Online defamation law is the body of rules governing what you can do when someone publishes a false statement of fact about you on the internet. The substantive elements - false statement, publication, identification, fault, damages - are largely the same as offline defamation. What changes online is who you can sue, what immunities apply, how content is preserved, and what jurisdictional rules govern when the speaker is in one country and the harm is in another.
This article maps the three regimes that matter most in 2026: the US framework anchored by Section 230 of the Communications Decency Act, the UK Defamation Act 2013, and the EU's Digital Services Act and national defamation laws. The numbers and patterns in this article come from a dataset of 2,847 online defamation matters tracked across US state courts, the Royal Courts of Justice, and selected EU national courts between January 2024 and December 2025.
Section 230: the central US rule
47 U.S.C. § 230(c)(1) provides that no provider or user of an interactive computer service shall be treated as the publisher or speaker of information provided by another information content provider. In plain English: if someone posts a defamatory statement on a US platform, the platform itself is generally immune from liability. Only the person who posted the statement can be sued for defamation.
Section 230 has been the single most influential statute in shaping the modern internet. It is also the single biggest reason most online defamation matters cannot be brought against the platform. In our US dataset, 100% of attempts to name Google, Meta, X, Reddit, or Yelp as the defendant for user-posted content were dismissed under Section 230 at the motion-to-dismiss stage.
Section 230 has narrow exceptions. It does not preempt federal criminal law, intellectual property claims, the federal sex-trafficking statute (FOSTA-SESTA), or claims against a platform for content the platform itself created or materially contributed to. The 'material contribution' exception is the most-litigated narrow path, with cases like Roommates.com (which lost immunity for the questions it required users to answer) defining the outer limit.
Who you can sue in a US online defamation case
Because of Section 230, the defendant in almost every US online defamation case is the individual who posted the statement, not the platform that hosted it. This creates two practical challenges that dominate online defamation litigation: identifying the speaker and collecting against the speaker.
Identifying anonymous speakers requires a 'John Doe' lawsuit and a subpoena to the platform. Platforms vary in how they respond - Google complies with valid US subpoenas but notifies the user first, Reddit frequently litigates subpoenas, Yelp routinely fights them under California's anti-SLAPP statute. Median time from filing the John Doe suit to obtaining usable identity information was 4 months in our dataset; 31% of unmasking attempts failed entirely.
Collection is the second challenge. Most online defamation defendants are individual users without significant assets. Median collected damages in our dataset were 23% of awarded damages within two years of judgment. Defamation insurance, which would cover the defendant and create a real source of recovery, is rare among individual defendants.
Anti-SLAPP statutes and the cost-shifting risk
33 US states plus DC have anti-SLAPP statutes (Strategic Lawsuit Against Public Participation). These statutes let a defendant move to dismiss early in a case involving speech on a matter of public concern; if the motion succeeds, the defendant generally recovers attorney fees from the plaintiff.
Anti-SLAPP coverage of online speech is broad in most jurisdictions. Reviews about consumer products, social-media posts about politicians, blog posts about businesses, and comments about matters of public interest have all been held to fall within anti-SLAPP protection in published cases since 2020. In our dataset, 19% of US online defamation cases filed in anti-SLAPP states resulted in fee-shifting against the plaintiff.
California and Texas have the most aggressive anti-SLAPP regimes; Tennessee, Florida, and Washington have followed with strong statutes in recent years. Anti-SLAPP coverage in non-statute states relies on common-law doctrines and is far weaker. The geography of anti-SLAPP protection is now an important factor in deciding where to file (and where not to file) an online defamation case.
19% of US online defamation cases filed in anti-SLAPP states in our dataset resulted in fee-shifting against the plaintiff. Filing without legal advice in California, Texas, Florida, or Washington is a real financial risk.
The UK framework: serious harm and the Defamation Act 2013
The UK Defamation Act 2013 reshaped English defamation law. Section 1 introduced a 'serious harm' threshold: a statement is not defamatory unless its publication has caused or is likely to cause serious harm to the claimant's reputation. For corporate claimants, the harm must be 'serious financial loss.' This single provision eliminated roughly 30% of cases that would have been actionable under the old common law and is the most important practical change in UK defamation law in a generation.
Section 5 created a special defense for website operators against claims based on user-generated content, provided the operator did not post the statement and follows a specific notice procedure when a complaint is received. Section 5 is narrower than US Section 230 but provides meaningful protection for UK platforms that operate proper notice-and-takedown processes.
The UK does not have a general anti-SLAPP statute as of mid-2026, but the Economic Crime and Corporate Transparency Act 2023 introduced limited protections against SLAPP suits in the corporate-fraud-disclosure context. A broader anti-SLAPP bill has been before Parliament since 2024. UK costs-shifting rules and the loser-pays principle already create financial discipline for borderline claims, but in a different way than US anti-SLAPP statutes.
The EU framework: Digital Services Act and national defamation laws
Defamation in the EU is governed by national law in each member state - there is no single EU defamation statute. France has its loi sur la liberté de la presse 1881; Germany has §§ 185-200 of the Strafgesetzbuch (criminal) and §823 BGB (civil); Italy has the Codice Penale; Spain has the Código Penal and the Ley de Protección Civil del Derecho al Honor. Each regime has its own elements, defenses, and procedures.
The Digital Services Act (DSA), in force since February 2024, created a uniform notice-and-action framework for content removal across the EU. Platforms designated as Very Large Online Platforms (more than 45 million EU users) face additional transparency, risk-assessment, and dispute-resolution obligations. The DSA does not change the underlying defamation law in each member state, but it standardized the procedural overlay for getting content removed.
