The legal and reporting picture, and the wall most cases stop at

What this page is, and what it is not

This is general information about how United States law and the major platform processes have been applied to search sabotage. It is not legal advice, it creates no lawyer-client relationship, and it cannot tell any reader what to do about their own situation. I am not a lawyer and this site does not practice law. Whether anything here is available to you turns on your jurisdiction, on facts that mostly do not exist in usable form when the question is first asked, and on the judgment of a licensed lawyer this page cannot substitute for.

That disclaimer is meant, not decorative. The most common way people are hurt in this part of the subject is not by losing a case; it is by acting on a confident summary of the law, sending something they should not have sent, and creating an exposure that did not exist before. A cease and desist letter aimed at a genuine critic rather than at an attacker can produce a fee award against the sender. A copyright notice filed too broadly carries its own liability. Both are easy to send and impossible to unsend.

The frame worth holding onto: a legal remedy is the relief a court can order once a wrong has been proved — damages, an injunction, restitution. Everything else in this area is something less than that, and calling it a remedy is where the confusion starts. A platform removing a review is not a remedy. A spam report being filed is not a remedy. A prosecutor declining a referral is not a finding of anything. The four systems below are routinely spoken about as one, and separating them is the first useful thing anyone can do here.

Four systems, three of which are not law

Ask what channel to use and the honest answer starts with which of four machines you want to operate, because they have different inputs, different outputs, and wildly different timescales.

• A platform process. An intake form operated by a private company applying its own policies to its own product. It can remove a review, restore a listing, delist a URL, lift a warning. It produces no finding, no reasoning and usually no reply, it is not appealable to anyone outside the company, and it is not adjudication however much the form resembles a complaint.
• A statutory notice. A copyright removal request and its counter-notification are the main example, and they are unusual here in running on clocks the law itself sets rather than on a company's discretion. They are legal instruments that carry legal consequences for the sender, which is exactly the part that gets skipped.
• A law-enforcement referral. A complaint to a federal, state or local agency. You are a witness rather than a client: you do not control whether anything is charged, what is charged, or what any of it produces, and most referrals produce nothing visible to the person who filed them.
• A civil claim. The only one of the four that can produce a legal remedy in the strict sense, and the only one that requires a defendant with a name.

Two of those are commonly mistaken for each other. Reporting spam to a search engine feels like reporting a crime and is nothing of the sort — it is an input to a private enforcement system that owes the reporter no answer. And in at least one case the reporting channel runs backward: where a report can lead to a manual action, the submission text is relayed to the site being reported. Writing a spam report about somebody who is extorting you means writing them a letter. Which channel exists for which symptom, with the current names and what each accepts, is set out in reporting negative SEO to Google.

What the law reaches, and what it does not

There is no offense called negative SEO anywhere in United States law, and no cause of action by that name. The phrase describes a goal — reducing somebody else's search visibility — rather than a method, and the methods run the entire distance from federal felony to entirely lawful.

The law reaches conduct, and it reaches it best where the conduct is old and well understood. Breaking into a server and altering what it serves is unauthorized access, and the intrusion statutes are real and are used. Demanding money under threat of harm to a business is extortion, and it is the one theory in this subject with a documented federal conviction of a search practitioner behind it. Publishing a false statement of fact about a business is defamation or trade libel. Filing a copyright notice you know to be false is actionable misrepresentation under 17 U.S.C. 512(f), which makes a knowing material misrepresentation that material is infringing liable for the damages, costs and fees it caused. Using somebody's trademark to deceive is the Lanham Act's territory.

What the law does not reach is the thing people most want reached: a ranking. No United States legal theory entitles a business to a position in a search result, and no court supervises the judgment of a ranking system. A search engine's decision about where a page belongs is not a wrong that can be undone, which means a claim has to be built on something else the attacker did — an intrusion, a lie, a threat, a forged notice — with the ranking loss serving as the measure of damage rather than as the injury itself. That distinction disposes of a large share of the conversations that begin with someone asking whether they can sue.

