Last Updated on July 27, 2026 by Rob Cashman

In many BitTorrent and peer-to-peer copyright infringement lawsuits, the plaintiff begins with an IP address—not the name of the person it intends to sue. Through an ISP subpoena, a copyright plaintiff may seek to identify the Internet subscriber associated with that IP address. Understanding how ISP subpoenas work, and when a John Doe defendant loses anonymity, is critical for anyone facing a copyright infringement claim.

The ISP Subpoena process is the bridge between an anonymous Internet connection and a named individual.

Understanding that process is important because anonymity changes throughout the life of a copyright lawsuit.

At different stages:

the plaintiff may not know your identity;
the plaintiff may know your identity but you remain anonymous to the court and public;
or you may eventually be named and served as a defendant, ending your anonymity.

Understanding where you are in this timeline can help you better understand your legal options and the decisions that may become available at each stage of a copyright lawsuit.

ISP subpoena anonymity timeline showing the process from IP address identification through John Doe lawsuit, subscriber disclosure, and named defendant.

About the Author

Rob Cashman is a copyright defense attorney and the owner of Cashman Law Firm, PLLC. He is also the author of the TorrentLawyer blog. Since 2010, his law firm has focused on ISP subpoenas, dispelling misconceptions about motions to quash, defending clients in subscriber-identification disputes, most visibly over the last 10 years, in the Strike 3 Holdings cases.

TIMELINE: ISP SUBPOENAS AND ANONYMITY

STAGE 1: "JOHN DOE" LAWSUIT FILED & DISCOVERY REQUESTED. (ISP account holder remains anonymous.)

Stage 1: The Copyright Plaintiff Files a John Doe Lawsuit and Requests Discovery

Every ISP subpoena begins the same way: the plaintiff has technical information, but not a person’s identity.

The plaintiff may know:

the copyrighted work allegedly infringed;
the IP address observed during the alleged activity;
the date and time of the alleged activity;
and the ISP associated with the IP address.

However, the plaintiff does not yet know the subscriber’s identity.

Because the identity of the person associated with the IP address is unknown, the plaintiff typically files suit against anonymous “John Doe” defendants and asks the court for permission to obtain subscriber information through early discovery.

STAGE 2: COURT AUTHORIZES ISP SUBPOENA. (ISP is legally obligated to comply; ISP account holder remains anonymous.)

Stage 2: The Court Authorizes the ISP Subpoena

Once the court grants permission for early discovery, the plaintiff serves a subpoena on the ISP.

The subpoena requests information identifying the subscriber assigned to the IP address at the relevant date and time.

The ISP’s role is generally limited to responding to a court-authorized subpoena by providing subscriber information maintained in its ordinary business records. The ISP is not providing an opinion or input into whether copyright infringement actually occurred or whether the subscriber is legally responsible for the alleged conduct.

The ISP is generally only providing subscriber information maintained in its records.

STAGE 3: ISP SENDS SUBPOENA NOTIFICATION LETTER TO SUBSCRIBER. (ISP account holder still remains anonymous.)

Stage 3: The ISP Notifies the Subscriber and the Subscriber Responds

After receiving a subpoena, many ISPs notify the subscriber whose account information has been requested by sending a “Subpoena Notification Letter.”

This letter provides notice to the subscriber that identifying information may soon be disclosed to the plaintiff unless the subpoena is challenged or otherwise resolved.

Importantly, receiving an ISP subpoena notice is a good indicator that the subscriber:

remains anonymous to the plaintiff and the plaintiff’s attorney,
remains anonymous to the court,
remains anonymous to the public, and
they have not yet been publicly identified as a defendant.

The plaintiff knows that an Internet account exists.

The plaintiff does not yet know the identity of the person associated with that account.

SUBSCRIBER INQUIRIES ABOUT FILING A MOTION TO QUASH. (ISP account holder might self-disclose his identity.)

Some ISP Subpoena Notification Letters suggest filing a Motion to Quash the Subpoena

Some ISPs word their “Subpoena Notification Letter” in a way which suggests that the subscriber may try to object to their disclosure by filing a motion to quash (sometimes referred to as an “opposition with the court”) or another appropriate request for relief with the court.

In copyright cases involving unlawful downloading, a Motion to Quash is a request by the Subscriber (a non-party) asking the court to prevent the ISP from complying with the subpoena issued to it.

