The trial of a 71-year-old man has gripped France and horrified the world after he admitted to repeatedly drugging his wife and, over the course of decades, soliciting dozens of men online to rape her while she was unconscious. Dominique Pelicot’s confessions as well as the public bravery of his wife Gisèle have forced a nationwide reckoning over sexual assault and the double lives people lead through the internet.

As a court in Avignon has heard Pelicot’s case and allegations against 50 other defendants over the last several weeks, a pattern has emerged of men who lived publicly upstanding lives while allegedly engaging in abhorrent acts online and in private. As the men accused of mass rape have taken the stand, they have detailed how Pelicot found them and coordinated his abuse on an illicit chat forum called Coco.

What has emerged during the trial is that the scale of Pelicot’s crimes and his ability to keep them concealed for so many years would seemingly not have been possible without Coco and its administrators’ disregard for the content being shared on the platform. The site has become one of the starkest examples in memory of how platforms can result in extreme harm when left unmoderated.

Since its founding in 2003, Coco has been implicated in killings, pedophilia, homophobic attacks and sexual assaults as it evaded accountability and led law enforcement on an international manhunt. When European authorities finally shut down Coco earlier this year and arrested its founder along with other executives, the website had been cited in more than 23,000 reports of criminal activity and more than 480 victims had been involved in judicial proceedings involving the site, according to French prosecutors.

A haven for online harm

Founded by the software engineer Isaac Steidl while he was in his early 20s, Coco launched as a free chat site with a simple interface allowing users to communicate anonymously. Although the site asked users to confirm that they were over 18, they could quickly change their age once they gained access to the platform and chat with an invented username.

“It looked so innocent. It was this very 90s design, with coconut trees and a smiley face and it said “this is a website for nice people,” said Sophie Antoine, an officer for legal advocacy at the French anti-child prostitution organization ACPE. “But you went in, and it was like a jungle.”

Users would encounter a public landing page once registered to the site, which featured a list of different chat forums dedicated to different subjects. The sexualized nature of the site meant that many of these forums were dedicated to specific fetishes or contained explicit content. People could also enter private chats on Coco and directly message other users, which one French journalist pretending to be a 15-year-old girl on the site found resulted in a flood of people soliciting them for sex and sending nude images.

“It was very accessible and very explicit – there was no control over it,” Antoine said.

Although it never gained mainstream popularity, the site became well known among child safety advocates and LGBTQ+ rights groups monitoring sites with the potential for online harm. ACPE had been involved with work on Coco for years, with Antoine training people on how to use the site for research purposes while alerting authorities to illicit and dangerous activity there.

In Pelicot’s case, he used an anonymous pseudonym on Coco and solicited men on a forum called “à son insu”, meaning “without her knowledge”, to come to his house in the small town of Mazan. Pelicot claimed on the forum that he and his wife shared a fetish for men having sex with her while she was asleep, not openly mentioning that he was drugging her against her will and that she had no knowledge or consent of his abuse. While many of the men claimed they believed they were engaging in a consensual sexual roleplay, investigators found that several times Pelicot also explicitly used the words “rape” and described drugging his wife to potential attackers.

Coco was unmoderated to the extent that Pelicot was able to use the forum for years without any penalty, and authorities ultimately only became aware of him after a grocery store security guard caught Pelicot attempting to take nonconsensual videos of women who were shopping in 2020. In the unlikely event that a user did get kicked off Coco due to complaints or legal threats, researchers and authorities say the site would charge a small fee of about €10 to reinstate banned accounts.

Despite the site becoming a well-known haven for online abuses, rights groups and authorities faced various legal hurdles in investigating and taking legal action against it. European Union regulations for years had broad provisions that prevented a website owner from being held legally liable for the content on their site, similar to Section 230 law in the US. Coco also moved where it was registered, complicating matters by moving – after Pelicot’s arrest in 2020 – from being a wholly French site to a domain registered to the self-governing island of Guernsey under a .gg URL.

Holding Steidl accountable for the site he created also faced another logistical hurdle – at some point after founding the site, he moved to Bulgaria, outside the immediate reach of French authorities, and renounced his French citizenship. Even as Coco was publicly implicated in a string of violence and sexual abuse, the site remained online, with Steidl nowhere to be found.

