Defamation removal letter

By Yair Cohen, Solicitor specialising in internet law

Serving notice on website operators and US platforms to take defamation down

A defamation removal letter to a website operator or platform is a formal notice asking the host of a defamatory publication, rather than the person who posted it, to take the content down. It is the right tool where the poster is anonymous and you cannot identify them, where the platform has notice-and-takedown obligations under UK law, or where the platform is US-based and only its own internal process is workable. For letters to identified individuals, where the recipient is the defamer rather than the host, see our cease and desist letter guide. Where you already intend to issue proceedings and need to comply with the Civil Procedure Rules, see our letter before legal action guide.

When a removal letter to a platform is the right move

A removal letter to a platform is the right move in three situations. First, where the post is anonymous and the platform is the only fixed point you have. Second, where the platform is a UK-facing website operator and section 5 of the Defamation Act 2013 puts it on notice with consequences if it fails to act. Third, where the platform is US-based and you need to engage its in-house takedown process on terms the platform recognises.

Identifying the poster does not take the platform route off the table. Sometimes the platform will remove the content faster than a letter to the named individual ever could. Sometimes the victim has good reasons not to write to the poster directly, including a real risk of retaliation, an ongoing harassment campaign, or a defamer whose mental state means a personal letter is likely to escalate the matter rather than resolve it. Parallel notice on the platform also strengthens any subsequent action against the poster: the platform's own response becomes part of the evidence. The platform route is the wrong tool only where the publication is true and you can prove it, where the issue is privacy or harassment and what you actually need is a right to be forgotten application to Google or an online harassment response, or where the cause of action is something other than defamation altogether. We tell clients early, before we draft anything, when defamation is the wrong route and we point them at the right one.

Anonymous defamation: identifying the poster before you write to anyone

Anonymous defamation is the most common single problem we deal with at the Internet Law Centre. The person attacking your reputation may be behind a numbered Twitter handle, a Reddit pseudonym, a fake Google or Trustpilot review profile, a sockpuppet on an investor forum, a throwaway Telegram or Discord account, or a Gmail address that gives nothing away. Before you write to the platform, there is a question worth answering: can the poster be identified, and on what terms.

OSINT: identifying the poster from the traces left online

Open-source intelligence work, OSINT for short, is the evidence-driven route. It is the work of taking the small traces an anonymous defamer leaves behind on and off the platform and turning them into a real name, a real address and, very often, a real employer. We do this work in-house at the Internet Law Centre and it is one of the things that distinguishes us from defamation firms that have to outsource the investigative side.

Those traces are usually more visible than the defamer realises. Writing style and idiom repeat across handles. Posting times cluster around the same working day. Profile pictures carry image metadata or appear in reverse-image search results that link back to a personal LinkedIn or Facebook page. Handles get reused across forums, and one careless reuse can connect an anonymous Twitter account to a public Companies House filing. Old archived versions of forum bios, registration leaks and breached database records often add the final piece. None of this requires a court order.

When OSINT succeeds, and in our experience it succeeds in the substantial majority of internet defamation cases we take on, the removal letter goes to a named individual at their home or business address. That changes everything. The recipient is no longer an anonymous handle that can be deleted; they are a person whose family, employer and professional regulator can be put on notice if the matter escalates. Compliance is faster and platform-only takedown is no longer the only option.

Norwich Pharmacal Order: the court route with real limits

A Norwich Pharmacal Order is a court order requiring a third party who is mixed up in the wrongdoing, typically the platform that hosts the post or the email provider behind a sender address, to disclose what it knows about the publisher. We act on these every week and have a dedicated disclosure orders service, including a low cost Norwich Pharmacal Order service for the more straightforward applications.

