be a throwaway. The registered name, where there is one, can be false. What the order delivers, in many cases, is a set of clues that still need running down. The open-source work runs again on the disclosed material, and what emerges at the end is a real person at a real address. That second pass is described in fuller depth in our guide on how to unmask someone behind anonymous online posts.

The first Norwich Pharmacal order against Facebook: Nicola Brookes v Persons Unknown

The historic example on this side of the work is the case of Nicola Brookes. Nicola was the subject of a sustained campaign of anonymous abuse on Facebook after defending an X Factor contestant who was himself being bullied online. The trolling escalated. She approached the police and got nowhere. She then approached dozens of law firms looking for someone who would help her identify the people behind the accounts. Yair Cohen agreed to take the matter on a pro-bono basis.

The application went to the High Court in London and Facebook was ordered to disclose the identifying information it held on the accounts in question. It was the first time a UK court had compelled Facebook to release user information of this kind. The disclosure produced a piece of information that, with hindsight, helps explain why the police response had been thin. The principal troll was himself a serving police officer.

The Nicola Brookes case opened the route that thousands of online harassment victims have used since. The mechanics of how Meta-family platforms handle these applications have settled down a lot in the years since, but the threshold the court asks the applicant to clear remains the same.

When the application fails or the disclosure leads nowhere

The court can refuse the order. The most common reasons are that the wrong has not been made out clearly enough, that the disclosure sought is wider than is necessary, or that another route has not yet been tried. The application is rarely lost on the underlying principle. It is lost on the detail of what is being asked for and why.

More often, the order is granted but the disclosure does not produce what the applicant hoped. The platform genuinely does not hold a real name. The IP resolves to a VPN with no logs the firm can lawfully obtain. The registered email is single-use and gives nothing away. In those cases the question becomes what to do next.

One route is the persons-unknown substantive claim. The applicant proceeds against an unnamed defendant identified by reference to the conduct rather than by name. The court can grant the substantive order, including a final injunction, against persons unknown where the identification is precise enough that the defendant could be told whether they are caught by the order. Our guide on the letter before legal action in defamation covers the persons-unknown route in the pre-action stage, and the same framing extends to the substantive claim where disclosure has not closed the question.

The seminal modern example on the privacy side is the firm's own matter in GYH v Persons Unknown [2018] EWHC 212 (QB). The client was a transgender escort whose health, sexual history and identity were being attacked across review websites. Despite extensive open-source work, the harasser could not be identified to the standard required for a named claim. The proceedings were issued against persons unknown. Mr Justice Warby granted a privacy injunction protecting the claimant, and the judgment made clear that someone who provides personal or sex-work services does not lose the right to keep private information private simply by working in that sector. The decision now sits in the privacy textbooks; it also makes the point that the substantive remedy can be obtained even where the wrongdoer's name remains out of reach.

The international dimension

Many of the platforms the firm needs disclosure from are US-incorporated. The registrars and hosting providers frequently sit in California, Arizona or Florida. UK Norwich Pharmacal orders are recognised by the major US platforms in practice, but a UK order has no direct enforcement standing in a US court. Where the platform declines to act voluntarily on the UK order, the work moves into the US disclosure routes.

There are three of those, and we run them in-house. A US state court John Doe action allows proceedings to be started against an unknown defendant and the discovery to be sought directly in the same jurisdiction. A UK Norwich Pharmacal order can be domesticated in a US state court so the court there gives it effect locally. A federal application under 28 U.S.C. § 1782(a) allows discovery in a US court in aid of foreign proceedings, including proceedings that have not yet been issued in the UK. The choice between the three is fact-specific, and the cost profile differs materially. Our guide on disclosure from USA websites and companies sets the routes out in fuller depth.

Cross-border disclosure using both UK and US orders: Phipps v Britton

The case of the Phipps family of Origin Design v Paul Britton sits at the more complex end of disclosure work. Britton had run a sustained campaign against the family and the business across UK-facing and US-incorporated infrastructure. The disclosure work had to operate in both jurisdictions in parallel. UK Norwich Pharmacal applications were used where the platform was prepared to act on a UK order. US federal court subpoenas in Arizona were used against GoDaddy and PayPal, where the underlying records sat with US-incorporated providers and the disclosure could only realistically be compelled in a US court.

