Determining Authorship in Social Media Accounts

The seven guideposts in XXX v. People, G.R. No. 274842 (22 October 2025) are not arbitrary evidentiary rules. Each is grounded in the principle that criminal liability requires proof beyond reasonable doubt of the identity of the perpetrator, and that social media accounts are susceptible to impersonation, fabrication, hacking, and dummy account creation. The Court therefore adopted methods that reliably connect the accused—not merely the account—to the online act.  

1. Admission of ownership or authorship

Ratio: An admission is among the strongest forms of direct evidence because it comes from the accused himself. If a person admits owning the account or making the post, the issue of identity is largely resolved without relying on inference.

The Court treats this as direct evidence because identity no longer depends on circumstantial proof or technical authentication. It is consistent with the rules on admissions under the Rules on Evidence.  

2. Eyewitness evidence

Ratio: Seeing the accused log in, compose, or post directly links the accused to the account and the communication.

The rationale mirrors ordinary criminal cases: eyewitness testimony may establish identity. The fact that the act occurs through a digital medium does not diminish the evidentiary value of someone personally observing the accused use the account.  

3. Exclusive or insider information

Ratio: Information uniquely known to the accused functions as a digital “signature.”

If the post contains facts that only the accused—or a very limited group—could know, it becomes highly improbable that an impersonator authored it. This is classic circumstantial evidence under Rule 133 because the content itself points toward authorship.  

4. Distinctive language or writing style

Ratio: Every individual tends to exhibit identifiable linguistic habits.

Vocabulary, spelling, grammar, dialect, recurring phrases, emojis, punctuation, abbreviations, and writing patterns may collectively identify an author, much like handwriting or voice identification.

The Court recognized that authorship can be inferred from these recurring characteristics even without technical evidence.  

5. Technical and forensic evidence

Ratio: Digital artifacts objectively connect a person, device, and account.

Examples include:

• ISP records;
• telecommunications records;
• Meta/Facebook records;
• login history;
• IP addresses;
• device forensics;
• geolocation;
• search history;
• hard drive examination;
• social media forensic attribution.

Unlike human testimony, these are machine-generated traces showing that the account was accessed from a particular device or connected to the accused’s email, phone number, or other accounts.

However, the Court expressly emphasized that these forms of evidence are not indispensable because many prosecutions cannot realistically obtain them from foreign social media companies. Otherwise, many genuine offenses would become practically impossible to prosecute.  

6. Conduct consistent with previous posts

Ratio: Consistent behavior over time supports authorship.

A person’s online conduct often exhibits recurring habits:

• whom they interact with;
• the topics they discuss;
• the timing of posts;
• recurring jokes;
• relationships reflected in conversations;
• established posting behavior.

If the disputed communication fits that established behavioral pattern, it strengthens the inference that the accused authored it rather than an impersonator. This is another form of circumstantial evidence based on consistency of conduct.  

7. Other evidence showing ownership, access, or authorship

Ratio: The Court intentionally avoided creating an exclusive checklist.

Technology evolves rapidly. Limiting proof to six specific methods could exclude future reliable authentication techniques.

Accordingly, the Court made the list illustrative rather than exhaustive, allowing courts to consider any competent evidence that logically proves ownership, access, or authorship. This preserves flexibility while remaining subject to the Rules on Evidence.  

The overarching ratio behind all seven guideposts

The Court’s central rationale is that social media evidence presents a unique identification problem. A Facebook profile name, profile picture, or screenshot alone does not prove who actually controlled the account because:

• anyone can create a fake account;
• accounts may be hacked or shared;
• names and photographs can be copied;
• screenshots can be fabricated or manipulated.

Therefore, courts must examine all the surrounding circumstances that connect the accused to the account and the communication. The seven guideposts are simply different ways of establishing that connection through direct or circumstantial evidence, with no single method being mandatory. Ultimately, the prosecution must prove beyond reasonable doubt that the accused was the person who owned or accessed the account and authored the post or message.

This article is for general informational purposes only and does not constitute legal advice. For advice on a specific situation, consult a qualified lawyer.

Torres Law Office · General Santos City, Philippines · Est. 1991