Whether filing a motion to quash is appropriate depends on the specific circumstances of the case, including issues such as:

whether the court has jurisdiction over the subscriber;
whether the subpoena seeks information that is properly discoverable;
whether the plaintiff has provided sufficient evidence connecting the IP address to the alleged infringement;
whether the subscriber is the proper party to file the motion,
whether the subscriber has other legal arguments available (whether now, or once named as a Defendant),
and the practical costs and benefits of challenging the subpoena.

I have written extensively about the strategic considerations involved in deciding whether to challenge an ISP subpoena, including the potential advantages and disadvantages of filing a motion to quash:

Should You File a Motion to Quash an ISP Subpoena in a Strike 3 Holdings Copyright Lawsuit?

In general, a Motion to Quash has its place in the federal courts. It is a useful tool when one party demands that the other party disclose to them information they are either not permitted to access, or in a form that is not permitted by the Federal Rules.

In many circumstances, a Motion to Quash is an effective mechanism, as demonstrated in the recent New York Times lawsuit, where the US Department of Justice subpoenaed records of its journalists.

However, in copyright infringement cases involving an unknown internet user, and their IP Address is observed while they infringe the copyright rights of another, motions to quash are not as effective because it is not the internet users who are subpoenaed to ascertain their identity, but their internet service provider.

STAGE 4: ISP PROVIDES SUBSCRIBER INFORMATION TO PLAINTIFF'S ATTORNEY. (Not anonymous to plaintiff; still anonymous to public.)

Stage 4: The ISP Provides Subscriber Information

If the subscriber does not successfully challenge the subpoena, or if the court permits disclosure, the ISP will provide the requested subscriber information to the plaintiff.

At that point, the plaintiff’s attorney learns the identity of the subscriber associated with the IP address at the relevant date and time. Procedurally, that subscriber still has the status as a potential “John Doe Defendant” because the plaintiff has not yet amended the complaint to identify the subscriber as being the accused Defendant in the lawsuit.

However, this creates an important distinction:

The plaintiff may know the subscriber’s identity, but the subscriber is still anonymous to the court and the public.

Important Distinction:
Many people assume that once the ISP provides subscriber information, they have “been sued.” They are not sued until the plaintiff’s attorney amends the complaint and identifies them as the Defendant.
Many plaintiffs use lawsuits as a mechanism to extract settlements from those who have downloaded, streamed, or copied their content without a license.
Whether the plaintiff names that subscriber as a defendant is a separate decision.

A John Doe Defendant does not lose all anonymity the moment the ISP responds to the subpoena.

Instead, there are different levels of anonymity:

anonymity from the plaintiff;
anonymity from the court record;
anonymity from the general public.

Understanding these distinctions is essential to understanding what happens next in a copyright lawsuit.

Have you read enough? Book Now to get help.

When Does a John Doe Defendant Actually Lose Anonymity?

The answer depends on what type of anonymity is being discussed.

The subpoena process creates several different stages of anonymity.

Type #1: Anonymous to the Plaintiff

At the beginning of the lawsuit, the plaintiff typically knows only limited information:

the IP address allegedly associated with the infringement;
the date and time of the alleged activity;
and the ISP responsible for assigning that IP address to the internet user.

The plaintiff does not yet know the subscriber’s identity.

At this stage, the subscriber is anonymous to everyone involved in the lawsuit except the Internet Service Provider that maintains the subscriber records.

Type #2: Known to the Plaintiff, But Still Anonymous to the Public

After the ISP complies with the subpoena, the plaintiff’s attorney receives the subscriber’s identifying information. They receive this directly from the ISP because it is the plaintiff’s attorney who requests the subscriber’s contact information.

At this point, the plaintiff’s attorney may know:

the subscriber’s name;
address;
and other information provided by the ISP.

However, the subscriber is still anonymous to the court and the public.

The subscriber continues to be aware that the “John Doe” Defendant referenced in the lawsuit refers to them. But they are merely a ‘potential’ defendant; the plaintiff could still conclude that they are not the proper party to be accused (or steps could be taken to convince the plaintiff to decide not to associate them with the lawsuit, whether through argument, demonstration, or settlement).

The plaintiff and the plaintiff’s attorney is also aware that the subscriber was the individual assigned the IP Address which they observed infringing their copyrighted content. However, they do not know yet if it was the subscriber who was ‘at the keyboard’ engaging in the online activities.