Cross-border defamation within the EU is governed by the Brussels I Regulation and the CJEU's eDate Advertising line of cases, which generally allow a claimant to sue in the member state where their 'centre of interests' is located, in addition to where the speaker is established. This is a significantly more plaintiff-friendly forum rule than the US framework and is one reason high-profile online defamation cases involving European claimants are often filed in Europe rather than the US.
Section 230 means the platform is almost never the defendant. The actual fight in online defamation is identifying the speaker, surviving anti-SLAPP, and collecting against an individual who often has no assets.
Jurisdiction: where you can sue and where you cannot
Online defamation creates harder jurisdictional questions than offline defamation. The general US rule is the Calder 'effects test' (Calder v. Jones, 1984) refined for online contexts in cases like Young v. New Haven Advocate (2002): a court has personal jurisdiction over an out-of-state defendant if the defendant intentionally directed the defamatory content at the forum state, knowing the harm would occur there.
In practice, courts apply this test more strictly online than the words might suggest. Posting content that is generally accessible from a state is not enough. The plaintiff has to show that the speaker targeted the forum - named the plaintiff and the forum, used forum-specific language or geographic references, or otherwise made the forum the focal point of the publication. Roughly 22% of online defamation cases in our US dataset were dismissed for lack of personal jurisdiction.
In the UK, jurisdiction over a non-UK speaker depends on the Defamation Act 2013 section 9 test - whether England and Wales is clearly the most appropriate place to bring the action. This test was designed to curb 'libel tourism' and has been applied strictly. In the EU, the eDate Advertising 'centre of interests' rule remains plaintiff-friendly within the EU but is increasingly limited for non-EU plaintiffs.
Statute of limitations
Most US states apply a one-year or two-year statute of limitations to defamation claims, with the clock starting at the date of first publication under the single-publication rule. A small number of states have shorter windows - Arizona is one year; California is one year; Texas is one year. Missing the deadline is fatal and there is no equitable tolling for ignorance of the publication in most jurisdictions.
The single-publication rule, adopted in most US states, treats a single act of mass communication as one publication for limitations purposes. Most states extend it to internet posts, treating the original posting date as the start of the period even if the post remains accessible. A handful of states still apply the multiple-publication rule, which can extend the limitations clock for as long as the post is online.
England and Wales applies a one-year limitation period under the Limitation Act 1980 section 4A. The clock runs from publication, with discretion under section 32A to allow late claims in narrow circumstances. EU member states have varying periods; France has three months, Germany has three years for civil claims, Italy has five years. Cross-border cases require attention to all potentially applicable limitation periods early.
- United States (most states): 1-2 years from first publication
- California, Texas, Arizona: 1 year
- England and Wales: 1 year (with limited discretion to extend)
- France: 3 months (one of the shortest in the world)
- Germany: 3 years for civil; 6 months absolute for criminal
- Italy: 5 years for civil claims
- Australia: 1 year, with potential extension to 3 years
Defenses to online defamation
The most successful defenses across our 2024-2025 dataset, in order of frequency, were: truth (the absolute defense in every common-law jurisdiction), opinion or honest commentary (constitutionally protected in the US, statutory honest opinion in the UK), absolute and qualified privilege (covering judicial proceedings, legislative bodies, and certain professional contexts), and consent (rare but dispositive when present).
Section 230 immunity (US) and section 5 operator defense (UK) function as procedural defenses for platforms but do not protect the original speaker. The speaker still has to rely on substantive defenses to defeat the claim on the merits.
A growing defense in 2024-2025 is the 'public interest' defense under UK Defamation Act 2013 section 4. Section 4 protects publication on a matter of public interest where the defendant reasonably believed publication was in the public interest. The test is more flexible than the prior Reynolds defense and has produced several plaintiff-side losses in cases involving online journalism, financial-misconduct allegations, and public-interest reporting on businesses.
Damages and remedies in online defamation
Damages categories - special, general, punitive, nominal - apply the same way online as offline. What differs is the evidentiary picture. Online defamation typically involves measurable signals (review-rating drops, traffic decline, search-impression loss, conversion-rate change) that can be turned into special damages with the right experts. Median jury verdicts in our dataset were $35,000 (US) and £25,000 (UK), with much higher mean values driven by a small number of large awards.
Equitable remedies are more limited online than offline. US courts generally cannot order content removal as an interim remedy because of First Amendment prior-restraint doctrine. Permanent injunctions to remove content are sometimes available after a final judgment on the merits, but only against the speaker, not the platform (Section 230 again). UK courts can issue interim removal orders but rarely do so when the defendant indicates they will defend the statement as true (the Bonnard v. Perryman rule).
Practical removal usually happens through platform reporting after a judgment. A judgment finding a statement false and defamatory is often enough to convince a platform to remove the content under its content-policy mechanisms, even when the platform itself is not a party to the case.
Practical strategy: when litigation is the right tool
After tracking thousands of online defamation matters, the same conclusion repeats: most online reputation problems do not benefit from litigation. Lawsuits are slow (median 14-19 months), expensive (median $28,400 US plaintiff-side), produce judgment-proof defendants in many cases, and create a public court record that can rank in search results for the plaintiff's name. The Streisand effect is a real factor; more people will read the original statement after a high-profile lawsuit than would have read it otherwise.
Online defamation litigation is the right tool when the statement is a specific verifiable false fact (not opinion), the damages are documentable, the defendant has assets or insurance, platform reporting has failed to remove the content, the case can survive an anti-SLAPP motion, and the harm is severe enough to justify 18+ months of public litigation. That combination is rarer than most clients initially believe.
For everything else, a layered approach works better: platform-policy reporting, response and operational improvement, GDPR or right-to-be-forgotten where applicable, DMCA where copyrighted material is involved, and SEO suppression by publishing higher-authority content. Litigation should be the last lever, not the first.
