Is negative SEO illegal, and could you actually sue?

Three different questions hide inside one

There is no statute anywhere in the United States called "negative SEO," and no offense of that name. Most pages asking this question get it wrong by replying with a flat yes or a flat no.

The phrase names a goal - reducing someone else's search visibility - not a method. The methods run from plain federal felony (breaking into a server and injecting redirects), through civil wrong at most (a competitor pointing junk links at you), to entirely lawful and merely infuriating (an accurate spam report about a site that really does violate Google's policies). Three questions are being collapsed into one:

• Illegal means criminal. A prosecutor decides whether to charge; the victim does not.
• Actionable means a civil wrong you could sue over - if you can name who did it and prove it cost you money.
• Against Google's policies is neither, and most conduct in this subject lives here and nowhere else.

Everything below is general information about how United States law has been applied to this kind of conduct. It is not legal advice, it creates no lawyer-client relationship, and it cannot tell any reader what to do. I am not a lawyer and this site does not practice law. Whether a campaign is actionable turns on the jurisdiction, on the facts, on who the attacker turns out to be, and on evidence that mostly does not exist yet when the question is first asked. Anyone contemplating a claim, a criminal referral or a demand letter needs a licensed lawyer in the relevant jurisdiction, and needs one first.

The Computer Fraud and Abuse Act: the intrusion statute

The Computer Fraud and Abuse Act, 18 U.S.C. section 1030 - a statute is an enacted law, as distinct from a rule courts built from decided cases - reaches unauthorized access to, and unauthorized damage to, a "protected computer," which in practice means any web server. It is the law for the intrusion half of the subject: hacked-site injection, redirect hijacking through a compromised host or registrar, credential misuse by a former contractor.

Section 1030(a)(5) reaches unauthorized access or transmitted code that causes damage - defined broadly enough to cover injected content, as "any impairment to the integrity or availability of data, a program, a system, or information." "Loss" is equally broad, covering "the cost of responding to an offense, conducting a damage assessment, and restoring the data" (18 U.S.C. section 1030). Two details decide whether a business can use it: the civil action at section 1030(g) realistically opens only through subclause (I) of subsection (c)(4)(A)(i), which requires losses aggregating at least $5,000 in a single year; and a limitation period - the deadline after which a claim is barred - runs two years from the act or from discovery of the damage.

Two decisions narrowed it, both against victims. Van Buren v. United States, 593 U.S. 374 (2021), decided 3 June 2021, read "exceeds authorized access" to reach someone taking information from areas off-limits to them, not someone entitled to it who uses it improperly. hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783 (9th Cir. 18 April 2022) applied that to public pages, since a computer hosting them "has erected no gates to lift or lower in the first place."

The commonest category error in this area is reaching for this statute against conduct that never came near your server. Spam links involve no access to your computer; a false suggested edit to a business listing uses a form the platform opens to the public; a report, a review or a grievance page touches nothing of yours. Where there was an intrusion the statute is real and prosecutors do use it. Where there was not, it is not a theory - and even where it is, attribution usually stops at a VPN exit node, the $5,000 in losses is proved poorly because nobody logs the weekend spent cleaning a hacked site, and server records rotate away before anyone looks.

Extortion: the one theory with a conviction behind it

The Hobbs Act, 18 U.S.C. section 1951, defines extortion as "the obtaining of property from another, with his consent, induced by wrongful use of actual or threatened force, violence, or fear," where the conduct affects commerce; the maximum is twenty years. The "fear" element has long been understood to include fear of economic harm, which is what a threat to search visibility is. A lower-friction companion, section 875(d), reaches an interstate threat to injure property or reputation made with intent to extort.

This is the only theory here behind which sits a documented federal conviction of a search practitioner. The record is on the link removal extortion page and the handling questions in the extortion guide. One qualification travels with that case: the conduct prosecuted was reputation extortion - threatening to publish disparaging material - not link extortion. Anyone claiming a federal court has ruled on link threats is describing something no source supports.

Unlike every other theory here, this one is not yours to run. Charging belongs to a prosecutor, and small-dollar demands are declined routinely; the cases that get made have a domestic, identifiable defendant, a loss aggregated across many victims, and a victim who reported early.

Tortious interference, and the case that is not there

Tortious interference with business relations - deliberate disruption of a business relationship, or of a reasonable expectation of one - is the classic state-law companion claim: most often pleaded in these complaints, least often carried to judgment.

