Online Defamation: First Amendment Rights and Legal Standards for Unmasking the Identities of Anonymous Defendants

Luke Hwang

Lee Sun-kyun, a renowned South Korean actor for his role in the Oscar-winning film Parasite, tragically took his life in December 2023.[1] Lee had been facing a police investigation over allegations of illegal drug use, despite his constant reiteration of his unawareness of any consumption. Throughout this time, Korean media outlets sensationalized reports about Lee’s personal life that were unrelated to the drug allegations.[2] His public appearances for police investigations were widely televised and reported in news articles, sparking a flurry of commentary on speculations and rumors surrounding his alleged drug uses with a hostess, which were replayed millions of times on YouTube. This led to a flood of malicious comments and unverified information anonymously spreading online, resulting in Lee’s death. Despite recent efforts by web portals and social media platforms to bolster their monitoring systems to better filter out online character attacks, many victims still lament that these rumors spread so swiftly online that their reputations can be irreparably damaged instantly.

The tort of defamation is generally defined as a false communication that tends to tarnish a plaintiff’s reputation.[3] Gossip, false statements, misleading claims and rumors can hinder various aspects of one’s life. When tarnishing and false statements are perpetuated through print, broadcasting or online, the reputational harm can be extended from local communities to even across the country.[4] The advent of the Internet has broadened the scope for public discourse, allowing an increasingly diverse population to engage. Due to the nature of online platforms, even if targeting private individuals, a defamatory content gains public platform once it is posted online, amplifying the potential damages.

“[A]nonymity is an essential tool in protecting free speech and action on the Internet, even if accountability is marginally diminished.”[5] However, it goes without saying that online anonymity has created significant problems within the tort of defamation. Although most Internet Service Providers (“ISP”) require submission of true personal information when users sign up for their service, users can be an entirely different persona online by using usernames. Therefore, most users in the digital world have taken their ability to remain anonymous for granted as part of the First Amendment right to free speech.

Background and Analysis

The First Amendment and Online Defamation
The United States Supreme Court has protected anonymity as an essential component of the First Amendment’s right to free speech.[6] Not only has the court provided Constitutional protection to anonymous political and social activities, but it has also provided the same protection to literature in general, including an author’s right to use a nom de plume (pen name).[7]

These rationales for protecting anonymity are more or less the same for online communications. The United States Supreme Court also held that online speech is not different from traditional forms of communication; thus, online speech is within the same Constitutional protection of First Amendment rights to free speech as the traditional forms of communication.[8]

However, in the context of online defamation claims, in contrast to the traditional defamation claims which provide several distinct avenues for recourse such as bringing an action against the actual defamatory speaker or publisher of defamatory speech,[9] anonymity causes difficulties for the recourse. For online defamation claims, it is hard to locate the genuine identities of the rumor spreaders or posters without a cooperation of the ISP even when the offended party suffers from emotional distress or any other mental illness from defamatory or false statements and may even commit a suicide. Even when a plaintiff requests that the ISP disclose the identities of alleged defamers or demands the government to seek a subpoena for the ISP, unresolved issues still arise about the alleged defendants’ First Amendment rights to free speech.

The CDA and the Subsequent Judicial Interpretation
In 1996, to the plaintiff’s dismay, the Congress enacted the Communications Decency Act (CDA) in response to Stratton Oakmost, Inc. v. Prodigy Servs., where the court held an ISP liable for a defamation claim as a publisher when the ISP exercised its editorial control over the alleged defamatory contents on its bulletin board.[10] The court reasoned that the ISP’s use of software to automatically delete comments deemed in “bad taste” classified it as a publisher rather than a mere distributor, thereby holding it liable.[11] However, in the statutory section 230 of the CDA (hereinafter, “Section 230”), the Congress stated that the Internet provides “a forum for a true diversity of political discourse, unique opportunities for cultural development, and myriad avenues for intellectual activity.”[12] Thus, the basis for Section 230 has been expanded in the legislative history of this provision, which states that “[t]his section provides ‘Good Samaritan’ protections from civil liability for providers or users of an interactive computer service,”[13] effectively overruling Stratton Oakmont.