There are real limits on this route. The court will only grant the order where the application is necessary, proportionate, supported by evidence of a viable underlying cause of action, and likely to identify the wrongdoer. There is also a substantive threshold inherited from the foundational Norwich Pharmacal jurisprudence: the third party must be sufficiently "mixed up" in the wrongdoing for the court to require it to disclose. That threshold is doing real work in cases involving Google. The leading recent example is Davidoff & Ors v Google LLC [2023] EWHC 1958 (KB), a decision of Nicklin J in the Media and Communications List. The claimants, a North London estate agency and its directors, had already obtained one Norwich Pharmacal order against Trustpilot, which had disclosed that each of the anonymous posting accounts behind a series of one-star reviews had been registered to a Gmail address. They then applied for a second order, this time against Google, to identify the people behind those Gmail accounts. The judge refused the second application. Google was not "mixed up in the wrongdoing": the wrong relied on was the publication of the reviews on Trustpilot, and Gmail had simply been the email address provider used at the signup stage. The judgment draws the analogy of a garage that sells a car to a driver who later causes a collision: the sale facilitates the driving in a loose sense, but the garage is not mixed up in the collision. The decision is a useful reminder that the further away the third party sits from the actual act of publication, the harder the "mixed up" threshold becomes – and that a second-tier NPO against Google after a first NPO against the host platform is not a formality.

There is a parallel structural problem against US-based platforms. The English court's jurisdiction reaches Google UK Limited, which typically replies that it does not hold the disclosable data. The entity that does hold the data, Google LLC, sits in California and is generally outside the reach of the English NPO. Enforcement through the US courts under the Stored Communications Act is technically available but expensive and slow. In many cases the platform genuinely holds no identifying data beyond an IP address that resolves to a VPN or a coffee shop. The cost runs into five figures, and that money is at risk whether or not the order produces a name. The timeline is typically four to twelve weeks. We routinely run OSINT first and reserve Norwich Pharmacal for the cases where OSINT has run its course and the "mixed up" threshold is properly arguable.

The UK legal framework: section 5 Defamation Act 2013 and the Operators of Websites Regulations 2013

Section 5 of the Defamation Act 2013 gives a UK website operator a defence to a defamation claim where the operator did not post the statement. That defence is conditional. It falls away once the operator has been put on notice, in a form that complies with regulation 2 of the Defamation (Operators of Websites) Regulations 2013, and fails to act within the time limits the Regulations set. In other words, a properly drafted notice converts the operator's safe harbour from a shield it can hide behind into a clock that is now running against it.

To engage section 5, the notice must specify the complainant, the statement complained of with sufficient particularity for the operator to identify it, the meaning attributed to it, the basis for the defamation claim, and confirmation of whether the complainant has the means to contact the poster. The Regulations then require the operator to act within 48 hours of receipt: contact the poster, give the poster five days to respond, and either remove the statement or rely on the poster's response. Where the operator does not follow that procedure, its section 5 defence is lost and the operator itself becomes exposed.

The same architecture sits behind the Electronic Commerce (EC Directive) Regulations 2002. Regulation 19 gives a hosting provider a defence where it does not have actual knowledge of unlawful information. Actual knowledge is what your notice supplies. Once knowledge is on record, the hosting defence depends on prompt action.

The practical effect is that a UK operator who receives a section 5 compliant notice has a decision to make in days, not weeks. The cost of inaction is no longer reputational; it is legal exposure as a publisher in its own right.

The US platform framework: why UK orders bite less than UK clients expect

UK clients often arrive expecting that a sternly worded letter under English law will produce the same response from a Californian platform as it would from a London-based forum. It does not. US platforms operate under Section 230 of the Communications Decency Act, which gives them broad immunity from liability for user-generated content, and they will not generally treat a UK section 5 notice as triggering an obligation to remove material from their servers in California.

This is not a reason to leave US-hosted defamation in place. It is a reason to write a different letter. A notice to a US platform's legal team that is properly drafted, served to the right contact, set out in the idiom the platform expects and supported by the right factual matrix usually does produce removal. The notice has to do four things: identify the precise URLs and the words complained of; set out the defamatory imputations clearly; explain why the content breaches the platform's own community standards or terms of service (which is the lever the platform's legal team actually pulls); and engage any local-jurisdiction process the platform has, including notices for English residents and EU GDPR-adjacent removal pathways. A blanket UK template served on the wrong contact address is usually ignored.

