Social Media and Criminal Defamation: Why Courts Treat a WhatsApp Message Differently From an Open Facebook Post

A WhatsApp group message does not trigger Italy's aggravated defamation penalty the way an open Facebook post does. That is the article's central, and most citable, claim. Layered on top of these national frameworks, the Digital Services Act (Regulation (EU) 2022/2065) regulates the process platforms follow once notified of illegal content, without creating a new EU crime or redefining what counts as criminally defamatory under national law.

Platform liability is a separate question, one the European Court of Human Rights (ECtHR) has answered not with a single rule but with a fact-sensitive gradient across three landmark judgments: strict for a commercial news portal that allowed hate speech to sit uncontested, lighter for a portal hosting merely offensive commentary, and an intermediate but real duty for an individual who controls a public page or wall.

Imprisonment has not disappeared from the picture, either. Italy's Corte Costituzionale struck down mandatory prison sentences for press-based defamation in sentenza n. 150/2021, but custodial sentences survive as a discretionary option for cases of exceptional gravity. France and Germany retain custodial maximums on the books even where fines remain the practical norm.

Italy's Article 595 and the Aggravating "Mezzo di Pubblicità"

Article 595 of the Codice Penale punishes anyone who, communicating with more than one person, offends another person's reputation. The base offense, set out in comma 1, carries a sentence of up to one year's imprisonment or a fine of up to EUR 1,032. Comma 3 supplies the aggravated form: when the offense is committed "through the press or any other means of publicity" (mezzo di pubblicità), the penalty rises to six months to three years' imprisonment or a fine of no less than EUR 516.

Italian courts settled the social media question early, largely against the defendant's interest. Publishing a defamatory statement on an open Facebook page or a public profile satisfies the mezzo di pubblicità aggravation, on the same reasoning historically applied to newspapers and broadcast media: the content is potentially capable of reaching an indeterminate or at least quantitatively appreciable number of people, regardless of how many actually saw it. The test looks at capacity for reach, not confirmed reach.

Two defenses remain available against a comma 3 charge, both requiring more than a bare factual claim. Diritto di cronaca, the right to report, requires the underlying fact be objectively true. Diritto di critica, the right of criticism, requires only that the fact be reasonably believed true, since criticism is opinion, not factual reporting. Both defenses additionally demand continenza, a proportionate and non-gratuitously offensive form of expression, and genuine public interest in the information conveyed. A true fact reported in an intemperate, gratuitously insulting register can still fail continenza even where the underlying content is accurate. These four elements, truth or reasoned belief, continenza, and public interest, underpin every subsequent Italian ruling on point.

The WhatsApp Exception: Cassazione n. 42783/2024 and "Diffusione Ristretta"

The Corte di Cassazione's First Criminal Section (Sez. I Penale), in sentenza n. 42783/2024 (deposited 21 November 2024), held that a defamatory message sent in a WhatsApp group chat does not trigger Article 595's aggravated penalty. The Court's reasoning: the message stays confined to an identifiable, determinate group and retains a connotation of confidentiality. The number of participants in the group is irrelevant to the analysis. What matters is the medium's "conformazione tecnica" (technical configuration): whether the platform is engineered to keep the exchange private, not how many people the message happens to reach.

This is a functional test, not a headcount test. A 200-member WhatsApp group is not automatically "public" simply because many people belong to it; what matters is whether the medium's architecture preserves the exchange's private character. Conversely, a Facebook profile with only a handful of followers can still satisfy the aggravation if the platform's technical design leaves the content open to indeterminate reach. The Cassazione is moving away from treating "the internet" as a single medium and toward examining each platform's own architecture.

Four further decisions round out the doctrine, each addressed here briefly rather than in full treatment:

• Cassazione n. 38135/2024 annulled a defamation conviction, requiring lower courts to conduct a deeper contextual analysis before applying the mezzo di pubblicità aggravation rather than assuming it from the medium alone.
• Cassazione n. 7358/2024 held that authorship of an anonymous or pseudonymous post can be established through circumstantial evidence, profile identity and apparent motive, without a technical IP-address forensic trace, addressing the common defense that no account was ever technically linked to the defendant.
• Cassazione n. 29458/2025 extended the platform-specific analysis to TikTok content.
• Cassazione n. 20392/2025 addressed whether provocation by the victim, replying to a post after some delay, could operate as a mitigating factor in a Facebook defamation case.

