How to prove cyberstalking on Facebook: document repeated harassment over time
Cyberstalking is supported by a pattern of incidents over time, so each message, comment and new account needs its own verifiable date and time.
Updated on
Proving cyberstalking on Facebook means showing a pattern: every message, comment and new account, each recorded with its own date and time. TrueScreen certifies each incident at the source, and each certification carries a qualified electronic seal and qualified timestamp that a lawyer or the police can check.
Key takeaways
- Article 6 of Directive (EU) 2024/1385 requires Member States to criminalize repeatedly or continuously placing a person under surveillance by means of ICT, without consent, where this is likely to cause serious harm; transposition is due by June 14, 2027.
- A stalking log needs, for each incident, the date and time, the profile URL, the full content in context, what you did next and the effect on you.
- Meta’s law enforcement guidelines state that it does not retain data for law enforcement unless a valid preservation request arrives before the user deletes the content.
- In the EU, under eIDAS, a qualified electronic seal enjoys the presumption of integrity and correct origin of the data (Art. 35(2)) and a qualified timestamp the presumption of accuracy of its date and time (Art. 41(2)).
- TrueScreen certifies how and when each incident was acquired, not who is behind a profile; the court weighs the evidence case by case.
21,557
harassment and stalking complaints received by the FBI’s Internet Crime Complaint Center in 2025 (complaints, not prevalence)
FBI IC3, Internet Crime Report 2025
3.4 million
people aged 16 or older who were stalking victims in the US in 2019
Bureau of Justice Statistics, Stalking Victimization, 2019 (2022)
29%
of stalking victims who reported it to the police in 2019
Bureau of Justice Statistics, Stalking Victimization, 2019 (2022)
Cyberstalking on Facebook rarely starts with something that looks serious: a message at midnight, a comment under a family photo, a friend request from an unknown account. Over weeks they form a pattern, and if you are wondering how to prove cyberstalking, that pattern is what you will need to show.
Defamation usually turns on one post, as our guide on deleted Facebook posts as evidence explains. With stalking, the evidence is the timeline: a series of separate, dated certifications, not a camera roll with nothing to check it against.
If you are in immediate danger, call your local emergency number (911 in the US) first. Your safety comes before any evidence.
This insight is part of our guide: guide to Facebook defamation and deleted posts
When Facebook messages and comments become cyberstalking
What matters most in cyberstalking is repetition and its effect on the person targeted, more than how offensive any single message is; the legal test depends on where you are.
Facebook harassment starts to look like cyberstalking when the same person keeps coming back: messages after you stopped replying, comments on everything you post, new accounts after a block. Cyberstalking laws differ by jurisdiction. In the EU, Directive (EU) 2024/1385 requires Member States to criminalize, among other things, repeated or continuous surveillance of a person by means of ICT; Member States have until June 14, 2027 to transpose it.
Repeated conduct and its impact on the victim
A message that is merely rude once reads differently when it arrives every evening for a month. A lawyer weighing whether you can prove cyberstalking will want to see the frequency and how it escalated over time, along with what each incident changed for you.
What the EU Directive requires Member States to criminalize
Article 6 of Directive (EU) 2024/1385 requires Member States to make punishable as a criminal offense “the intentional conduct of repeatedly or continuously placing a person under surveillance, without that person’s consent or a legal authorisation to do so, by means of ICT, to track or monitor that person’s movements and activities, where such conduct is likely to cause serious harm to that person.” Member States must transpose the Directive by June 14, 2027, so it is not yet national law everywhere. Other harassing conduct, such as repeated abusive messages, may fall under different rules; a lawyer can tell you which.
How to prove cyberstalking: a sequence of incidents, not a single screenshot
What supports a cyberstalking complaint is the timeline: each incident captured separately, with a date and time a third party can verify.
A screenshot shows one moment. Stalking is conduct over time, so to prove cyberstalking you need the whole series to be reliable. A screenshot on its own gives a third party little to verify about when and how it was made, and across many screenshots every doubt adds up.
Every incident with its date
A stalking log works best when every entry records the same things:
- date and time of the incident;
- the profile URL, since names change and new profiles appear;
- the full content in context, such as the whole thread;
- what you did next (blocked, reported, replied);
- the effect it had on you.
If the same person also writes on WhatsApp, keep one timeline and see our insight on WhatsApp stalking evidence.
Content that disappears: deleted posts and comments
What the stalker deletes may be gone before anyone asks for it. The Budapest Convention on Cybercrime provides for expedited preservation of stored computer data (Article 16). In its law enforcement guidelines, Meta ties retention to a preservation request made before deletion, which is why reporting to the police early matters.
No certification brings back what has already disappeared. When a post or comment looks likely to vanish, certify it right away with the Browser Extension on your computer or Web Browsing Acquisition in the TrueScreen App on your phone.
How TrueScreen certifies each incident with date and time
TrueScreen turns every incident into its own certification, so the sequence rests on separate records that each carry a verifiable date and time.
TrueScreen, the Data Authenticity Platform, certifies each incident on Facebook when it happens: it acquires the content at the source with a forensic methodology, verifies the data and closes each acquisition with a qualified electronic seal and qualified timestamp, recognized internationally. In the EU, under the eIDAS Regulation, a qualified electronic seal enjoys the presumption of integrity and correct origin of the data (Article 35(2)), and a qualified timestamp the presumption of accuracy of its date and time (Article 41(2)). TrueScreen certifies how and when the content was acquired, not who is behind a profile: identifying the author is a job for investigators.
