The escalation ladder: who can actually remove online content

When a client asks how to get something taken off the internet, the honest answer begins with a map. Six distinct layers can be asked to act, they have very different powers, and each rung down the ladder is blunter, slower and more likely to cause collateral damage than the one above.

The governing principle: escalate only when the layer above genuinely cannot or will not act. Jumping straight to a registrar or a CDN marks the claimant as unserious and often destroys goodwill that will be needed later.

Before any of it, preserve the evidence. Content that has been removed is content you may no longer be able to prove existed. See Preserving digital evidence.

Rung 1 — The publisher, author or site operator

Can do: everything. Delete, correct, amend, add a right of reply, apply a noindex directive, remove the item from their own archive.

Cannot do: control mirrors, caches or third-party reposts.

Why start here. This is the only layer that produces genuine removal at source. Google says so itself: content removed by the site owner will be gone from the web entirely, not just from search results. It is also the fastest, cheapest and least public route.

A calibrated letter — accurate, specific, proportionate, not threatening — resolves a large share of matters. A defective or overreaching one converts a contained problem into a news story about the attempt to suppress it.

It matters here whether the operator is a publisher with editorial responsibility — a news organisation, potentially answerable to a press regulator such as the Media Council of Kenya or the UAE Media Council — or an ordinary user on someone else’s platform. The levers are entirely different. A statutory right of reply, for instance, exists against a Kenyan newspaper and not against an anonymous account.

Rung 2 — The platform or host

Can do: remove the specific item; suspend or terminate the account; geo-restrict the item in one country; apply policy remedies that have no legal equivalent — impersonation, doxxing, non-consensual intimate imagery, coordinated harassment.

Cannot do: adjudicate contested facts. Platforms will not decide whether a statement is true. They will apply bright-line policies.

The instruments, in rough order of strength: a platform policy report; a notice under Article 16 of the EU Digital Services Act where the service is offered to users in the Union; a section 512(c)(3) notice where the matter is genuinely a copyright case; a request under the US TAKE IT DOWN Act where the content is non-consensual intimate imagery; and a court order.

Where you have actual rights. Inside the EU regime the position is materially better than elsewhere. Article 16(5) requires a reasoned response to a notice. Article 17 requires a statement of reasons to the affected user. Article 20 gives access to an internal complaint-handling system, free of charge, for at least six months, with decisions taken under the supervision of qualified staff and not solely by automated means — and it expressly extends to people who submitted a notice, not only to those whose content was removed. Article 21 allows either side to take the dispute to a certified out-of-court settlement body, which must decide within 90 days, with the platform bearing the fees if the user wins; those decisions are not binding.

Article 16(1) says “any individual or entity”, with no nationality or residence requirement for the notifier. A Nairobi- or Dubai-based claimant can therefore serve an Article 16 notice on a major platform. But the content must be illegal content — illegal under Union law or the law of a Member State — so a claimant with no EU nexus must identify the Member State law breached, and the realistic outcome for a defamation claim is geo-restriction in that Member State rather than global removal.

One further limitation worth stating plainly: Article 16(3) fixes a provider with knowledge only where a notice allows it to identify the illegality without a detailed legal examination. Defamation notices are structurally weak on that test, because falsity, meaning and defences are exactly the kind of detailed examination the provision carves out. A DSA notice with a judgment behind it is a different instrument from a DSA notice without one.

On defamation specifically, most platforms will not adjudicate. Their consistent position is that they are not a court: bring a court order identifying the specific unlawful content, or report it under a policy category they can actually assess. Google is the notable exception — it assesses defamation claims on their merits without requiring a judgment, using its own subject-matter experts against local defamation law, though a favourable judgment is taken into account and the usual outcome is country-scoped removal.

The consequence for planning is worth saying directly: for defamation, the realistic path is a claim against the publisher, with a court order as the instrument used against the platform. The order is not an obstacle on the way to the remedy. It is frequently the product.