Which theories exist, what elements each requires, and how thin the decided case law actually is are set out in is negative SEO illegal. The short version worth carrying into any first conversation with counsel: the theories are real, and almost none of them has been tested on these facts.

Attribution is the wall, and it is not a technical problem

Nearly every matter in this subject stops at the same place, and it is not causation, cost or the merits. It stops because nobody can say who did it.

Every channel an attacker uses is designed to be usable anonymously. Spam links are placed on other people's compromised or automated sites. Fake reviews and suggested edits are submitted through forms platforms open to the public by design. Copyright notices arrive from disposable accounts. Grievance pages are registered behind privacy services and hosted wherever is cheapest, frequently in jurisdictions where a subpoena is decorative.

Public registration data no longer helps the way practitioners remember it helping. Under ICANN's Registration Data Policy, effective 21 August 2025, registries and registrars publish a limited set — the domain name, registrar details, creation and expiry dates, status and registrant country — while the registrant's name, street address, postal code, phone number and technical contacts are redacted. The useful half of the same policy is a formal disclosure route with clocks attached: a published request process, acknowledgement within two business days, and a response within thirty calendar days, compressed to two hours and twenty-four hours where an imminent threat is claimed. Most victims do not know that route exists, and thirty days is a long time to start counting in month three.

So attribution surfaces in a small number of places and nowhere else. Server logs, which record a requesting address and agent and are the only artifact here that behaves like forensic evidence. Published takedown notices, which carry the submitter's own claims about who they are. Infrastructure shared across several attacker-controlled domains, which is one of the few practical routes to tying incidents together. And the case that produces most of the matters where recourse is genuinely realistic: the intruder turned out to be a former employee, contractor or agency using access nobody revoked. That is not a coincidence. It is the only fact pattern in which the attacker is already known to the victim.

The second and third walls: causation and damages

Suppose attribution is solved. Two problems remain, and they are the reason experienced counsel are slow to file even on good facts.

Causation runs through a system nobody can inspect. To recover, a claimant has to show that what the defendant did caused the loss. The defense will point to a core update that landed the same week, a migration, a competitor's better content, and — most damagingly — the search engine's own published position that it neutralizes manipulative links rather than charging them to the site they point at. In a link case the defendant's strongest expert is the plaintiff's own search engine's documentation, and there is no way to examine the ranking system to rebut it. Nobody can put the algorithm on the stand.

Damages have to be proved in money, not in positions. A ranking is not a property interest and a lost position is not a quantity. Converting one into a number means before-and-after revenue data, a defensible attribution model and a baseline that was recorded before the incident — which is precisely the material most businesses discover they do not have. Some theories add their own hurdle on top: trade libel in most states requires pecuniary loss pleaded with particularity, and a claimant who can show only that overall traffic fell has usually not pleaded it.

Add the structural obstacles and the picture is complete. Evidence decays on a schedule of days. Litigation costs more than the attack did. The defendant is often judgment-proof. And in the speech cases there is a real downside: anti-SLAPP statutes in a majority of states expose a claimant who sues over protected speech and loses to paying the other side's attorney fees. That is the largest single downside risk in the subject, and it is why just sue them is advice given almost exclusively by people who will not be paying for it.

A platform decision is not a finding, in either direction

People read platform outcomes as verdicts, and platforms encourage the reading by shipping forms that look like complaints. They are not verdicts, and the error runs both ways.

A removal is not vindication: a review taken down, a listing restored or a URL delisted means a policy was applied to a product, and it establishes nothing about whether any law was broken. A refusal is not exoneration either, and that is the half that does real harm. Platform processes decline for reasons unrelated to the merits — the wrong form, a report naming a domain where specific URLs were required, the wrong policy cited, an overwhelmed queue. An attacker who was reported and not acted against has not been cleared, and treating a refusal as a finding is how a victim talks themselves out of a matter they might have had.