Where a US platform refuses to act, the realistic options narrow to enforcement in the US courts under the Stored Communications Act for disclosure, or to litigation strategy that focuses on the named poster (once identified by OSINT) rather than on the platform itself. We give clients a written cost-benefit estimate before we go down either route.

There is a separate enforcement problem that UK clients often overlook. The SPEECH Act 2010 (28 U.S.C. §§ 4101–4105) bars US federal and state courts from recognising or enforcing a foreign defamation judgment unless the foreign country's defamation law gives the defendant at least as much protection as the First Amendment would. UK defamation law generally does not meet that bar, because the English serious-harm threshold and the absence of an actual-malice rule for public figures fall below First Amendment standards. The practical effect is that a UK defamation judgment, even one secured against a US platform, is unlikely to be enforced in the platform's home jurisdiction. The SPEECH Act does not bite on privacy or data-protection grounds in the same way, which is one of the reasons the choice of legal grounds in the original notice matters as much as it does.

Choosing the grounds: defamation, privacy, GDPR or several at once

A removal notice can run on more than one legal basis. The grounds you pick, and the order in which you put them on the page, materially affect the platform's response and the case you can later bring. This is one of the decisions that separates a solicitor-drafted notice from a template, and it is one of the points at which a confidently-worded ChatGPT output is most likely to cost the client.

The realistic grounds available, depending on the publication, include defamation under the Defamation Act 2013 where the content is a false statement of fact and you can show serious reputational harm; misuse of private information where the content discloses private facts in which you have a reasonable expectation of privacy; UK GDPR Articles 17 (right to erasure) and 21 (right to object), where the platform processes your personal data without a lawful basis or you have objected and the platform cannot show overriding legitimate grounds; harassment under the Protection from Harassment Act 1997 where the content forms part of a course of conduct; and trademark or passing off where a mark or commercial goodwill is at stake.

For UK operators, leading with defamation engages section 5 of the Defamation Act 2013 and the regulation 2 procedure cleanly. For US platforms the picture is different. Section 230 immunity, the SPEECH Act and the First Amendment between them make defamation the strongest of the platform's defences. Privacy and data-protection grounds often bite better against US platforms: California's Consumer Privacy Act, Virginia's Consumer Data Protection Act and the patchwork of US state privacy statutes give a UK complainant pathways the First Amendment does not override, and the platform's own community standards on harassment, doxxing or non-consensual intimate imagery are usually a stronger lever than defamation for content that fits those categories.

The decision is not "which one is technically available". Several usually are. The decision is which to lead with and which to put in the alternative. Leading with privacy on a US platform, with defamation as a UK-law point in the alternative, is usually stronger than the reverse. Leading with defamation against a UK forum where the operator has section 5 exposure is usually right. Including defamation in a privacy-led notice can dilute the privacy request, because the platform routes the case by the lead ground and a defamation lead pushes the file to the team most insulated by Section 230. A template that lists every possible basis side by side looks comprehensive on paper and is treated by platform legal teams as exactly what it is: pattern-matched output rather than strategy. The sequencing is the work.

What a strong removal notice to a platform must contain

Whatever the platform, a removal notice that engages either the UK statutory framework or a US platform's internal takedown process contains the same building blocks. Where the recipient is a UK operator under section 5, the notice must also satisfy regulation 2 of the Operators of Websites Regulations 2013.

Parties and standing

Identify the complainant, the legal representatives if any, and the recipient. For corporate platforms, identify the company, the legal contact (often a designated agent for service) and the specific officer copied in. State the complainant's standing to bring a defamation claim in England and Wales.

