Obtaining the identity of an anonymous Gmail user: a blackmail victim wins in emergency proceedings.

The protection of anonymity on the Internet is a widely recognized principle. However, it is not absolute. When a person is a victim of serious offenses committed from an anonymous email address, it is possible, under strictly defined conditions, to obtain a court order to lift this anonymity.

This is perfectly illustrated by a decision rendered on October 27, 2025, by the Judicial Court of Paris, ruling in summary proceedings (TJ Paris, 27 Oct. 2025, n° 25/55080 \\ [1\\]).

Seized by a woman who was a victim of harassment and blackmail by email, the Judicial Court of Paris, ruling in summary proceedings, ordered Google to transmit to her all identification data in its possession concerning the holders of two anonymous Gmail accounts, provided that these data are legally retained and have been provided by the users.

The plaintiff's daughter, born from a previous marriage, had filed a criminal complaint for sexual offenses that she attributed to her stepfather.

Shortly after filing this complaint, Ms. \\[C\\] began to receive anonymous emails.

Their contents are threatening: the author claims to possess information about the complaint and threatens to publish documents concerning the family's private life on social networks. These threats are accompanied by several anonymous phone calls, coming from numbers clearly generated by anonymization applications.

The facts could constitute several serious offenses: blackmail (Article 312-10 of the Penal Code), harassment (Article 222-33-2), and invasion of privacy (Article 226-1).

In order to react, Ms. \\[C\\] initiated summary proceedings based on Article 145 of the Code of Civil Procedure.

This text allows for the obtainment of investigative measures before any trial, when there is a legitimate reason to preserve or establish proof of facts upon which the resolution of a dispute may depend.

She therefore requested the President of the Judicial Court of Paris to enjoin Google Ireland Limited and Google LLC to provide her with all identification data of the holders of the Gmail accounts used to send her the threatening messages.

The court granted her request.

No prior criminal complaint is required: civil urgent proceedings are enough to obtain identification, provided the legitimate reason is made out.

The obligation for electronic communication service providers to retain data is provided for in Article L34-1 of the Postal and Electronic Communications Code.

This text, supplemented by Decree No. 2021-1361 of October 20, 2021, enjoins platforms to retain several types of data, distinguishing between information voluntarily entered by the user during registration and identification data of the connection source (IP addresses).

Data voluntarily entered by the user may include:

- information relating to the user's civil identity (name, surname, address, etc.), - information provided during account creation (pseudonyms, associated addresses, etc.), - payment information.

This identity information can be obtained in any judicial proceeding, including in defamation cases, when a criminal offense is potentially constituted.

Conversely, technical data such as IP addresses can only be transmitted for the purposes of combating serious crime and delinquency (cyberstalking, blackmail, etc.), in accordance with the provisions of point 3° of II bis of Article L34-1 and IV of Article R10-13 of the Postal and Electronic Communications Code.

Thus, only certain criminal offenses (the most serious) can lead to the communication of IP addresses by platforms, which can be regrettable given the importance of this data.

The dividing line is clear: declared data can be obtained in any proceedings, IP addresses require serious crime.

The court favorably granted Ms. \\[C\\]'s request and ordered Google to provide her with all identification data in its possession concerning the disputed accounts, namely:

- the names and surnames, or the corporate name, of the account holders, - the associated postal and email addresses, - the telephone numbers, - the IP addresses used during account creation, - connection times and dates.

Google Ireland Limited and Google LLC have 15 business days to comply, without having the right to inform the targeted users of the identification request.

However, the judge recalled that Google can only transmit data actually provided by users, and still present in its systems, in accordance with the retention period imposed by the aforementioned texts.

This order recalls that, even in the absence of a judicial investigation, a victim can act in summary proceedings to identify the perpetrator of anonymous blackmail. The judge here considered that the alleged facts, blackmail and harassment accompanied by threats of publishing sensitive content, fall under serious delinquency, a necessary condition to justify the lifting of IP addresses.

In many similar cases (identity theft, revenge porn, defamatory statements, etc.), victims face the difficulty of identifying the perpetrator.

This order confirms that the law today offers effective legal tools to restore balance.

For practitioners, it emphasizes the importance of accurately targeting the legal grounds, providing detailed evidence, and relying on proper procedures.

It should be noted that the communication request could have been made through the accelerated fundamental procedure provided for in Article 6-3 of the LCEN law \\ [2\")\\] which also allows for requesting measures to stop the harm (deletion of publications, accounts, etc.).

Our lawyers bring these identification proceedings for victims of blackmail, harassment and online threats, then run the criminal and compensation claims against the person identified. See also our cyberbullying lawyer and e-reputation lawyer pages. Contact the firm: we answer every enquiry within 24 hours.