Background
MKR, a lecturer and academic, alleged that since December 2024 thousands of internet domains had used her full legal name, sometimes including a little-known middle initial, in URLs or search-result snippets. The links redirected users to pornographic or adult content. The conduct continued in changing forms for more than 18 months, including through short-lived domains, persistent domains and, later, sites employing geographic restrictions. MKR said the conduct caused serious distress and threatened her professional reputation.
After attempts to identify the person responsible through public information, the police and internet infrastructure providers proved unsuccessful, MKR sought Norwich Pharmacal disclosure orders against Cloudflare Limited and three related UK companies: Mesh Digital Limited, 123-Reg Limited and Host Europe Group Limited. Factual disputes about whether Cloudflare Limited possessed or controlled the requested information led the court to transfer the claim against that company from Part 8 to Part 7 for a trial in early 2027. This judgment addressed only the unopposed claim against the other three defendants.
The Court’s Holding
Mrs Justice Hill granted the requested Norwich Pharmacal order against Mesh Digital, 123-Reg and Host Europe Group. MKR had a good arguable case that the domain activity constituted harassment under the Protection from Harassment Act 1997 and defamation by implication. Its persistence, timing and adaptation following complaints supported an inference that MKR had been deliberately targeted, while associating her name with adult content was arguably oppressive, distressing and seriously harmful to her reputation.
The court held that the three defendants were sufficiently mixed up in the alleged wrongdoing and were able, or likely able, to supply information identifying the wrongdoer. Mesh Digital’s domain-registration or hosting services facilitated the relevant website, while the roles and prior communications of its sister company and parent company supported relief against them as well. Disclosure was necessary and proportionate because MKR had exhausted practical alternatives, the requested categories were carefully focused on identification, and the interest in vindicating her rights outweighed the anonymous party’s privacy interest.
The defendants were ordered to disclose defined information about the person or persons behind the relevant domain within seven days. MKR’s use of that information was restricted to pursuing civil relief, reporting the matter to law-enforcement or regulatory authorities, or seeking further identification-related relief. No cross-undertaking in damages was required. MKR was ordered to pay compliance costs, capped at £200 for each defendant. The separate claim against Cloudflare Limited remained unresolved.
Key Takeaways
- A domain registrar or hosting provider may be “mixed up” in online wrongdoing when its services enable and facilitate the offending website, rather than merely supplying evidence as a witness.
- Repeatedly placing a person’s name in URLs or search snippets linked to adult content can support arguable claims for harassment and defamation by implication.
- Norwich Pharmacal disclosure must remain necessary, proportionate and narrowly directed toward identifying the alleged wrongdoer.
- The order did not determine Cloudflare Limited’s disclosure obligations; that claim was transferred to Part 7 because of factual disputes over possession or control of the information.
Why It Matters
The decision illustrates how Norwich Pharmacal relief can help victims identify anonymous actors who use domain infrastructure to conduct sustained online harassment and reputational attacks. It also clarifies the distinction between an intermediary that merely holds evidence and one whose registration or hosting services facilitate the alleged wrong.
For internet infrastructure providers, the judgment underscores that non-engagement with pre-action correspondence does not prevent an identification order where the evidence shows that relevant records likely exist and can be supplied. The court nevertheless applied the usual costs principle favoring an innocent respondent, while capping compliance costs to reflect the defendants’ lack of engagement, the likely modest burden and MKR’s financial circumstances.