← LegalCite blog · Home

How to document online harassment so the evidence holds up

July 6, 2026 · Practical guide · Factual claims link to their sources.

A safety note first: if anyone is threatening you or your family with violence, contact local law enforcement now — documentation can wait until you are safe. Threats communicated online can also be reported to the FBI's Internet Crime Complaint Center.

For everything else — the fake accounts, the abusive comments, the posts about you, the review-bombing, the account impersonating you — the order of operations matters more than most people realize.

1. Preserve first, report second

The instinct is to hit "report" immediately. Resist it for sixty seconds. When a platform removes content — or the harasser deletes it, or deletes the whole account — the public evidence goes with it, and getting anything back later typically requires legal process directed at the platform. Capture the material before you report it. Then report it. You lose nothing by preserving first, and you can lose everything by reporting first.

2. Capture more than the single post

One abusive comment, cropped tight, proves very little. What makes a harassment case is pattern and identity, so capture the surroundings that establish both:

3. Keep a harassment log

Judges, police officers, and platform trust-and-safety teams all respond to the same thing: a tidy, dated record. Keep a simple running log — a notes file or spreadsheet — with one line per incident: date and time (with your time zone), the URL, the account, what happened, and the filename of your capture. Harassment and stalking statutes generally turn on a course of conduct — repeated acts over time — which is exactly what a log demonstrates and a shoebox of screenshots doesn't. This log is also what turns a rambling twenty-minute account at the police station into a two-minute handoff.

4. Make each capture one a court can use

To be admitted, evidence must be authenticated: under Federal Rule of Evidence 901(a), you need "evidence sufficient to support a finding that the item is what the proponent claims it is" — usually your own testimony about when and how you captured it (Rule 901(b)(1)). State rules are generally similar.

The most common attack on screenshot evidence is "this could have been doctored." Since 2017, Federal Rules of Evidence 902(13) and 902(14) have addressed exactly that: the committee notes to 902(14) point to hash values — a digital fingerprint that changes if even one byte of a file changes — as the way to show a copy is genuine.

Practically: keep the original capture files unedited (annotate copies, never originals), record a SHA-256 hash at capture time if your tool supports it, and store everything somewhere that won't vanish with a lost phone.

5. Know where third-party tools stop

Honesty over sales copy: public-webpage capture tools — ours included — cannot capture DMs, private accounts, or text messages, and nothing can capture what's already deleted. For private messages, screenshot or screen-record the thread on your own device, keep the device, and note the same details (date, time, account). For content that's already gone, a lawyer or law enforcement can send the platform a preservation request — under 18 U.S.C. § 2703(f), providers must preserve records for 90 days (extendable) when a governmental entity requests it pending legal process. That's a reason to involve police early when conduct crosses into threats or stalking: they can freeze evidence you can't.

6. Where the evidence goes

A well-documented file serves you in every venue at once: a police report (bring the log and captures), a petition for a protective or anti-harassment order (many courts let you attach exhibits — dated full-page captures with URLs read far better than cropped images), a platform report or appeal, a demand letter, or a civil claim. You build the record once; every process that follows draws on it.

The 60-second version

  1. If there are threats of violence, law enforcement first — and IC3 for online threats.
  2. Preserve before you report. Removal destroys public evidence.
  3. Capture the post, the profile, and the context — full page, URL and date visible.
  4. Keep a dated log: pattern is what harassment cases are made of.
  5. Originals stay untouched; a hash recorded at capture time proves they stayed that way.
  6. Private content: capture on your device, keep the device. Deleted content: ask about a § 2703(f) preservation request.
Need a capture that documents itself? ProofSnap saves any public webpage — a post, a profile, a review — as a court-exhibit-style PDF: full-page screenshot plus a certificate page with the UTC timestamp, the exact URL, a SHA-256 integrity hash, the capture method, and a public verification record anyone can check later. No account, $4.99 one-time, done in about a minute — while the page is still up. Capture a page now →

This is general information, not legal advice; harassment, stalking, and protective-order law varies by state, and admissibility is always decided by the court under the rules of your jurisdiction. ProofSnap preserves public webpages with a timestamp and integrity hash; it cannot capture private content and does not guarantee any capture will be admitted as evidence. Sources: Fed. R. Evid. 901, Fed. R. Evid. 902(13)–(14), and 18 U.S.C. § 2703 (Cornell LII); FBI Internet Crime Complaint Center.