CDA has been a primary impediment for protecting online defamation victims.[14] CDA provides that no ISP shall be treated as the publisher or speaker of any third-party statements unless ISP attempts to edit content created by third parties.[15] Furthermore, through the CDA, the Congress sought to shield ISPs from any distributor liability to promote the continued development of the Internet and other interactive computer services and media,[16] thereby fostering free speech and online communications protected by the First Amendment.

Therefore, the Congress and courts have been significant obstacles to the defamation plaintiffs seeking protection from the false information, particularly when dealing with anonymous posters whose identities are challenging to ascertain, as the CDA grants immunity to ISPs from defamation claims involving anonymous posters. Furthermore, courts have required defamation plaintiffs to prove the speaker’s actual malice for defamation claims involving public figures[17] and the speaker’s negligence for private individuals.[18] Consequently, establishing the identity of the anonymous defendant in online defamation claims has become essential to proving either actual malice or negligence on the part of the defendant.

Moreover, even if a plaintiff can demonstrate good cause for seeking a subpoena against an ISP to identify a defendant, the anonymous defendant would argue against the subpoena based on their First Amendment right to free speech. Thus, when unmasking the identity of an anonymous defendant, courts have weighed the interest of both parties, considering the plaintiff’s “interest in rectifying perceived defamation”[19] alongside the defendant’s First Amendment rights to free speech.

The first landmark case interpreting Section 230 was Zeran v. America Online, Inc, wherein a bulletin board user posted the plaintiff’s name and phone number, accusing him of selling offensive T-shirts that celebrated Timothy McVeigh and the Oklahoma City bombing.[20] Despite the plaintiff requests for AOL to remove the original posting and AOL subsequently removing the relevant postings, new postings by AOL users continued to appear.[21] As a result, the plaintiff received threatening calls every two minutes and eventually required police protection in his residence.[22]

Although the plaintiff argued that AOL, as an ISP, should be held responsible for the postings as a distributor since the company was aware of the defamatory statements,[23] the court granted AOL immunity from liability both as publisher and distributor.[24] The court reasoned that holding ISPs liable would incentivize them to simply delete any controversial comments or postings to avoid potential liabilities.[25] The court further reasoned that such actions would likely chill online communication, which would be contrary to the Congress’ statutory purposes to promote free speech on the Internet protected by the First Amendment in passing Section 230.[26]

Following Zeran, many jurisdictions broadly interpreted Section 230 by immunizing ISPs from liability both as publisher and distributor. In 2006, the California Supreme Court unanimously interpreted Section 230 more than any previous courts, holding that Section 230 provides immunity not only to ISPs but also to the individual posters online who are not ISPs.[27] The court reasoned that the Congress, through Section 230, did not intend to differentiate between individual users differently and ISPs.[28] Therefore, the court held that even individual users should be immunized from any liability for defamation.

While many courts followed the reasoning and holding of Zeran in their interpretation of Section 230, not every court applied this interpretation in defamation cases.[29] The California Appellate Court rejected the reasoning of Zeran in Grace v. eBay.[30] When a plaintiff, an eBay user was defamed by another eBay user on the feedback page,[31] the court held that there should be distinction between distributors and publishers in interpreting Section 230.[32] The court reasoned that by providing immunity not only to publishers but also to distributors, Zeran decision and subsequent rulings have eliminated any incentive for ISPs to regulate defamatory content on their bulletin boards.[33] The court in Grace reasoned that Zeran and its followers were inconsistent with the Congress’ statutory intent in passing Section 230.[34]

Zeran has remained canonical, and continues to shape jurisprudence in interpreting Section 230 to this day,[35] and the rights of plaintiffs seeking remedies for online defamation has also remained uncertain. Since a plaintiff typically cannot bring an action without obtaining a subpoena for the ISP to identify the actual party responsible for posting the allegedly defamatory statement online, it appears challenging for defamation plaintiffs to protect their rights and seek remedies for their tarnished reputation.

If the law only protects ISPs or the online users to encourage the freedom of speech under the First Amendment and development of Internet, how can the defamation victim’s right be protected? Why should the law protect only the First Amendment rights of the wrongdoer, not the right of wronged party?