-
Acquire each incident at the source
Which TrueScreen tool to use for each type of Facebook content, and what to capture Facebook content What to capture TrueScreen tool Messenger on your phone the whole thread, scrolling through it screen recording in the TrueScreen App Messenger or Facebook on a computer the conversation in the web version Forensic Browser Profile, posts and comments on your phone profile URL, the post and its comments Web Browsing Acquisition in the TrueScreen App A post or comment about to be removed visible area, full page or a video of the tab Browser Extension If you log in to Facebook inside a full recording in the Forensic Browser or inside Web Browsing Acquisition, the Login is recorded with the session. The recording shows everything on your screen, so close other apps and tabs, turn off notifications and never show your password or one-time codes. Your certification package contains the video and the original files, with other people’s names and messages: share it only with your lawyer or the police, and do not post it online. For private messages, see certifying a Messenger chat.
-
Certify every new incident as it happens
Each certification has its own date and time and stays in your workspace archive, visible in the Portal, where you can sort it into folders; for certifications made with the App, the App’s Archive tab lets you edit title and notes to number each incident. Keep certifying after you block the account or file a report: new contact, new accounts and messages after a block belong in the timeline too. You do not need to reply, and you should not try to provoke contact to collect evidence. Older screenshots can be certified as files, but their date is fixed from the moment of certification, not from when they were taken.
-
Hand the sequence to a lawyer or the police
A copy of a certification sent to your lawyer carries the same weight as yours and can be checked independently of TrueScreen, for example on the public verification page. Order the certifications by date next to your log, and see our guide to social media evidence from capture to the police report. The court weighs any evidence case by case. If you are in immediate danger, call your local emergency number first.
Conclusion
Cyberstalking on Facebook is rarely one dramatic message; it is the same person returning, week after week, through messages, comments and new accounts. What you can bring to a lawyer or the police is that pattern, made of incidents that each carry their own date and time. Certify each one while it is still on screen, keep your log alongside it and let a professional assess the case: the weight of the evidence is for the court to decide.
FAQ: proving cyberstalking on Facebook
What is legally considered cyberstalking?
What counts as cyberstalking depends on the country; a lawyer can tell you which rules apply. In the EU, Article 6 of Directive (EU) 2024/1385 requires Member States to criminalize repeated or continuous surveillance of a person by means of ICT, without consent, where it is likely to cause serious harm; transposition is due by June 14, 2027.
What evidence do you need to prove stalking?
To prove cyberstalking, you need the pattern: each incident with its date and time, profile URL, full content in context and effect on you. TrueScreen certifies each incident separately, with a qualified electronic seal and qualified timestamp a third party can verify.
What can police do about cyberstalking?
Under Meta’s law enforcement guidelines, authorities can send a preservation request, and Meta says it will take steps to preserve account records in connection with official criminal investigations for 90 days pending formal legal process. What police can do beyond that depends on where you are. Certifying each incident while it is visible gives you your own record, whatever the platform keeps.
How do you deal with harassment on Facebook?
If you are not in danger and it is safe to do so, certify the content before you report or block, because a report may lead to removal. If the situation feels unsafe, safety comes first: block, report and ask for help, then certify whatever is still visible. In the EU, Article 16 of the Digital Services Act requires hosting providers to offer easy-to-access notice mechanisms; a notice should give a reasoned explanation and the exact URL.
Sources and verification
Every figure and principle cited here links to its source, listed with type and date. Links checked on the publication date.
| Source | Type | Date | What it supports |
|---|---|---|---|
| Directive (EU) 2024/1385, Art. 6 | Law | 2024 | Conduct Member States must criminalize as cyber stalking, and transposition deadline (June 14, 2027) |
| Budapest Convention on Cybercrime (ETS 185), Art. 16 | Law | 2001 | Expedited preservation of stored computer data |
| Regulation (EU) 910/2014 (eIDAS), Art. 35(2) | Law | 2014 | Presumption of integrity and correct origin for a qualified electronic seal |
| Regulation (EU) 910/2014 (eIDAS), Art. 41(2) | Law | 2014 | Presumption of accuracy of date and time for a qualified timestamp |
| Regulation (EU) 2022/2065 (Digital Services Act), Art. 16 | Law | 2022 | Notice mechanisms for illegal content, with reasoned explanation and exact URL |
| FBI IC3, Internet Crime Report 2025 | Survey | 2025 | Harassment and stalking complaints received in 2025 |
| Bureau of Justice Statistics, Stalking Victimization, 2019 | Survey | 02/2022 | Stalking victims aged 16+ and share who reported to police |
| Meta, Information for law enforcement authorities | Document | consulted 27/10/2026 | Data preservation for 90 days and no retention without a preservation request before deletion |
Certify each incident while it is still on screen
TrueScreen acquires Facebook messages, posts and profiles at the source and closes each certification with a qualified electronic seal and qualified timestamp, recognized internationally, so every incident in your timeline carries its own verifiable date and time.
TrueScreen editorial team
This section is edited by the TrueScreen editorial team, which brings together expertise in digital forensics, the law of digital evidence and regulatory compliance. Every article is checked against primary sources: legislation, published rulings, technical standards and official documentation, always cited in the text.