Words complained of

Quote the exact words. Include direct URLs, archive links and date-stamped screenshots. For platforms that allow content to be edited or deleted, this evidence preservation step is critical because the operator may take the material down silently and then dispute its content.

Defamatory meanings

For each item, set out the natural and ordinary defamatory meaning you attribute and, where relevant, any innuendo meaning. Where context matters, quote the surrounding paragraph so the meaning is not stripped of its context. This is what allows the operator to assess whether the content is defamatory on its face.

Specific demands

State plainly what you want done: removal of the publications, an undertaking not to host the same material if reposted, disclosure of the underlying poster's identity (where the operator holds it), and where appropriate, an apology or correction. Set out each demand specifically rather than leaving the platform to choose.

Deadline

The working norm is fourteen days. For UK operators served under section 5, the Regulations require the operator to start its own process within 48 hours of receipt, with the poster given five days to respond. Set the overall deadline so that those statutory windows fit inside it.

Statutory hooks

For UK operators, cite section 5 of the Defamation Act 2013 and regulation 2 of the Operators of Websites Regulations 2013, and where applicable regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002. For US platforms, cite the platform's own terms of service, the relevant community standards and any local-jurisdiction process the platform recognises.

Service mechanics for corporate platforms

Identify the platform's registered office in England and Wales (if any), its designated agent for service for content complaints, and the legal contact published in its terms of service. Serve the notice formally, retain proof of service, and copy in the named officer rather than leaving the notice to a generic abuse mailbox.

What happens after you serve the notice

From the day the notice is served, the matter sits on a stepped timeline. The numbers below are typical ranges across the platform cases we run. They are not promises; individual cases vary.

Day 0. Notice served on the platform's designated contact. Proof of service captured. Date-stamped copies of the publications preserved independently of the recipient's site, in case material is taken down and then disputed.

Days 1 to 7. The substantive monitoring window. UK operators who intend to rely on their section 5 defence will, by the end of day 2, be required by the Regulations to have started their own internal process. We watch the publications, watch for silent edits, watch for retaliation and watch for changes to the platform's response posture.

Days 7 to 14. The typical compliant takedown window. Most UK operators acting in good faith on a section 5 notice complete their process inside this period. US platforms operating their own internal review under their terms of service typically respond within the same window where the notice is properly drafted.

Day 14. The deadline. By now the platform has complied, partially complied, requested an extension or refused. For a UK operator, silence at this point is the loss of the section 5 defence. For a US platform, refusal means falling back to escalation under their terms or to litigation against the named poster (once identified).

Days 14 to 30. The escalation window. Pre-action Protocol full-disclosure correspondence opens, see our letter before legal action guide. Parallel notices to upstream hosts or registrars. Where the poster is still unknown, this is when the Norwich Pharmacal Order is prepared and issued.

Days 30 to 90. Settlement, withdrawal and apology, or issue of proceedings. By this stage almost every matter that is going to settle at the operator level has settled.

Costs follow the stage at which the matter resolves and the complexity of the matter. A straightforward removal notice to a single UK operator that resolves at the notice stage is typically a low four-figure cost. Multi-platform matters, US-platform escalation and parallel work to identify an anonymous poster run higher. Escalation through the Pre-Action Protocol and into Norwich Pharmacal applications typically pushes the bill into the five figures. We provide a written cost estimate at every stage.

Worked example: TripAdvisor fake reviews, refusal and section 5 disclosure

The case of Gavin (not his real name), a Cornish restaurateur, illustrates how a platform-focused removal strategy works in practice. Gavin bought a coastal bar and restaurant in 2015, rebranded it, and built it into a popular tourist destination. Each year, in the weeks leading up to the high season, the same pattern of fake one-star TripAdvisor reviews would appear. The reviews did not describe his restaurant; they described one that did not exist. Tourists who would otherwise have visited went elsewhere. A pattern emerged of timed seasonal posting tied to a local rival's commercial interest.