Standards developed in Unmasking the Identities of Anonymous Defamation Defendants
In facing a dilemma regarding when, and by what standard, should the anonymity of the defamation defendant be disclosed, courts have developed several standards, including but not limited to the good faith standard, balancing test standard, and summary judgment standard.

For example, in America Online, Inc. v. Anonymous Publicly Traded Co., the court provided a good faith standard which requires the plaintiff only to show a “good faith” for its prima facie case and unmasking identities of the other party.[36] However, because of the high discretion of the standard, the plaintiff can abuse the ease in bringing an action only by proving a “good faith,” which can be overly subjective or speculative.

In Dendrite International Inc. v. Doe, the court provided a balancing test, a four-part test in assessing whether to allow unmaking an anonymous Internet poster’s identity.[37] This balancing test considers the defendant’s First Amendment right to post content anonymously on the online forum without revealing their true identity, juxtaposed with the plaintiff’s right to safeguard their reputation and balance the necessity of unmasking the poster’s identity against the harm caused. By weighing the anonymous poster’s First Amendment rights against the plaintiff’s interest in revealing the poster’s identity, the court must initially assess whether the speech merits protection.[38] This standard is significant as it compels the court to “reconcile the particular claim against that particular speaker’s right to remain anonymous.”[39]

As an alternative approach, in Doe v. Cahill, the Delaware Supreme Court implemented a more simplified standard, a summary judgment standard, by eliminating the balancing test requirement.[40] Instead, it mandated that the plaintiff make efforts to notify the anonymous poster that he is the subject of a subpoena or disclosure order and provide sufficient evidence to establish a prima facie case that withstands motion for summary judgment.[41] However, this summary judgment standard still significantly favors plaintiffs in their efforts in unmasking the identities of alleged defamation defendants as it would be overly lenient in allowing plaintiffs to present sufficient evidence to survive summary judgment to unveil the anonymous speaker’s identity.

Lack of uniformity in determining when to disclose the identity of anonymous Internet defamation defendants poses challenges in courts. Two (2) primary approaches are: one involving a balancing test (Dendrite) and the other not involving a balancing test (Cahill). Neither approach has been deemed dominant. However, a balancing test between the competing rights of the anonymous speakers seeking their rights to free speech and plaintiffs seeking redress for wrongful communications is crucial in establishing an adequate standard framework for online defamation claims.

A New Standard

Competing Interests in Online Defamation

The United States Supreme Court held that the protection of reputation “reflects no more than our basic concept of the essential dignity and worth of every human being.”[42] Reputation has also been viewed as an “intangible property right.”[43] With the expansive reach of Internet, the impact of online defamation is exacerbated, allowing false statements to rapidly spread globally and undermining the defamation victim’s dignity and intangible property rights. Without clear legal standards to safeguard the online defamation victims from malicious, intentional or reckless posting or sharing of unverified information, the Congress’ objective of fostering a responsible Internet in enacting Section 230 along with protection of the First Amendment right to free speech would not be achieved. Therefore, to align with the Congress’ intent, it is imperative to establish liability for those spreading false or defamatory information, thereby protecting online defamation victims and ensuring the Internet’s reliability.

Debate on the Public Issues
There has been a controversy on the court’s decision on the protection of public debate. In Sullivan, the court implemented the actual malice standard, holding that the First Amendment requires the plaintiff to show that the defendant knew that a statement was false or was reckless in deciding to publish the information without investigating whether it was accurate.[44] Similarly, in Rosenbloom v. Metromedia,[45] the United States Supreme Court extended this standard to all discussions involving public or general concerns, and held that the degree of First Amendment protection should be based on the subject matter at issue, rather than the status of the plaintiff whether he is a public figure or a private individual.[46] On the other hand, in Gertz, the court limited the application of the actual malice standard to public figures when the defamation defendants intentionally “thrust themselves to the forefront of particular public controversies.”[47]

However, what if the defaming party did not intentionally “thrust” himself to “the forefront of particular public controversies,” but rather negligently posted defamatory information online? In such cases, regardless of the intent of the defaming party, the defamation victim’s reputation is harmed. Therefore, government’s probable cause for the search should be sufficient to subpoena ISPs for the identity of the anonymous posters.

