Does “online” or “active now” prove that the user was present?¶

No. An online indicator usually reflects recent contact between the service and an account or session, not verified attention by the named account holder.

Services infer activity from technical events¶

A phone, tablet, desktop client or browser may keep a session connected while an application runs in the background. Synchronisation, notifications and other automated contact can maintain or update status. A linked endpoint can also be active while the primary phone and its owner are elsewhere.

The displayed indicator may be delayed, rounded or filtered by privacy settings. Its precise trigger and expiry depend on the platform and can change over time. Preserve the wording rather than translating “active now” into a specific undocumented action.

Use status as one timeline observation¶

Record the account's stable identifier, platform, displayed status, exact observation time and time basis, source screen and any known linked sessions. A witness recollection that an account “was online” is less precise than a contemporaneous capture with context.

Compare the observation with messages, login and session events, device possession and other account activity. Even then, it does not prove that a person read a particular message. Last-seen values carry similar service-specific limits.