Digital footprints — the trail of data left behind by users during their online activities — now play a major role in criminal investigations. Every action on online platforms, from posting content to sending private messages, creates records that can later be traced and examined.
A single social media post, especially one made in haste, can have serious legal consequences for individuals and organizations. While social media remains an essential platform to communicate and build brands, it now operates in an environment where online conduct is closely monitored and scrutinized.
Our courts have recognized that once a social media account is created, the user can post statements, photos, or videos visible to others. At the same time, fake or dummy accounts are easy to create and often used for impersonation, disinformation, identity theft, and other criminal activities. Because of this, proving who owns, controls, or authored content from a social media account has become essential in criminal cases.
GUIDEPOSTS
In XXX v. People (G.R. No. 274842, Oct. 22, 2025), the Supreme Court addressed the challenge of proving who actually controls or authors posts from social media accounts. The Court established guidelines in proving the fact of ownership of, or access to, a social media account in the context of crimes and offenses committed through social media.
To prove ownership or access, the following may be shown:
1. An admission of ownership of or access to the social media account, or authorship of the social media post or private message;
2. Evidence that the offender was seen accessing or using the account, or composing, posting, or sending the post or private message;
3. A social media post or private message containing information known only to the offender or a few people, or that only the offender could be expected to know;
4. Use of language or writing style consistent with the offender’s characteristics indicating authorship of the social media post or communication;
5. Records from the internet service provider, telecommunications company, or social media site, and results from device forensic analysis showing geolocation features, and other attributes linking the account to the offender;
6. Acts consistent with previous posts or private messages sent through the social media account; or,
7. Other instances showing ownership, access, or authorship.
DUMMY ACCOUNT DEFENSE
In cyber libel, harassment, and similar cases, a common defense is the claim that the account used was fake or controlled by someone else.
In XXX v. People, the accused also raised a similar defense. Although the account carried his name and displayed a photograph of him with his child, he argued that someone might have used his photo to create a dummy account and post derogatory statements against the complainant. In rejecting this claim, the Court examined the account’s history, its interactions with Facebook friends, and messages that contained information known only to the accused.
The Court explained that authorship may be established through a combination of circumstantial evidence that, taken together, points to the accused as the author of the social media post.
This ruling shows that courts now look beyond account ownership and consider a broader examination of digital footprints. This includes not only active footprints, or those deliberately generated by users such as social media posts and messages, but also passive data collected without direct user actions, such as IP addresses, browsing history, and location data from GPS-enabled devices.
CORPORATE CONSIDERATIONS
Although the case of XXX v. People involved a violation under the Anti-Violence Against Women and Children Act, the same evidentiary principles may be applied in cases involving cyber-libel, intellectual property disputes, and cases involving unauthorized disclosure of confidential information.
In many organizations, several employees or third-party providers may have access to corporate social media accounts. This makes determining responsibility more difficult, especially considering the Court’s focus on access and behavior patterns. While the Court clarified that forensic analysis and data are not indispensable, they remain valuable in evidence gathering and establishing accountability. For this reason, having an adequate IT system and access controls is crucial for managing potential legal risks.
Ultimately, the Supreme Court’s ruling underscores that online conduct has real and enforceable legal consequences. As these guideposts are applied, companies and their leaders should ensure that their policies, controls and practices can withstand the growing scrutiny over online identity and accountability.
References:
Soni N., &, Soni P., Tracing the Unseen: The Role of Digital Footprints in Modern Forensic Investigations, available at https://ijirt.org/publishedpaper/IJIRT167732_PAPER.pdf last visited on Jan. 30.
SC Provides Guide in Proving Identity of Social Media Account in Criminal Cases, available at https://sc.judiciary.gov.ph/sc-provides-guide-in-proving-identity-of-social-media-account-in-criminal-cases/ last visited on Jan. 30.
XXX v. People of the Philippines, G.R. No. 274842, Oct. 22, 2025.
The views and opinions expressed in this article are those of the author. This article is for general informational and educational purposes only and is not offered as, and does not constitute legal advice or legal opinion.
Gillian Ruth A. Grancho is an associate of the Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW), Davao Branch.
(6382) 224-0996