Gavin reported the reviews to TripAdvisor under the platform's own community guidelines. TripAdvisor declined to remove them, taking the view that the reviews did not breach those guidelines. The platform's internal process had run its course and the only remaining options were legal.

Our advice was that the conduct amounted to both malicious falsehood (a false statement made in bad faith causing financial harm to a business) and defamation against a business, and that the realistic path was a cease and desist letter to TripAdvisor combined with a request for disclosure of the posters' identities under Norwich Pharmacal. The letter set out the seasonal pattern, the commercial damage, the legal grounds and the specific demand. The disclosure request asked for IP addresses and any linked mobile telephone numbers held against the posting accounts. We also asked TripAdvisor to forward copies of the cease and desist letter to the users who had posted the reviews. The point of forwarding was strategic: putting anonymous posters on notice that a defamation firm with a record of identifying them was now involved often changes behaviour before identification ever happens.

That is what happened here. TripAdvisor indicated it would cooperate with the disclosure request. Before any order issued, the offending reviews quietly disappeared from the site, deleted by the posters themselves. Gavin's business recovered through the next high season and the pattern has not recurred. You can read the fuller account of that case here.

The TripAdvisor matter shows three things about platform-side removal letters. First, the platform's own community-guidelines review is a separate gate from the legal route, and a refusal at the community gate does not mean the legal route will fail. Second, parallel notice on the platform and on the underlying posters, served through the platform, can resolve the matter without any disclosure being made. Third, the cost-benefit of acting through the platform is materially better for a small business than the cost-benefit of suing anonymous individual posters one at a time.

The right question is not whether your removal letter is well drafted in the abstract. The right question is whether the platform has been put on notice in a form the platform's own legal team can act on, and whether the consequences of inaction are made plain.

Likely outcomes

The realistic spread of outcomes from a properly drafted and properly served removal notice to a platform looks like this.

Silent removal. The single most common outcome. The platform removes the content without further correspondence, treating the section 5 process or its own terms-of-service review as administrative. No money changes hands. Particularly common with UK forums and with the larger US platforms operating mature internal review teams.

Removal with disclosure of the poster. Where the platform holds identifying data on the poster and the notice has properly engaged regulation 2, the operator may disclose the poster's contact details alongside removing the content. That converts the matter from a platform takedown into a letter to an identified individual: see our cease and desist letter guide for what happens next.

Refusal and loss of safe harbour. A UK operator that refuses to comply with the Regulations loses its section 5 defence and becomes exposed as a publisher in its own right. That changes the operator's incentives sharply on a follow-up Pre-Action Protocol letter, which is when most refusals reverse.

US-platform escalation under platform terms. Where a US platform initially refuses, the realistic escalation is internal: a renewed notice citing the platform's own terms with sharper particulars usually produces removal. Litigation in the US courts is rare and expensive.

Issue of proceedings against the poster. Where the poster has been identified (by OSINT or NPO), the matter often resolves against the poster directly even if the platform has not removed the content. The platform is then served with the consent order and removes on the strength of the judgment.

Frequently asked questions

Acting quickly is part of the strategy

Defamation cases reward speed at every stage. Material that is removed in week two is rarely re-uploaded; material that has been allowed to sit and proliferate for six months acquires its own ecosystem of mirrors, cross-posts, archives and search-engine cached versions. The one-year limitation period in section 4A of the Limitation Act 1980 sets the legal outer edge. The single publication rule in section 8 of the Defamation Act 2013 means the year normally runs from the date the post first appeared, not from each fresh view. Every week of delay reduces what a removal notice can achieve and increases what the eventual remediation costs.

If something defamatory has been published about you, your business or the company you serve on a website you do not control, the right time to act is now, not after the next development. The cost of one early conversation is much lower than the cost of one late one.

More on Cohen Davis defamation work: UK defamation lawyers · Cease and desist letter · Letter before legal action in defamation · Disclosure orders and Norwich Pharmacal · Signature cases · About Yair Cohen.