The first 48 hours: what to do when something harmful appears online

Something has been posted. It is false, or private, or both, and it is spreading. What happens in the next forty-eight hours will shape every option that follows.

The instinct is to act immediately and visibly. Almost every part of that instinct is wrong.

Hour zero to two: preserve

Do this before anything else, and before contacting anyone at all.

The moment you complain — to the poster, to the platform, to anyone — the material is at risk of deletion. If it is deleted before it is captured, you may have a real grievance and no way to prove it.

Capture:

• The full page, not the visible screen, with the complete URL including any post identifier.
• The date and time of capture, with the time zone.
• The account: profile page, display name, handle, creation date if shown, follower count.
• The reach: views, shares, comments, and the comments themselves. This is how damage is proved.
• Republications: search the distinctive phrases elsewhere and capture what you find.
• Metadata where available — file properties, page source, platform identifiers.

Corroborate with something independent: a public web archive capture, and an email of the files sent to yourself and to your advocate at the time of collection. Do not crop, annotate or re-save the originals, and do not photograph a screen with a second device. Write down what you did, when, and on what device.

If the matter is likely to be serious, this is the moment to instruct someone to do it properly rather than doing it on a phone between meetings. Preserving digital evidence sets out what a defensible record looks like.

Hour two to six: do not respond

Do not reply publicly. Not to correct, not to deny, not to threaten. Every reply is a fresh signal to the platform’s ranking systems, a new notification to everyone following the thread, and a quotable escalation.

Do not have anyone respond on your behalf. A colleague, a friend or a communications adviser posting a rebuttal produces the same amplification with less control, and their words may be attributed to you.

Do not contact the poster from a personal account in the first hours. A hostile or panicked message becomes an exhibit. If the poster is someone you know, and a direct conversation is genuinely the fastest route, have it by a channel you would be content to see read aloud.

Do not delete your own material. Deleting your own posts, messages or account in a matter that may be litigated creates a serious problem later, and looks worse than whatever you removed.

Do not send a copyright notice unless you actually own the copyright in the specific file. This is the single most common early error and it carries its own liability. When a takedown is the wrong move explains why.

Hour six to twenty-four: assess

Four questions, answered honestly.

1. Is it true? Not “is it fair”, not “is it the whole picture” — is the sting of it substantially true? If it is, defamation is not the route, and the question becomes whether privacy, data protection or a platform policy applies instead. If it is false, identify precisely which factual assertion is false and what evidence establishes that.

2. Who published it, and who republished it? Is it an identifiable person, a business, a news organisation with editorial responsibility, or an anonymous account? Each has a different set of levers. Note that identifying an anonymous publisher is a separate, slower problem than establishing that the publication is wrongful.

3. What is the actual harm? Lost contracts, withdrawn offers, cancelled meetings, a bank asking questions, staff resigning. Record it as it happens, with dates. Harm asserted six months later in a witness statement is worth far less than harm documented as it occurred.

4. What outcome would resolve this? These are not interchangeable:

• Correction or right of reply — the fastest and often the only thing that repairs the record.
• Removal at source — the only outcome that takes it off the internet.
• De-indexing — reduces discovery through a search engine; the page stays live.
• Damages — compensates, slowly and publicly, and revives the story.
• A judgment — frequently the instrument needed to make a platform act, rather than an end in itself.

Answer this before choosing a route. A doctrinally strong claim aimed at the wrong outcome will disappoint.

Hour twenty-four to forty-eight: choose the route

Note the clock. In Kenya, an action for libel or slander must be brought within twelve months of accrual — against three years for tort generally. A statutory right of reply against a newspaper must be requested in writing within fourteen days of publication. In the UAE, a criminal complaint for defamation is not admissible more than three months after the victim becomes aware of both the offence and the perpetrator. These are short and they run from now.

Identify the right first recipient. In most cases it is the publisher or site operator, because they are the only party who can remove the content at source. Reporting to a platform first is appropriate where the content falls squarely within a policy category the platform can actually assess — impersonation, doxxing, non-consensual intimate imagery, harassment — because those are decided quickly and do not require anyone to adjudicate the truth of a statement.

Get the letter right. A calibrated first letter — accurate, specific, proportionate, setting out precisely which statements are false and why, and asking for a defined and achievable remedy — resolves a large share of matters. A letter that overstates the claim, threatens remedies that are not available, or demands the removal of true statements invites publication of the letter itself and turns a contained problem into a news story about an attempt to suppress criticism.

Where the content is non-consensual intimate imagery, move differently and faster. Hash-matching services allow the image to be blocked across participating platforms without ever uploading it — the hash is generated on the person’s own device. In the United States, the TAKE IT DOWN Act requires covered platforms to remove such material within 48 hours of a valid request from the individual or their authorised representative, enforced by the Federal Trade Commission, with the platform process requirement having taken effect in May 2026. These routes are dramatically faster than any copyright or defamation route and do not depend on who took the photograph.

Where a criminal offence is genuinely involved — extortion, threats, unauthorised access, impersonation, image-based abuse — a complaint to the police engages investigative powers that a private party does not have, including the ability to compel production of records identifying an anonymous account. In the UAE this is the normal route rather than an alternative one.

What to do about the people around you

Reputational harm is felt as an emergency by everyone connected to it, and uncoordinated action multiplies the damage.

• Tell the small number of people who need to know — a board, a partner, key clients — directly and early, with a short factual account and a clear statement of what is being done.
• Ask everyone else not to engage, share, screenshot or comment. Well-meaning defence from colleagues extends the story’s life considerably.
• If the matter is likely to reach staff, customers or media, prepare a short holding statement before you need it. A holding statement you have thought about is very different from one drafted under pressure.

What not to do at any point in the first week

• Do not buy the domain, the search advertisement, or the “reputation management” package that arrives unsolicited within hours of the post. These services frequently make matters worse and occasionally break the law.
• Do not pay a demand. Where there is an extortion element, paying invites escalation, and the payment itself becomes a fact in the case.
• Do not brief a journalist to tell “your side” in the first week, unless there is a specific and time-critical reason. It converts a post into an article, and the article outranks the post.
• Do not assume the matter is too small to be worth advice, or too large to be fixable. The first assessment is usually short, and it is where the cost is lowest.

The short version

Preserve everything. Say nothing publicly. Work out whether it is true, who published it, what the harm actually is, and what outcome would resolve it. Note the limitation clock. Then send one accurate, proportionate letter to the person who can actually remove it.