Formulations vary by state, because this is common law with no single national test, but the recurring elements are a valid contract or a reasonable expectancy of a prospective economic relationship; the defendant's knowledge of it; intentional interference inducing breach or disruption; in most states, that the interference was improper or independently wrongful, since ordinary competition is privileged; causation; and damages. Read that as a composite, and as the law of no particular state.

On precedent, the honest answer is that there is not one. No decided case applying tortious interference to a negative SEO fact pattern was located in the research behind this page. The claim fills commentary and appears as a companion count in filed complaints; that is not a court deciding it, and blurring the two does a reader real harm.

The obstacle is structural: courts want a specific third-party relationship that was interfered with. A ranking is not a contract, and "everyone who might have searched for us" is not an expectancy a court will recognize. Anonymous spam also cannot satisfy a requirement that the defendant knew about the relationship at all.

The Lanham Act: elements, standing, and no precedent to point at

The Lanham Act, 15 U.S.C. section 1125(a), has two branches and conflating them is a common error. Section 1125(a)(1)(A) covers false designation of origin, false association and trademark infringement - the branch for an attacker who uses your mark, in anchor text, in a hijacked listing, on a spoofed page. Section 1125(a)(1)(B) is false advertising: misrepresenting "the nature, characteristics, qualities, or geographic origin" of goods or services "in commercial advertising or promotion."

Circuit formulations differ; the common core of false advertising is a false or misleading statement of fact, in commercial advertising or promotion, deceiving a substantial segment of the audience, materially - likely to influence a purchasing decision - in interstate commerce, causing injury. Standing comes from Lexmark Int'l, Inc. v. Static Control Components, Inc., 572 U.S. 118 (2014), decided 25 March 2014, which swept away a circuit split. The plaintiff must fall within the zone of interests - "a plaintiff must allege an injury to a commercial interest in reputation or sales" - and satisfy proximate cause, showing "economic or reputational injury flowing directly from the deception wrought by the defendant's advertising," which "occurs when deception of consumers causes them to withhold trade from the plaintiff." The Court rejected any requirement that the parties be direct competitors.

As with tortious interference, no decided case applying this statute to a negative SEO fact pattern is cited here. The above is the general law of section 1125(a) - the framework a lawyer works from, not authority that anyone has won. A business owner asking "has anyone actually won on this?" deserves the accurate answer, which is that this research pass found no decision saying so.

Two walls stand in front of it regardless. "Commercial advertising or promotion" requires commercial speech, which in practice means a competitor, so an anonymous operator with nothing to sell falls outside that branch. And after Lexmark the deception must be tied to withheld trade - a causal chain running through ranking systems no plaintiff can inspect and every defendant will call a black box that ignored the links anyway.

Defamation, trade libel, and the risk of being the one who sues

Defamation reaches false factual statements about you; trade libel, also called commercial disparagement, reaches disparaging false statements about your goods or business. The SERP defamation page carries it in full.

Defamation requires a false statement purporting to be fact, publication to a third party, the requisite fault, and cognizable harm; public figures must also show actual malice under New York Times Co. v. Sullivan, 376 U.S. 254 (1964). Pure opinion is protected, though the label does not protect a statement that conveys a verifiable factual assertion. Trade libel adds, in most states, pecuniary loss pleaded with particularity - a special-damages requirement that is frequently fatal, since a plaintiff showing only that overall traffic fell has usually not pleaded it.

Three structural obstacles sit on top. Section 230 of the Communications Decency Act removes the deep pocket: the platform hosting the accusation and the engine indexing it are not treated as the publisher, so the only defendant is the author. Anti-SLAPP statutes, in force in a majority of states, expose a plaintiff who sues over protected speech and loses to paying the defendant's attorney fees - the largest downside risk in the subject, and why counsel who know this area are slow to file. And unmasking an anonymous author means a Doe action and a platform subpoena: slow, contested on First Amendment grounds in many jurisdictions, and often terminating at a VPN.

One caution belongs in the body, not a footnote. The 2017 exposure of roughly two dozen libel suits filed against apparently fabricated defendants - documented by Eugene Volokh and Paul Alan Levy, in which a consenting "defendant" produced an agreed order that was then sent to Google - damaged the credibility of defamation court orders as a de-indexing instrument for everyone who came after. A guaranteed de-indexing outcome is being sold on the back of something that has already been a route into a fraud investigation.

State computer-crime and unfair-competition statutes

Every state has a computer-crime statute and most have an unfair-competition or deceptive-trade-practices statute. They matter because their thresholds are sometimes lower than the federal ones, and because they supply a state-court forum.