Key Factors for a New Standard
Based on the foregoing, it is essential to consider the following factors when proposing a new standard for disclosing the identity of online defamation defendants. Initially, courts commonly consider whether the plaintiff is a public figure or a private individual when requested to compel the disclosure of an anonymous Internet defamation defendant. Traditionally, courts have required defamation plaintiffs to demonstrate the defamer’s actual malice for defamation claims involving public figures, and negligence for private individuals. However, the dynamics of online platforms complicate this distinction. Once a defamatory statement is posted, even when targeting private individuals, it quickly enters the public domain and spreads widely, rendering impact of the statement quasi-public. Consequently, the rapid dissemination of information online blurs the lines between public figures and private individuals in defamation claims, making such a distinction legally less significant.

Moreover, given the inherent anonymity of online forum, the plaintiffs’ burden of proof of actual malice on the part of the defendant would be unduly burdensome. Therefore, courts must meticulously analyze the subject matter at issue, content and context of alleged online defamation, and apply a negligence standard even to public figures. This standard, which is lower than the actual malice standard, acknowledges the challenges posed by the swift dissemination of information in the online forum and the resulting blurred lines of responsibility.

Second, while the court in Zeran granted the ISPs immunity from liability both as publishers and distributors, the reasoning presented by the court in Grace suggests that ISPs should be incentivized to regulate defamatory content and information on their online forum.[48] In alignment with the reasoning in Grace, careful consideration must be made to ensure that ISPs, as distributors, can effectively regulate defamatory content online to protect defamation plaintiffs and uphold the Congress’ statutory intent.

Third, finding a delicate balance between the interests of both parties is crucial when determining whether to disclose the identities of the anonymous defamers. Setting the threshold too low could suppress free communication and infringe on the First Amendment right to free speech. Conversely, a threshold set too high could leave the defamation victims vulnerable to false and defamatory statements online.
Therefore, courts should prioritize protecting the reputation and privacy of the aggrieved party in addressing online defamation. A thorough examination of the subject matter, content and context of alleged defamatory statements should be conducted, and once the court finds that the plaintiff has a legitimate basis for the complaint, disclosure of the defendant’s identity should be warranted. In certain instances, the defendant’s Constitutional right to free speech and privacy should be defeated to protect innocent citizens harmed by online defamatory statements that entered the public domain. Courts should have the discretion to discern such cases.


The First Amendment grants the cherished right to freedom of speech, including anonymity. However, such rights are not absolute since false, tarnishing and defamatory statements do not warrant protection. In the realm of online defamation claims, with the development of Internet and its transformative impact on society, the defamation defendant’s Constitutional right should not supersede the rights of innocent victims.

In addressing online defamation, the Congress and courts have considered the First Amendment rights of the defamation defendant, but often overlooked the protection of the plaintiff’s rights. Thus, to ensure a more effective and equitable approach to addressing online defamation while upholding the rights of all parties, a new standard for disclosing online defamation defendants’ identities should consider the following factors: reevaluating the burden of proof for defamation claims due to blurred distinction between public figures and private individuals online; incentivizing ISPs to regulate defamatory content while balancing their immunity from liability with protection of defamation plaintiffs; and a delicate balance between free speech rights and protection of defamation victims.