Rung 3 — The hosting provider

Can do: suspend the site or the customer account, and in practice force the operator’s hand.

Cannot do: edit a page. Hosts act at account or site granularity, not page granularity. Asking a host to remove one paragraph will fail.

When appropriate: the operator is unreachable, anonymous or refusing, and the content is manifestly unlawful — non-consensual intimate imagery, child sexual abuse material, clear infringement, or content covered by a court order. US hosts respond to section 512(c)(3) notices; EU hosts to DSA Article 16 notices; any host to a court order.

The collateral-damage warning. Suspending shared hosting can take down unrelated sites. A host asked to remove an entire account over a contestable defamation allegation will usually decline, and is right to.

Rung 4 — The CDN or reverse proxy — usually the wrong target

Cloudflare’s own position is unambiguous: it “does not host content through those services, and we cannot remove content from the Internet that we do not host.”

Pass-through services — reverse proxy, CDN, pass-through security — do not store content. There is nothing to delete. Terminating the service does not remove the material; it removes a layer of protection while the site continues to resolve to its origin. The same logic applies to every other reverse proxy.

What Cloudflare does with a pass-through abuse report is forward the complaint to the website operator and to the hosting provider, and supply the hosting provider with the origin IP address so that they can locate the content.

So the correct use of a CDN abuse report is not removal — it is discovery. Filing one is often the most efficient way to identify the true hosting provider so that Rung 3 can be served properly. Do not let a client believe the CDN is the host merely because it is what DNS shows.

The exception: where the CDN’s own hosting products are in use, it does store content, and it will act on notices and on categories including defamation.

Rung 5 — The registrar and registry

Can do: suspend, lock, delete or — on a dispute-resolution decision or court order — transfer the entire domain.

Cannot do: touch a page, a post or a subdirectory. This is the bluntest instrument on the ladder. It takes down email, subdomains, applications and everything else on the name.

When appropriate: the whole domain is the problem — a cybersquat, an impersonation site, a dedicated harassment site — and the dispute-resolution elements are met, or a court order is held. See Domain name disputes.

The hard limit. Under the 2024 global amendment to the Registrar Accreditation Agreement, registrars must maintain a dedicated abuse contact monitored 24 hours a day and must promptly mitigate DNS Abuse, defined as malware, botnets, phishing, pharming and spam where spam serves as a delivery mechanism for those. Defamatory or offensive content is not DNS Abuse. A registrar has no ICANN obligation to act on it, and ICANN’s contractual compliance function will not compel them. Registrars generally act on content only under a court order or their own acceptable-use policy. Complaints to ICANN about site content are a dead end, and clients should be told so before they spend time on one.

Rung 6 — Search de-indexing

Can do: remove URLs from a search engine’s results — typically country-scoped for legal removals, and global for removals under the engine’s own policies.

Cannot do: remove anything from the internet.

This is the message to give every client without softening it. De-indexing is visibility management, not removal. The page remains live and reachable by direct link. It remains on other search engines unless separately addressed. It remains in web archives. It remains shareable. And where removal followed a notice, the notice itself may be published to a transparency database.

Google’s own framing is that the information still exists on the source page whether a request is approved or denied, and its stated preference is source removal for exactly that reason.

The available routes are the legal removal flows (copyright, defamation, privacy and data protection, court orders), the personal-information removal policy covering a requester’s own phone number, home address or email address where they cannot remove it themselves — which expressly excludes pages owned by educational or government institutions or by newspapers — and the self-service monitoring tools layered on top. Filing the equivalent request with other search engines is a step routinely skipped.

Sequence note: de-index last, and only after Rungs 1 to 3 have been exhausted. De-indexing an active page while the operator is still hostile achieves little and can prompt republication at a new URL.

The order, in one line

Preserve the evidence. Approach the publisher. Report to the platform under a category it can actually decide. Escalate to the host only for manifestly unlawful material or with an order. Use the CDN to find the host, not to remove. Go to the registrar only when the whole domain is the problem. De-index last, and never mistake it for removal.