Killings, attacks and child abuse

While Pelicot was using Coco to perpetrate his attacks, a slew of other abuses were taking place in forums and chats throughout the site. For years, a number of high-profile crimes involving Coco received widespread news coverage in France and increased calls among rights groups to shut the platform down.

One of earliest cases was the 2018 killing of 55-year-old Michel Sollossi, who was killed by a 22-year-old man who had arranged to meet up with him on Coco. Sollossi was found beaten to death in his home in the Paris suburbs, with a trial finding that the killing was a homophobic attack. The perpetrator was sentenced to 20 years in prison.

A wave of similar “ambush attacks” on gay men who were lured to meet up with strangers on Coco followed. In 2022, a 24-year-old from Marseille alleged that he narrowly escaped an attack by three people who tried to run him over with their car when he arrived at a meetup arranged through Coco. Law enforcement officials arrested four people in the town of Saint-Polois earlier this year after they were accused of posing as men looking for hookups on the site then luring victims to meet them before violently attacking and robbing them.

While violent attacks ambushing gay men proliferated on the platform, the site was also used for child sexual abuse. A man from the north-western French city of Brest admitted in 2019 to exchanging videos of child rape using the same “without her knowledge” forum as Pelicot. In one of the most high-profile cases, the 77-year-old former French pop star Richard Dewitte was arrested after sexually soliciting an undercover officer whom he believed was a 13-year-old girl. A court sentenced Dewitte to three years in prison last year.

In yet another case, two teenage boys were arrested earlier this year and charged with the killing of a 22-year-old man in a suburb of Dunkirk. The two boys allegedly pretended to be a girl looking to meet up on Coco, before ambushing the man and beating him to death in a parking lot when he showed up.

The myriad of cases drew the attention of French LGBTQ+ rights groups such as SOS Homophobie and child protection organizations such as ACPE, which began calling for authorities to take more aggressive action against the site.

“We have been talking about it for years and asking for it to be closed,” Antoine said. “But it was complicated with all the different European laws.”

The end of Coco

Coco’s ability to evade authorities relied on a combination of legal protections for internet providers, the complicated logistics of international investigations and obscured origins. Sites seeking to avoid scrutiny use a variety of tools to mask exactly where they are operating, forcing law enforcement to peel back layers of obfuscations before finding the origins and owners of a site.

When authorities finally came for Coco, it involved an immense, 18-month international effort and a recent change in French law. In December 2023, France’s national anti-organized crime authority Junalco launched an investigation into Coco that utilized a 2023 law called “délit d’administration de plateforme”, which can hold administrators liable for certain activities on their sites. The law allows authorities to accuse site founders of complicity in crimes such as their sites or apps being used for illicit transactions that fund gangs. Violations carry penalties of up to 10 years in jail as well as fines up to €500,000.

Prosecutors used the same law to issue a preliminary charge against the billionaire Telegram CEO, Pavel Durov, following his arrest earlier this year. Durov’s arrest gained international attention and prompted a debate over the extent to which governments should hold platforms accountable for illegal content.

Along with Junalco, agencies from countries including Lithuania, Bulgaria, Hungary, Germany and the Netherlands coordinated an effort to bring Coco down in June of this year. International authorities shut down servers based in Germany, seized about €5.6m and froze several bank accounts related to the site. In Bulgaria, local authorities arrested and interviewed Steidl with French prosecutors present as observers. Three of Steidl’s associates including his wife were also detained for questioning in France and later released, according to national media and a Junalco press release.

French prosecutors have not issued statements on what the next steps in the criminal case involving Coco and Steidl may be, but the site remains offline. LGBTQ+ rights groups and anti-child abuse organizations have celebrated the closure while warning that similar sites may fill the vacuum.

The Pelicot trial is meanwhile still ongoing as French society grapples with how such acts, committed by men from a variety of ages and backgrounds, could go undetected for so long. It’s a question that advocates against sexual abuse say involves the country reconsidering how these crimes happen, and who perpetrates them.

“We are trying to dismantle the idea that these criminals are monsters,” Antoine said. “The Mazan case showed with websites like Coco these people can be your neighbors – even in the smallest town people can connect online and commit these crimes.”

Kari Paul contributed reporting

• This article was amended on 20 November 2024 to clarify that Coco’s move to a Guernsey-registered URL ocurred after Dominique Pelicot’s arrest.