What does “last seen” prove?¶

“Last seen” records the platform's representation of recent account or session activity. It is not necessarily the exact moment a named person opened or stopped using the service.

The underlying trigger may vary¶

The value might update when an application opens, a session contacts the service, a message is sent or a linked endpoint synchronises. Platforms may round, delay or suppress it through privacy controls. Relative labels such as “recently” or “within a week” describe ranges rather than timestamps.

A desktop or tablet can update account status while the primary phone is elsewhere. Shared access or compromise further separates the service identity from a particular human user.

Preserve observation and meaning separately¶

Capture the exact displayed value, account and platform, observation time and time zone, source device and relevant linked-session information. If the platform definition is important, establish it for the applicable period and configuration.

Compare the value with account events, device artefacts, messages and possession evidence. Report that the platform displayed a last-active value and explain its supported time resolution. Do not use it alone to prove that someone saw a particular message, performed a specific action or occupied a location.