California Penal Code section 502 is the worked example, and only an example - this research pass surveyed California and nothing else. It prohibits knowingly and without permission adding, altering, damaging, deleting or destroying data, software or programs, and knowingly disrupting or denying computer services to an authorized user, and section 502(e)(1) supplies a civil action for compensatory damages and injunctive relief. Note the absence of a $5,000 gate. That is the practical reason state computer-crime counts are pleaded alongside federal ones.

California's Business and Professions Code section 17200 reaches any "unlawful, unfair or fraudulent business act or practice," letting a plaintiff borrow another statute's violation as the predicate - but it is equitable and does not deliver damages. Elsewhere, state statutes vary enormously in whether a business competitor may sue at all and in what connection to the state must be pleaded, so a count under the wrong state's statute can be lost before anyone reaches the merits. No decided negative SEO case is cited for any of this; it comes from the statutes.

Section 512(f): the fastest attack, the weakest deterrent

A knowingly false copyright notice has the highest success rate in this subject, because the intermediary acts in hours and asks questions later. The counterweight is 17 U.S.C. section 512(f), making anyone who "knowingly materially misrepresents" that material is infringing liable for damages, costs and attorney fees incurred as a result of the service provider relying on the misrepresentation (17 U.S.C. section 512). The notice mechanics and the counter-notification live on the fake DMCA takedown page.

Two cases frame it and point opposite ways. Online Policy Group v. Diebold, Inc., 337 F. Supp. 2d 1195 (N.D. Cal. 2004), decided 30 September 2004, held that "knowingly" covers a party who actually knew, should have known with reasonable care, or would have had no substantial doubt in good faith; it settled on 15 October 2004 for $125,000 - a settlement, not a judgment, and not a typical outcome. Lenz v. Universal Music Corp., 801 F.3d 1126 (9th Cir. 2015), decided 14 September 2015, then held the good-faith-belief requirement "encompasses a subjective, rather than objective standard," requiring "some actual knowledge of misrepresentation."

Sources genuinely disagree about what survives that. The subjective standard bites much less against a fraudulent competitor than against the overzealous rights-holder who fills the commentary: where the claimed original is a fabricated or backdated page, actual knowledge is inferable from the fabrication. The practical obstacles are identification and reach, since notices come from disposable accounts and frequently offshore. For scale, in Google LLC v. Nguyen, No. 5:23-cv-05824 (N.D. Cal., filed November 2023), Google alleged at least 65 accounts filing against more than 117,000 URLs; that case's disposition is not confirmed to the precision this site requires, so it is cited for the shape of the problem only.

Why so few cases are brought, and what non-US readers should know

Six reasons, and anyone told to "just sue" deserves all six. Attribution: spam links, fake reviews, false reports and forged notices are placeable anonymously, from jurisdictions where a US subpoena is decorative. Causation: the defense points to a core update, a migration, a competitor's better content and - devastatingly - Google's own position that it neutralizes link spam rather than penalizing its target, which makes the defense's best expert Google's documentation. Damages: a ranking is not a property interest. Decay: logs rotate and reports roll off before anyone looks. Cost: litigation costs more than the attack did, and the defendant is often judgment-proof. Downside risk: anti-SLAPP fee-shifting, and the discovery exposure of putting your own search history in front of an opponent.

Exactly one of the six is inside your control on the day you first suspect something, and it is decay - the whole argument for preserving the evidence before anything else. A lawyer's first call is mostly a list of artifacts: who you think it is and why, dated proof the conduct happened, dated proof of the before and after, proof you did not cause it yourself, and proof of loss in dollars.

Two differences of kind are worth naming for readers outside the United States, and this is not a survey. The United Kingdom's Computer Misuse Act 1990 carries no monetary threshold and no "exceeds authorized access" gloss, its offenses running from unauthorized access to unauthorized acts impairing a computer's operation. And the European Union's Digital Services Act, Regulation (EU) 2022/2065 of 19 October 2022, creates something with no US equivalent: Article 23 requires platforms to suspend processing of notices and complaints from people who frequently submit notices that are manifestly unfounded. Nothing in US law penalizes a serial abuser of a reporting channel that way - section 512(f) makes the victim sue.

The honest summary. The law holds real theories and a small number of real convictions, and whether any is available to you turns almost entirely on whether the attacker is identifiable and whether the evidence was preserved in the first week. Everything else depends on facts you do not have yet, on the state you are in, and on the judgment of a lawyer this page cannot substitute for.

Frequently asked questions