Sending a threatening message, waiting for the victim to read it, and deleting it immediately does not guarantee that the evidence will disappear. The Attorney General's Office has drawn attention to an increasingly common practice in cases of digital violence and warns that the very trace left by messaging applications may end up having value in a criminal proceeding.
The warning appears in the annual report of the Public Prosecutor's Office, which notes the proliferation of the use of WhatsApp, social networks, and other digital tools to commit crimes related to gender violence, especially among young people and adolescents. The Prosecutor's Office also expresses concern about the incorporation of artificial intelligence into these behaviors.
One of the detected behaviors consists of the investigated deleting a message immediately after confirming that it has been read, with the intention of making it difficult for the victim to present it later to the Police or the court.
But deleting the content does not always eliminate all evidence.
The “deleted message” can also have value
The Prosecutor's Office emphasizes that during the last few years, a significant advancement has been consolidated from an evidentiary point of view.
Although the original content may have disappeared, applications like WhatsApp can continue to show in the conversation that a message existed and was subsequently deleted. That trace can be used as an indication that corroborates the victim's account.
The Prosecutor's Office of Lleida had already specifically pointed out this phenomenon: more and more situations were detected in which the accused sent a message, waited for the victim to read it, and then deleted it.
According to the Public Prosecutor's Office, the indication of “deleted message” has allowed reinforcing the victim's version of what happened and, in certain cases, has been sufficient along with the rest of the evidence to substantiate a violation of a communication prohibition.
This can be especially relevant when there is a court order that prevents an ex-partner from contacting the victim.
Deleting the message does not alone demonstrate what it said
However, there is a fundamental nuance.
The appearance of a message as deleted does not automatically reveal its content. It also does not demonstrate by itself who sent it or that a crime has been committed.
Its importance depends on the set of existing evidence: the victim's statement, other previous or subsequent messages, witnesses, calls, device data, account identification, or any other element that allows reconstructing what happened.
The Supreme Court has been insisting for years that conversations from messaging applications must be analyzed with caution, due to the possibility of manipulating files, creating false profiles, or altering screenshots. When their authenticity is questioned, it may be necessary to provide additional elements that allow verifying it.
What happens if there was a restraining order
One of the clearest examples appears in cases of breach of sentence or precautionary measures.
A court order can prohibit not only physically approaching a person but also communicating with them.
This potentially includes WhatsApp messages, SMS, emails, or contacts through social networks when the court prohibition includes communication. Article 468 of the Penal Code punishes the breach of certain penalties and precautionary measures.
Therefore, if a person is prohibited from contacting their ex-partner and sends a message to delete it seconds later, the deletion does not necessarily prevent investigating that this contact existed.
The notice that remains in the application can become another piece of the procedure.
Screenshots: useful, but not infallible
The Prosecutor's Office also highlights the importance of screenshots as one of the tools used to document digital violence.
In investigations for threats, coercion, harassment, or prohibited communications, prosecutors frequently resort to screenshots accompanied by the presentation of the device itself before the court to verify the original content.
However, a screenshot does not automatically have absolute value.
The Supreme Court has warned that images of digital conversations can be manipulated. Therefore, if one of the parties denies that the conversation is authentic, the court may assess other elements to verify it.
Hence the importance of not limiting oneself solely to saving an isolated photograph of the screen when it is also possible to preserve the conversation, the phone, and other associated data.
The original mobile may be important
Another practical recommendation that arises from the experience of prosecutors and police is to keep, whenever possible, the device on which the communications were received.
The phone itself can allow checking numbers, accounts, dates, times, and the continuity of a conversation.
The Prosecutor's Office has warned that some investigations become complicated when, some time after filing the complaint, the victim no longer keeps the messages, has changed phones, or the device has broken. That is why it recommends that the material be verified as soon as possible during the investigation.
In certain investigations, moreover, a judge may authorize the obtaining of electronic data stored by service providers when they are necessary and provided to clarify the crime. The Criminal Procedure Law expressly regulates judicial access to data associated with electronic communications.
WhatsApp is not the only problem
Digital violence is not limited to messages sent through WhatsApp.
Prosecutors are detecting threats to disseminate intimate images, ongoing harassment, humiliations, impersonation of profiles, installation of spyware, persistent communications from different numbers, and contacts through Instagram, Facebook, or other platforms.
Some victims block their partner or ex-partner's phone and later begin to receive calls from unknown numbers or new accounts.
There are also specific difficulties when the aggressor uses fake profiles. In those cases, it may be necessary to request information from tech companies to determine who is behind an account.
Instagram, Meta, Google, or Telegram may have relevant data
The investigation of these crimes has an added difficulty: part of the necessary information is not physically located on the victim's phone, but on servers managed by tech companies.
The Prosecutor's Office explains that to verify in some cases who created an account or from where a communication was made, it is necessary to request data from companies like Meta, Google, or Telegram.
These requests can delay proceedings and sometimes do not provide sufficient results.
Spanish procedural legislation provides that, with judicial authorization when appropriate, certain electronic traffic data or data associated with communications stored by service providers may be incorporated into an investigation.
This again demonstrates that removing what appears on a screen does not necessarily equate to eliminating any technical trace of a communication.
AI opens a new avenue of digital violence
The most recent memory of the Prosecutor's Office also introduces an additional concern: the use of artificial intelligence in gender cyber violence among young people.
The Prosecutor's Office warns that generative tools allow for the creation or manipulation of images, audios, and videos with enormous ease and can be used to fabricate false sexual content, humiliate a victim, or disseminate seemingly real material.
The phenomenon expands a problem that was already growing with social networks and messaging applications.
According to the 2024 Macro-survey on Violence against Women cited by the Prosecutor's Office, 12.2% of women residing in Spain over the age of 16 report having suffered digital harassment at some point, while 9.4% have received inappropriate sexually explicit messages through digital means.
The Prosecutor's Office therefore considers “more urgent than ever” to improve the specialized training of prosecutors and strengthen educational prevention.
What to preserve in the face of digital threats or harassment
Judicial experience shows that the more sources that allow for reconstructing what happened, the easier it is to verify a complaint.
Captures can be relevant, but so can the complete conversation, the original phone, user identification, dates and times, emails, calls, messages from other platforms, or witnesses who have seen the communications.
Physically presenting the device also allows for the content to be verified and documented in the procedure, a practice highlighted by the Prosecutor's Office itself.
In situations of immediate risk, the priority must be to seek help and ensure the victim's safety. Preserving evidence should not involve maintaining dangerous contact with the aggressor or responding to communications.
Deleting no longer necessarily means disappearing
Digital violence poses a problem that did not exist with the same intensity just a few decades ago: a aggression can begin and end in seconds, but leave different traces on phones, applications, and servers.
The Prosecutor's Office is verifying that some investigated individuals are trying to take advantage of the functions that allow deleting messages to hinder reports. However, the notice that remains after deletion, combined with the victim's statement and the rest of the evidence, may still have judicial relevance.
The conclusion is not that every deleted message demonstrates a crime, but exactly the opposite of an increasingly widespread idea: pressing “delete for everyone” does not guarantee that the evidence of a communication's existence disappears.
And in crimes such as threats, harassment, or violation of a communication prohibition, that small digital trace can end up being an important piece to reconstruct what happened.