When authorship is disputed, victims and prosecutors turn to platform data disclosure, whether through a national criminal complaint or, from August 2026, the EU's European Production Order. the article on digital evidence standards covers the full evidence-gathering and admissibility mechanics.

The Cassazione's WhatsApp holding should not be read as a categorical rule that private messaging apps are always safe from aggravated liability: the exemption turns on the medium's technical configuration, not the app's identity or its marketing as "private." A public WhatsApp channel with unrestricted joining, for instance, would raise a different analysis entirely from the closed group chat at issue in sentenza n. 42783/2024.

France's Parallel Rule: The "Cercle Restreint" Test and a Three-Month Trap

France regulates defamation through a specialized statute rather than the ordinary penal code. The loi du 29 juillet 1881 sur la liberté de la presse defines diffamation, in article 29, as any allegation or imputation of a fact that damages a person's or body's honor or reputation. The target need only be identifiable through context; naming is not required.

The loi du 21 juin 2004 pour la confiance dans l'économie numérique, known as the LCEN, extended the 1881 law's offenses under articles 23, 29, and 32 to "all means of electronic communication." As a result, a social media account holder, blogger, or forum poster becomes a potential "publisher" for the purposes of French press law.

French courts apply a "cercle restreint" test that asks whether a Facebook or X post is public for aggravation purposes. The inquiry is case-by-case: how many friends or followers had access to the post, and does that group exceed a genuinely restricted circle. This is the functional French parallel to Italy's diffusione ristretta doctrine, reached under a different statute, the 1881 law's public/non-public distinction rather than Article 595's aggravating-circumstance analysis, but asking substantially the same question about reach and confidentiality.

The stakes of that classification are concrete. Public defamation of a private individual, committed through article-23-scope media including electronic communication, carries a fine of up to EUR 12,000. Non-public defamation, by contrast, draws only a nominal fine, around EUR 38.

Two structural features set the French regime apart from Italy's and Germany's. First, Article 65 of the 1881 law sets a prescription period of three months from the date of first publication, rather than from each day the content stays accessible online, for both criminal and civil actions. The Conseil constitutionnel, in décision n° 2026-1204/1205 QPC of 12 June 2026, struck down the prior route that had allowed this three-month clock to reopen in cases tied to a later criminal decision, meaning claimants must now act within the ordinary three-month window without hope of a later reopening.

Second, the principe de non-cumul bars a claimant from pleading ordinary civil tort, article 1240 of the Code civil, to avoid the 1881 law's short limitation period and strict formalities. The sole recognized exception is dénigrement, commercial denigration of a product or service rather than a person.

Is France's cercle restreint test the same thing as Italy's WhatsApp rule? Functionally parallel, legally distinct. Both jurisdictions ask whether a communication reached a restricted, identifiable group rather than an indeterminate public, and both reach broadly similar outcomes on similar facts, but each does so under its own statutory framework and its own accumulated case law, not through any shared or harmonized EU test.

Germany's Mens Rea Ladder: From Opinion to Knowing Falsehood

German law protects honor through three graduated offenses in the Strafgesetzbuch, and the structure is worth understanding on its own terms before comparing it to Italy and France.

• Section 185, Beleidigung (insult) covers value judgments and opinions rather than factual claims. It is punishable by up to one year's imprisonment or a fine, rising to two years if committed publicly or "durch Verbreiten eines Inhalts" (by disseminating content), a phrase already anticipating non-print dissemination.
• Section 186, Üble Nachrede (slander) covers a dishonorable factual assertion that is not provably true, communicated to a third party, and carries up to one year's imprisonment or a fine.
• Section 187, Verleumdung (defamation in the strict sense) covers a factual assertion the speaker knows to be false, "wider besseres Wissen" (against their better knowledge), the highest culpability tier. It is punishable by a fine or up to five years' imprisonment, with steeper sanctions where the falsehood is spread publicly and at scale, squarely covering viral social media dissemination.