Unless and until the plaintiff takes the next step and identifies that person in the court filings as the accused Defendant, the subscriber remains anonymous to everyone else.

When Does Legal Anonymity Actually End?

A John Doe defendant loses anonymity when the plaintiff files an amended complaint identifying the defendant by name and serves that defendant with the lawsuit.

At that point, the individual is no longer an anonymous defendant.

STAGE 5: PLAINTIFF'S ATTORNEY NAMES THE SUBSCRIBER AS DEFENDANT. (No longer anonymous.)

Type #3: Known to Plaintiff, Known to the Public (No Longer Anonymous)

Once the defendant is named and served as a defendant in the lawsuit, the litigation moves from a case involving an unidentified Internet subscriber to a lawsuit involving a named party.

In our articles, we have referred to this transition as changing from the “John Doe” Phase of the lawsuit to the “Named and Served” Phase of the lawsuit. This transition is significant because it changes the practical considerations facing the defendant.

Once named and served, the timelines of what the Defendant needs to do and the procedural deadlines of how long he has to do it become immediate concerns.

The named defendant must then evaluate the new set of available options, which may include:

challenging the claims;
raising applicable defenses;
negotiating a resolution;
or continuing to litigate the matter.

The decision depends on the facts of the case, the strength of the plaintiff’s evidence, the available defenses, the potential costs of litigation, and the defendant’s individual circumstances.

Once a defendant has been identified, whether they want to participate in litigation or not, their “choice” as to whether to participate is limited because it is no longer a matter of “should we litigate,” but “what must I do next to prevent being found liable.”

Plaintiffs and their attorneys are aware of this too, and they often take advantage of the additional obligations and pressures an accused Defendant must comply with. This often results in increased settlement asking prices, as we have seen in the Strike 3 Holdings, LLC cases.

Why This Timeline of Anonymity is Important

Understanding when anonymity ends is important because the subpoena process is not simply a single event.

There is a progression:

An IP address is identified.

↓

The ISP is subpoenaed for subscriber information.

↓

The plaintiff learns the subscriber’s identity.

↓

The subscriber may remain anonymous to the public, while being able to defend against being named-and-served, or while being able to negotiate a settlement and a release of liability while still in the “John Doe” Phase of the lawsuit.

↓

The plaintiff names and serves the defendant, ending anonymity.

Each stage presents different legal and practical considerations.

Consequences of losing anonymity after being named and served

Once named and served, anonymity no longer exists on its own.

The subscriber’s identity is publicly available and searchable on search engines, and their association as being an accused defendant in the lawsuit can have consequences far beyond the embarrassment or reputation damage.

Those having security clearance could lose their clearance (and by extension, their job) if it is discovered they were sued in a lawsuit.
Those seeking to immigrate into the United States could find that their involvement in the lawsuit shows up in an immigration background check.
Those applying for professional licenses (for example, to be admitted to the practice of law) might be denied admission by failing an ethics filter which they must pass in order to be admitted.
There are many other examples as well, e.g., the financial effects that a civil judgement (if an answer is not timely filed) on a credit report, or the loss of a job (or a potential job) because the existence of the lawsuit shows up in a background check or website search.

It is noteworthy that this loss of anonymity is reversable, however, by asking the court for a protective order (or, to seal the case) so that the accused defendant can properly defend the claims against him. This remedy can be requested if a Defendant chooses to fight against the claims asserted against him.

If a Defendant Chooses to Fight

A defendant who chooses to contest a copyright infringement lawsuit should understand that litigation involves more than simply asserting that “someone else may have used my Internet connection.”

The available defenses and strategies depend on the specific facts and procedural posture of the case, and are outside of the context of this article. Readers interested in a broader academic discussion of litigation strategy and copyright-trolling defenses may also find Professor Matthew Sag’s article, “Defense Against the Dark Arts of Copyright Trolling,” informative.

For the purpose of this article, however, anonymity ends when an individual is named-and-served as a defendant — when the lawsuit moves from the “John Doe” Phase to the “Named and Served” Phase. Once the defendant chooses to fight, he can petition the court for a protective order so that he can regain the anonymity he previously enjoyed.

Questions About an ISP Subpoena?

If you have received an ISP subpoena notice, a copyright infringement complaint, or have questions about your legal options, I invite you to e-mail me at info@cashmanlawfirm.com, or set up a confidential consultation. You can also use the form below.