One of the stranger identification pieces in that matter sat between the two formal routes. A short voice recording existed of Britton speaking to GoDaddy customer services during a routine account interaction, picked up in the disclosure that GoDaddy produced. The firm matched that voice against other recordings already in evidence, using voice-pattern analysis on a conversation of only a few seconds. The match closed a gap that the documentary disclosure on its own had left open. It was the kind of moment that sits outside both the Norwich Pharmacal mechanics and the US subpoena process, and it shows why the identification work in a serious matter rarely runs on one technique alone.

The criminal conviction came first. The civil damages followed. The full account is set out in our standalone case study on the case of Paul Britton and Origin Design.

What it costs

The firm publishes starting fees for the main court-order routes. The figures are floors, not fixed prices. The actual cost on a given matter depends on whether the platform cooperates, whether a contested hearing is needed, whether the disclosed information needs OSINT to convert it into a real person, and how many jurisdictions are in play.

The full cost picture across all eight identification routes, including the OSINT-led, emergency and US state-court bands, is set out in the cost section of how to unmask someone behind anonymous online posts.

What happens once the person is identified

Once the order has produced a name and an address, the matter opens up. A defamation claim becomes available against a named defendant, with the remedies the law does not provide against an avatar. See our guide on defamation legal advice. A harassment injunction can be served on the person responsible; see online harassment legal advice. A blackmail file can be passed to the police with a name attached; see internet blackmail and extortion.

The identification work and the substantive matter run together on the same file, with the same team. There is no handover between a disclosure boutique and a substantive firm. That continuity is part of why clients come to us for the disclosure work in the first place.

Frequently asked questions

Can the platform refuse a Norwich Pharmacal order?

Once the order has been made by the court, the platform is required to comply with it. Before the order is made, the platform can take a position on the application: it can consent, it can stay neutral, or it can oppose. Cooperative platforms tend to consent or stay neutral where the application meets the standard internal threshold. Opposed applications happen but are the exception rather than the rule.

How long does a Norwich Pharmacal application take?

Where the platform consents and the application is dealt with on paper, the order can be made within a few weeks. Where the application is contested, the timetable extends to months. The disclosure itself usually follows within two to four weeks of the order being made. Emergency applications, where a credible risk of imminent harm is shown, can be heard the same day or the next morning.

Does the person we are asking about get notified?

The default position with some platforms is to notify the account holder when a disclosure request is made. Others do not notify. Where notification would defeat the purpose of the application, for example because it would prompt the account holder to delete evidence or move to a different identity, the court can be asked to make the order on a without-notice basis and to delay or restrict notification. We advise on whether that step is appropriate on the facts before the application goes in.

What happens if the platform does not have the user's real name?

The platform discloses what it actually holds. That is often an email account, an IP address and a timestamp rather than a real name. The open-source work then runs on the disclosed information to convert it into a real-world identity. In a meaningful share of matters, the disclosed material is enough to close the question; in others, the persons-unknown substantive route described above remains available.

Do I need a Norwich Pharmacal order if Google will give me the data on request?

Sometimes the order is still needed even on a cooperative platform. The platform may prefer to act on the back of an order for its own internal reasons. The court order also produces a cleaner evidentiary record of how the data was obtained, which matters if the disclosed information later forms the basis of substantive proceedings. We assess this on the facts of each matter.

Can I get a Norwich Pharmacal order against a US platform?

A UK Norwich Pharmacal order can be made against a US-incorporated platform that operates in the UK. The major platforms recognise UK orders in practice. Where the platform declines to act on the UK order, the disclosure work moves into the US routes (state court John Doe action, domestication of a UK order, federal application under 28 U.S.C. § 1782(a)). The fuller treatment of those routes is in our guide on disclosure from USA websites and companies.

Does a Norwich Pharmacal order work against a website registrant?

Yes. The same principle applies. The third party is the registrar or the hosting provider rather than the platform, and the information sought is the registration data or the account information. The route is the same one we use for impersonation websites, fake review sites and the kind of revenge-publication site set up to damage one named individual.