Germany's contribution to this comparative picture is structural rather than reach-based. Rather than a single aggravation turning on whether a medium counts as public or restricted, German law builds a graduated ladder running from opinion, through unproven factual claim, to knowingly false claim, with the penalty escalating at each rung.

Germany's regulatory layer is also undergoing its own transition. The Netzwerkdurchsetzungsgesetz, or NetzDG, passed in 2017, required social networks to remove manifestly illegal content within 24 hours of a complaint. NetzDG is being phased out by the Digitale-Dienste-Gesetz (DDG), in force since 14 May 2024, which transposes the EU Digital Services Act into German law and is explicitly designed to replace NetzDG.

Three Strasbourg Judgments, Three Different Duties: Delfi, MTE, and Sanchez

Delfi AS v. Estonia, decided by the Grand Chamber in 2015, held a large commercial news portal liable for offensive and threatening reader comments beneath a January 2006 article. Estonian courts imposed liability despite Delfi's notice-and-takedown system, and the Grand Chamber found no violation of Article 10 of the European Convention on Human Rights (ECHR): a professional, for-profit portal soliciting comments while permitting anonymous posting, backed only by reactive moderation, could be held responsible for failing to prevent clearly unlawful, hate-speech-adjacent comments, given the scale of potential harm.

Magyar Tartalomszolgáltatók Egyesülete and Index.hu v. Hungary, known as MTE v. Hungary and decided in 2016, reached the opposite result on different facts. Imposing strict liability on a self-regulatory media association and a news portal for reader comments that were vulgar and offensive, but did not amount to hate speech or incitement, violated Article 10. The Court distinguished Delfi directly on this basis: a notice-and-takedown system, not strict liability, is the appropriate standard for offensive-but-lawful-adjacent speech.

Sanchez v. France, decided by the Grand Chamber in 2023, moved the analysis from platforms to individual account holders. Julien Sanchez, a parliamentary candidate, was held criminally liable for failing to promptly delete hateful third-party comments posted on the public wall of his own Facebook account. The Grand Chamber found no violation of Article 10, holding that Sanchez's duty to monitor and remove unlawful comments from a space he controlled was heightened, not diminished, by his status as a candidate for office.

Read together, the three judgments describe a liability gradient rather than a single bright-line rule: strictest for a commercial platform that hosts unlawful hate speech at scale, lighter for a platform hosting merely offensive but lawful commentary, and an intermediate but real personal duty for an individual who curates a public page, group, or wall once aware of unlawful content there.

What the Digital Services Act Regulates, and What It Leaves to National Law

The Digital Services Act, Regulation (EU) 2022/2065, does not create or harmonize any defamation offense. What speech is criminally defamatory remains entirely a matter of national law, Italy's Article 595, France's 1881 press law, Germany's StGB, whichever statute applies. What the DSA harmonizes is the process platforms must follow once notified that content is illegal, a layer sitting on top of national defamation law, not a replacement for it.

Two mechanisms carry most of the DSA's weight for this purpose:

• Article 6 sets a conditional liability exemption, carried forward from the 2000 E-Commerce Directive: a hosting provider is not liable for user-uploaded content unless it has actual knowledge of illegality, or awareness of facts making illegality apparent, and fails to act expeditiously once aware.
• Article 16 establishes a notice-and-action mechanism, requiring platforms to provide a channel for flagging specific illegal content, triggering the actual-knowledge threshold under Article 6.

One further point deserves an explicit hedge rather than a confident assertion. Whether the DSA's framework gives a defamation victim a practical route to unmask an anonymous poster remains an open question that the Regulation itself does not resolve. Identity disclosure still runs through national procedural law, a national criminal complaint or civil discovery process, rather than through any DSA-created mechanism built for that specific purpose. This is a scholarly observation about the Regulation's apparent scope, not a settled legal conclusion, and readers relying on it for a specific case should confirm the point against current national procedure.

From Mandatory Prison to Discretionary Sanction: Italy's 2021 Constitutional Ruling

The Corte Costituzionale, in sentenza n. 150/2021 of 12 July 2021, declared unconstitutional the mandatory prison sentence for press-based defamation, striking down Article 13 of Legge n. 47/1948 and the parallel radio-television provision in Article 30(4) of Legge n. 223/1990. The Court's reasoning centered on the chilling effect a compulsory custodial threat produces on journalists' watchdog function. Imprisonment survives only as a discretionary option, reserved for defamation of exceptional gravity, a limitation the Court read into Article 595, comma 3 as well.