The one place a legal clock genuinely runs through a platform is the copyright counter-notification, where on a valid counter-notice the host restores the material within a statutory window unless the complainant sues. That is worth understanding before any notice is sent, because it means a takedown you are not prepared to follow into court is reversible by anybody willing to sign a form — and the person who signs it is now better informed about you than they were.

Scale, abuse of the channels, and what a research pass could not find

The reporting channels are themselves attack surfaces, and the volume involved is not small. In Google LLC v. Nguyen, filed in the Northern District of California in November 2023, Google alleged that a network of at least 65 accounts had filed copyright removal requests against more than 117,000 URLs. That case is cited here for the shape of the problem rather than for any holding: its disposition is not confirmed to the standard this site requires, and a filed allegation is an allegation. What it illustrates is the asymmetry that makes the fastest attack in this subject also the hardest to deter — a channel built to act in hours, aimed by somebody who never has to appear.

Two things follow. First, the fastest and most effective attacks are the ones that borrow somebody else's enforcement machinery, which is why the misrepresentation provision at section 512(f) matters out of proportion to how often it is used. Second, other legal systems have started to treat serial abuse of a reporting channel as its own problem — the European Union's Digital Services Act requires platforms to suspend the processing of notices from people who repeatedly submit manifestly unfounded ones. Nothing in United States law does that. Here the burden stays with the victim, who must sue.

A word about what this page rests on. A research pass is a documented round of source verification — fetching each primary source, recording what it says and the date it was checked, and recording just as explicitly where nothing could be verified. The research pass behind this section of the site located no decided case entering judgment for a claimant on a negative SEO theory under any of the civil statutes surveyed. There are federal criminal convictions for extortion by a search practitioner, and there are decided cases on the underlying statutes in unrelated settings. There is no body of negative SEO case law, and any article implying otherwise is describing something that does not exist. Recording that absence is more useful than filling it, and it is the kind of finding that gets quietly dropped from commercial writing on this subject.

The one variable inside your control on day one

Of the reasons these matters fail — anonymity, causation, damages, cost, downside risk, and decay — exactly one is inside a victim's control on the morning they first suspect something, and it is decay.

Server logs rotate in days. CDN records are frequently retained for hours or not at all. Attackers delete their own pages at will. Third-party link indexes overwrite themselves as they re-crawl, and hold no historical view anyone can subpoena. Search console performance data sits in a rolling window and the links report has no history whatsoever — it is a snapshot of now, and a snapshot not taken at the time is simply lost. By the time a business is angry enough to call a lawyer, typically weeks after the fall, most of that is gone.

The obligation also starts earlier than people expect. Federal Rule of Civil Procedure 37(e) addresses electronically stored information that should have been preserved in the anticipation or conduct of litigation, was lost because reasonable steps were not taken, and cannot be restored or replaced. The trigger is anticipation, not filing — and it attaches to the potential claimant as much as to anybody else, so a business that sues and cannot explain what happened to its own logs is the one answering for it. What that means practically is suspending routine deletion for the sources that matter, in writing, and recording when you did it. The full account of what decays, how fast, and how to capture material so it survives a challenge is in preserving the evidence.

Where the conduct is a demand for money rather than a link campaign the sequence changes shape: preserve before replying, verify the sender's claims against your own first-party reports before believing any of them, and take counsel before making a referral. Negative SEO extortion sets out that first day in order, along with why the two irreversible mistakes — paying and deleting — both tend to happen in the first ten minutes.

The honest summary of the whole area: the law holds real theories and a small number of real convictions, the platform processes do a narrow job narrowly, and whether either is available to you turns almost entirely on whether the attacker can be identified and whether the evidence was kept in the first week. Everything else is a conversation with a lawyer in your own jurisdiction, and it should be an early one.

Frequently asked questions