Who Is Behind the Account? User Data Disclosure Explained

Who is behind the account that insults, threatens or exposes you? Many people affected ask this first. Online, anonymous rarely means untraceable. But finding out the identity is not your job, and it only works through certain routes under German law: a criminal complaint or the civil-law right to information under § 21 TDDDG. This article explains both routes, their limits and what is changing.

What platforms know about an account

For an account, platforms usually store an email address, often a phone number, sometimes a name. Legally, this information is called subscriber data (Bestandsdaten). There is also data about use, such as IP addresses at login. This is called usage data (Nutzungsdaten). What exactly is stored, and for how long, differs from platform to platform.

For tracing the person, this means: the platform often does not know the real name. An email address or IP address is then an intermediate step. It leads to another provider, such as the internet provider, which knows which connection an IP address was assigned to at a particular time.

How do I find out who is behind an account?

There are two legal routes. The state takes the first for you; you take the second yourself with a law firm.

Route 1: Criminal complaint, the public prosecutor investigates

After a criminal complaint, the public prosecutor's office can request data. The Code of Criminal Procedure (Strafprozessordnung, StPO) allows it, among other things, to

• request subscriber data from platforms and telecommunications providers (§ 100j StPO), including on the basis of an IP address assigned at a particular time,
• collect usage data from providers of digital services (§ 100k StPO). For certain online offences such as insult, threats or stalking, this is possible if the facts cannot otherwise be established.

A criminal complaint costs you nothing. For insult and defamation, you also need a request for prosecution (Strafantrag) within three months, if necessary against persons unknown. How that works is explained in Strafantrag Explained: The 3-Month Deadline in Germany.

Will you then find out who it was? Not automatically. As an injured party, you can apply through a law firm to inspect the case file if you show a legitimate interest (§ 406e StPO), for example because you want to enforce civil-law claims. Under certain conditions, file inspection is also possible without a lawyer.

Route 2: Disclosure under § 21 TDDDG

Independently of a criminal complaint, there is a civil-law route in the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG). Under § 21(2) TDDDG, a provider of digital services must disclose the subscriber data it holds if this is necessary to enforce civil-law claims for the violation of absolutely protected rights, such as your right of personality. The requirement is illegal audiovisual content or content that meets one of the listed criminal offences and is not justified.

The listed offences include, among others:

• insult, defamation and malicious defamation (§§ 185 to 187 StGB),
• threats (§ 241 StGB),
• incitement to hatred (§ 130 StGB),
• violation of intimate privacy by taking images (§ 201a StGB).

Not on the list are, for example, stalking (§ 238 StGB) and the dangerous dissemination of personal data, known as doxxing (§ 126a StGB).

How the disclosure procedure works

• Disclosure requires a prior court order. The injured person applies for it, in practice usually through a law firm.
• The regional court (Landgericht) in your district has jurisdiction, regardless of the amount in dispute.
• The court decides whether disclosure is permissible and, as a rule, at the same time whether the platform must provide it.
• The platform is a party to the procedure. It may inform the user concerned about the procedure.
• By law, the injured person bears the costs of the court order.

With the result, a law firm can then, for example, send a formal warning or sue for an injunction. More on this in Compensation for Online Insults: Injunctions and Damages.

Where are the limits?

• Only existing data: a platform can only disclose what it has. Someone who signed up with a throwaway address is hard to find from that alone.
• Only subscriber data: the claim under § 21 TDDDG covers subscriber data. A civil-law claim against internet providers to match an IP address to a connection is only planned so far.
• Time: there is currently no general obligation for internet providers to store IP addresses. The later the investigation, the lower the chances.
• Abroad: many platforms are based in other countries. Requests then take longer.
• A connection is not a person: who owns an account or connection does not automatically establish who wrote the content.

Better not to investigate yourself

It is understandable to want to dig yourself. Do not do it anyway. Your own research can easily hit the wrong person. If you publish a suspected name or confront the person, you can expose yourself to legal risk and trigger an escalation. Instead, secure everything that could point to the person: profile URL, user ID, previous names, linked accounts. How to do that is explained in How to Secure Evidence of Online Hate.

What is changing

Two draft laws could change the situation. Neither has been passed yet (as of October 2026).

• Law against digital violence (Gesetz gegen digitale Gewalt): the federal government presented a draft in October 2026. Under it, people affected would be able to demand information about identity from online platforms and internet access providers after a court order. Courts would be able to have data preserved in advance. It also provides for a temporary account suspension for serious violations and an obligation for social networks based outside the EU to name an authorised recipient for legal documents in Germany.
• IP address retention: under a government bill from April 2026, internet access providers would have to store assigned IP addresses for three months. The bill is being debated in the Bundestag.

What you can do now

• Secure the profile URL, username and content with dates before the account disappears.
• File a criminal complaint early. The sooner the public prosecutor asks, the more likely the data still exists.
• For insults, file a request for prosecution within three months.
• If you want to take civil action, get advice on § 21 TDDDG.
• If you are threatened and feel in danger, call 110, the police emergency number in Germany.

Frequently asked questions

Can I ask the platform directly who is behind an account?

As a rule, no. Platforms only disclose user data to private individuals after a court order. Without a court, the criminal complaint remains your route.

Is a complaint against persons unknown worth it?

Yes. The public prosecutor has powers you do not have. It can request data from platforms and internet providers. Whether that succeeds depends on what data still exists.

Who pays for disclosure proceedings under § 21 TDDDG?

By law, the injured person bears the costs of the court order. On a low income, advice assistance (Beratungshilfe) or legal aid (Prozesskostenhilfe) may come into question. Clarify this with the law firm beforehand.

May I publish the name once I have found it out?

This is strongly discouraged. You can expose yourself to civil and, in some cases, criminal liability. Hand what you know to the police or a law firm.

Report your case

You do not have to find out on your own who is behind an account. You can report it through our form. If you say yes, your report goes automatically to a suitable cooperating law firm (Kooperationskanzlei) as soon as one is available. If there is no suitable firm right now, you get an email with other places to turn to straight away. Deadlines keep running: you can always file a request for prosecution (Strafantrag) with the police yourself. The legal assessment comes from the law firm, not from us. A report to us is not a criminal complaint. If you want to press charges, contact the police as well.