This ruling sits within a longer institutional push. The Parliamentary Assembly of the Council of Europe, in Resolution 1577 and the companion Recommendation 1814, both from 2007, called for decriminalization of defamation, targeting custodial sentences as disproportionate while accepting fines and civil remedies in principle. Italy's 2021 ruling is the clearest example here of a national court implementing that guidance directly.

None of this means imprisonment has disappeared: Italy preserved discretionary custody for the most serious cases, while France and Germany retain custodial maximums even though fines remain the practical norm for ordinary online defamation cases.

Frequently Asked Questions About Social Media and Criminal Defamation

Does posting something defamatory on Facebook always count as "public" for Italian criminal defamation purposes?

Not automatically anymore. The governing test looks at a medium's technical configuration rather than its potential audience size. An open Facebook page or public profile still satisfies the aggravation Article 595 attaches to publicity, but a WhatsApp group message, regardless of group size, does not, because the platform's design keeps the exchange confidential.

Can someone in Italy, France, or Germany still go to prison for defaming another person on social media?

Not automatically, but yes in principle. Italy's constitutional court removed the mandatory prison sentence for press-based defamation, preserving custody only for cases of exceptional gravity. France and Germany have not gone that far: both retain custodial maximums for their respective offenses, though fines are the practical norm.

Does the Digital Services Act create a new EU crime for online defamation?

No. The Regulation governs the process platforms follow once notified content may be illegal, and sets the conditions for keeping a hosting provider's liability exemption. Whether a statement is criminally defamatory in the first place stays a matter of national law, decided under Italy's Article 595, France's 1881 press law, or Germany's StGB, not under anything the DSA itself defines.

Are social media platforms automatically liable for defamatory comments users post?

No single rule covers every case. The ECtHR liability standard shifts with the speech and the host: a large commercial portal that let unlawful hate speech sit uncontested faces the strictest duty, a portal hosting merely offensive but lawful commentary faces a lighter notice-based standard, and an individual who controls a page or wall and fails to remove unlawful comments can face personal liability too.

Can an Italian court convict someone of online defamation without a technical IP-address trace?

Yes. Italian courts have accepted circumstantial evidence, the profile's apparent identity and motive among the relevant factors, as sufficient to establish authorship of an anonymous or pseudonymous post, answering the frequent defense claim that the account was never technically linked to the accused.

Is France's "cercle restreint" test the same as Italy's WhatsApp rule?

Similar in function, separate in law. Both ask whether a communication reached a limited, identifiable group rather than an indeterminate public, often reaching comparable outcomes. France reaches that question through the 1881 press law's public/non-public distinction; Italy reaches it through Article 595's aggravating-circumstance analysis. Neither statute borrows from the other.

What the Public-Private Line Means Going Forward

The same question, does a communication reach an indeterminate public or stay within a determinate circle, now structures aggravated-liability analysis in both Italy and France. Each system arrived there under its own statute, Article 595's mezzo di pubblicità aggravation in one case, the 1881 press law's cercle restreint doctrine in the other, converging on a similar functional test rather than an identical one. That independent convergence, reached without any shared EU standard, matters more than the surface similarity between the two doctrines.

The practical stakes are not abstract. The same WhatsApp-style group message that escapes aggravated liability in Italy could plausibly fail France's cercle restreint test if the group is large, loosely controlled, or open to new members without real vetting. The same conduct is not automatically treated alike, even between two neighboring civil-law systems with broadly parallel doctrines.

This article set out the public/private line for online defamation across three national systems and the ECtHR's platform-liability doctrine layered above them. the article on EU cybercrime legislation covers the adjacent statutory architecture and cross-border cooperation regime. the article on digital evidence standards addresses how courts handle the evidence once a case built on one of these doctrines actually reaches trial. a future piece, on artificial intelligence and criminal accountability, will take up the adjacent and distinct question of synthetic and AI-generated content.