WhatsApp stalking evidence: digital proof after Italian Supreme Court ruling 6024/2026
Italian Supreme Court ruling 6024/2026 (Criminal Section V, filed in February 2026) clarified how WhatsApp screenshots enter criminal proceedings for persecutory acts under art. 612-bis of the Italian Criminal Code: when the victim hands them over, they are documents under art. 234 of the Code of Criminal Procedure and are acquired without a seizure of correspondence and without examining the phone, as long as nothing casts doubt on her credibility. The Court rejected the defence's argument that a technical examination of the original device was needed. For lawyers handling WhatsApp stalking evidence, one front remains open: if credibility is challenged, the weight of the chat depends on how verifiable its origin and integrity are.
When the chat is central, the operational answer is to acquire it in a verifiable way, with a SHA-256 hash and an eIDAS qualified timestamp applied at capture time. TrueScreen integrates the qualified seal of a third-party trust service provider and produces files that anyone can verify, without handing over the device.
This insight is part of the guide Screenshots as Criminal Evidence: Italian Supreme Court Ruling and Forensic Acquisition.
What Cassation 6024/2026 changes for WhatsApp screenshots in stalking cases
The ruling confirms that a WhatsApp chat screenshot handed over by the complainant is usable without a seizure. The real issue becomes credibility: the Court found the screenshots sufficient because nothing called it into question. If the defence brings specific elements, such as missing messages or inconsistent dates, the origin and integrity of the capture become decisive again.
The screenshot as a document under art. 234 c.p.p.
Article 234 of the Italian Code of Criminal Procedure allows the acquisition of documents that represent facts, people or things by photography or any other means, and the Court places screenshots in this category. In criminal proceedings the judge assesses evidence freely (art. 192 c.p.p.), and the civil-law disavowal of electronic reproductions (art. 2712 of the Civil Code) does not have the same effect. Ruling 6024/2026 held that not acquiring the phone does not make screenshots handed over by the complainant unusable.
Civil ruling 1254/2025 and criminal proceedings: what differs
Several criminal lawyers cite civil ruling Cass. civ. 1254/2025, which recognised WhatsApp screenshots as documentary evidence in civil proceedings. The two settings work differently: in civil cases the chat is full proof unless the other party disavows its conformity with the facts (art. 2712 of the Civil Code); in criminal cases on art 612-bis stalking digital proof the judge assesses it freely together with the other evidence (art. 192 c.p.p.). Ruling 6024/2026 concerns criminal proceedings.
The three weaknesses of WhatsApp screenshots in persecution cases
Filing digital evidence criminal proceedings 2026 without forensic certification exposes the victim to three concrete risks. Each can flip the outcome of the case and must be addressed before submission.
Defence challenges when the original device is unavailable
The defence often objects that the victim's smartphone is not available at the hearing. Ruling 6024/2026 held that acquiring the phone is not necessary when the complainant hands over the screenshots and nothing casts doubt on her credibility. If the defence brings specific evidence of manipulation, the Digital Provenance of the capture can help answer it without necessarily requiring an expert examination of the device.
Missing chain of custody and forensic expert objections
When the judge appoints a forensic expert, the first question is always the same: "who captured the screenshot, when, and on which device?". A broken or incomplete chain of custody opens a wide flank for the defence: the expert may conclude that the file cannot be reliably attributed to the victim, and the probative value collapses. According to ENISA guidelines on electronic evidence (Electronic Evidence: a basic guide for First Responders), the chain of custody must be documented from the moment zero of the capture.
Stripped metadata and slow acquisition timelines
A manual screenshot loses almost all the EXIF metadata useful to the judge: coordinates, time zone, device model, app version. When the prosecutor requests a forensic extraction, the appointed expert's timeline can stretch the proceedings by months, leaving the victim exposed. Eurostat data on persecution offences in Europe (Crime statistics, Eurostat) show that the average duration of criminal proceedings in Italy exceeds 3 years at first instance, and a robust evidentiary chain at capture time shortens forensic expert turnaround.
How TrueScreen certifies WhatsApp stalking chats with legal value
TrueScreen is not a basic screen capture utility: it is the Data Authenticity Platform that captures the WhatsApp chat and applies a SHA-256 cryptographic hash and an eIDAS timestamp issued by a third-party qualified trust service provider at the same instant. The output is a sealed evidence package that the other party, the court and a technical expert can verify.
Three complementary solutions cover the acquisition, depending on the device at hand. The main solution on desktop is the TrueScreen Forensic Browser, an application for macOS and Windows that acquires WhatsApp Web while recording the entire browsing session in a controlled forensic environment. The Web Notarization extension for Chrome and Edge lets you quickly certify any content during normal browsing, while the TrueScreen app for iOS and Android certifies the conversation directly from the smartphone. All of them feed the same certification workflow, with SHA-256 hashing, qualified timestamping and electronic seal.
Forensic acquisition via App and browser Extension
The lawyer assisting the victim can choose two complementary tools. The TrueScreen App for smartphones captures the WhatsApp conversation directly from the victim's device, preserving metadata and context. The browser Extension handles WhatsApp Web capture when the victim has already turned the smartphone over to law enforcement. Both tools produce the same evidentiary package: capture video, hash, timestamp and system log.
SHA-256 hash and eIDAS timestamp: the evidence block
The value of the certification comes from three combined elements: the SHA-256 hash proves file integrity, the eIDAS timestamp attests the exact moment of capture, and the qualified seal of a third-party trust service provider links the package to a qualified subject. The forensic methodology applied by TrueScreen is not a seal added afterwards on a pre-existing file: it is contextual acquisition and certification, and it keeps the chat verifiable without handing over the device. For the technical detail, see the guide Screenshots as criminal evidence and Italian Supreme Court ruling.
FAQ: WhatsApp stalking and digital evidence after Cassation 6024/2026
Is a WhatsApp screenshot valid as evidence in criminal stalking proceedings?
How do you certify a WhatsApp chat for judicial use?
What changes with Italian Supreme Court ruling 6024/2026?
What are the risks of filing uncertified screenshots in a preliminary hearing?
TrueScreen editorial team
Published on · Updated on
This section is edited by the TrueScreen editorial team, which brings together expertise in digital forensics, the law of digital evidence and regulatory compliance. Every article is checked against primary sources: legislation, published rulings, technical standards and official documentation, always cited in the text.