1 Parasite actor Lee Sun-kyun found dead in Seoul (Dec. 27, 2023), The Guardian,
2 Director Bong Joon-ho calls for investigation into ‘Parasite’ actor Lee Sun-kyun’s death (Jan. 11, 2024), USA Today,
3 Jennifer O’Brien, Putting a Face to a (Screen) Name: The First Amendment Implications of Compelling ISPs to Reveal the Identities of Anonymous Internet Speakers in online Defamation cases, 70 Fordham L. Rev. 2745, 2750 (2002).
4 Erik P. Lewis, Unmasking “Anon12345”: Applying an appropriate standard when private citizens seek the identity of anonymous internet defamation defendants, 2009 U. Ill. L. Rev. 947, 948 (2009).
5 See Shawn C. Helms, Translating Privacy Values with Technology, 7 B.U. J. Sci. & Tech. L. 288, 304-05 (2001).
6 McIntyre v. Ohio Electrions Comm’n, 514 U.S. 334, 357 (1995). The Court reasoned that the protections for anonymous speech are not limited to political speech. The court upheld the First Amendment protection for anonymous literary speech, as well as anonymous handbills urging consumer boycotts.
7 Id. at 341.
8 See Reno v. ACLU, 521 U.S. 844 (1997).
9 See e.g., Cara J. Ottenweller, Note, Cyberbullying: The Interactive Playground Cries for a Clarification of the Communications Decency Act, 41 Val. U. L. Rev. 1285, 1296-99 (Spring 2007).
10 Stratton Oakmont, Inc. v. Prodigy Servs. Co., 1995 WL 323710 (N.Y. Sup. 1995).
11 Id.
12 47 U.S.C. § 230(a)(3).
13 See Valerie C. Brannon and Eric N. Holmes, Section 230: An Overview (Jan. 4, 2024), CRS Report, Congressional Research Service,
14 47 U.S.C. § 230(c)(1) (2006).
15 See Ambika Kumar and Tom Wyrwich, The Test of Time: Section 230 of the Communications Decency Act Turns 20 (Sep. 2016), Insight/Media Law Monitor, Davis Wright Tremaine LLP,
16 47 U.S.C. § 230(b).
17 See, e.g., New York Times Co. v. Sullivan, 376 U.S. 254, 279-80 (1964) (The court held that the plaintiffs, public officials must prove defamation defendant’s actual malice in making allegedly defamatory statements).
18 Gertz v. Robert Welch, Inc., 418 U.S. 323, 345-46 (1974) (The court prohibited the states from imposing strict liability for the defamation claims involving private individuals. After Gertz, most states adopted negligence as a standard for defining defamation involving private individuals, rather than public figures).
19 McMann v. Doe, 460 F. Supp. 2d 259, 266 (D. Mass. 2006).
20 Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997).
21 Id. at 329.
22 Id.
23 Id. at 331.
24 Id. at 332-33.
25 Id. at 333.
26 Zeran, 129 F.3d at 333.
27 Barrett v. Rosenthal, 40 Cal. 4th 33, 59 (Cal. 2006).
28 Id. at 58.
29 41 Val. U. L. Rev. 1285, supra, note 33, at 1307.
30 Grace v. eBay, 120 Cal. App. 984 (Cal. Ct. App. 2004).
31 Id. at 989-90.
32 Id. at 992-96.
33 Grace, 120 Cal. App. at 996-97.
34 Id.
35 Alan Rosenshtein, Interpreting the ambiguities of Section 230 (Oct. 26, 2023), The Brookings Institution,
36 America Online, Inc. v. Anonymous Publicly Traded Co., 261 Va. 350 (Va. 2001).
37 Dendrite International Inc. v. Doe, 775 A.2d 756, 760 (N.J. Super. Ct. App. Div. 2001).
38 Jonathan D. Jones, Cybersmears and John Doe: How far should First Amendment Protection of Anonymous Internet Speakers Extend? 7 First Amend. L. Rev. 421, 427 (Spring 2009).
39 Id. at 428.
40 Doe v. Cahill, 884 A.2d 451 (Del. 2005).
41 Cahill, 884 A.2d at 460.
42 Gertz, 418 U.S. at 402 (quoting Rosenblatt v. Baer, 383 U.S. 75, 92 (1966) (Stewart, J., concurring)).
43 See e.g., Robert C. Post, Symposium, The Social Foundations of Defamation Law: Reputation and the Constitution, 74 Cal. L. Rev. 691, 693-94 (1986).
44 Sullivan, 376 U.S. at 279-80.
45 Rosenbloom v. Metromedia, 403 U.S. 29 (1971).
46 Id. at 43.
47 Gertz, 418 U.S. at 345.
48 Grace, 120 Cal. App. at 996-97.