Online reputation attacks: legal remedies for influencers, companies and executives in France

A takedown video targeting a content creator, fake reviews hammering a company, a LinkedIn post accusing an executive of fraud: online reputation attacks have changed in scale, not in law. The victim’s first instinct is to demand removal. Yet the first decision is not technical — it is legal: characterising the attack. That characterisation determines the remedy, the evidence required, and a limitation period which, under French law, is often just three months.

Three legal regimes for one attack

French law has no general tort of “online reputational harm”. It has specific characterisations, each carrying its own regime, forum and limitation period. The practitioner’s first task is to read the attack and place it in the right box — because the choice is exclusive.

Defamation first: any allegation or imputation of a specific fact that damages the honour or standing of a person — natural or legal (section 29 of the Law of 29 July 1881 on press freedom). It is governed by a derogatory regime designed to protect free speech: strict formalism, a short limitation period, and specific defences (truth, good faith). And that regime is exclusive: the Plenary Assembly of the Court of Cassation has held since 2000 that abuses of free expression covered by the 1881 Law cannot be remedied through ordinary civil liability.

Commercial disparagement (dénigrement) next. Where the criticism — however excessive — targets not the person’s honour but its products, services or performance, the case leaves the 1881 Law for ordinary civil liability (article 1240 of the Civil Code) and, between competitors, unfair competition (Cass. 1st Civ., 20 September 2012, no. 11-20.963). The distinction is anything but academic: it reverses nearly every parameter of the case. The limitation period moves from three months to five years; the 1881 formalism disappears; and the truth of the statement, a central defence in defamation, does not necessarily exonerate the disparager. For a company under attack, the threshold question is always: does the statement target the company, or its products?

Criminal Code offences, finally, which escape the 1881 Law and its guillotine: invasion of privacy and image rights (articles 226-1 and 226-2), digital identity theft (article 226-4-1), online harassment (article 222-33-2-2), publication of doctored content and deepfakes (article 226-8), false accusations to authorities (article 226-10 — five years’ imprisonment and a €45,000 fine), and, for fake reviews, misleading commercial practices under the Consumer Code. Each has its own conditions; none is time-barred after three months.

One final characterisation trap destroys entire cases: within the 1881 Law itself, defamation and insult are mutually exclusive. A writ that pleads both characterisations for the same words is void (Plenary Assembly, 15 February 2013, no. 11-14.637). You must choose — and choose correctly. Nor is the public nature of the statement a given: among persons linked by a “community of interest”, a social-media account restricted to approved followers is not a public forum (Cass. 1st Civ., 10 April 2013, no. 11-19.530). An attack in a private group is not beyond reach — it simply moves to different ground.

The price of the wrong legal basis deserves to be stated plainly: it is not dismissal, it is the nullity of the originating document. A company that had sued in civil liability the author of statements imputing malversations to it saw its writ declared void for failing to cite a provision of the 1881 Law, the formalities of section 53 being substantial to the rights of the defence (Cass. com., 26 September 2018, no. 17-15.502). And since the three-month period runs throughout, nullity usually comes with a time bar. On that boundary and its most recent decisions — including a June 2026 judgment quashed without remittal — see our dedicated analysis: companies and executives under attack.

Three months: the deadline that governs everything

Both the prosecution and the civil claim arising from press offences are time-barred after three full months (section 65 of the 1881 Law). The rule is a matter of public policy: courts raise it of their own motion. Online, the rule has been settled since 2001: time runs from the first posting of the content (Cass. crim., 30 January 2001, no. 00-83.004), a solution extended to all offences under the 1881 Law (Cass. crim., 19 September 2006, no. 05-87.230). That the content remains online for years changes nothing: the offence is instantaneous, not continuous.

The case law has drawn precise contours. The clock does not restart upon a mere website update, or the addition of a second address giving access to identical content (Cass. crim., 6 January 2009, no. 05-83.491). It does restart upon the insertion of a hyperlink pointing directly to the offending text (Cass. crim., 2 November 2016, no. 15-87.163) and upon the deliberate reactivation of a deactivated website (Cass. crim., 7 February 2017, no. 15-83.439; Cass. crim., 10 April 2018, no. 17-82.814). The effect of a mere social-media share remains debated — one more reason not to count on a second chance.

Interrupting the period requires a valid procedural act. Before proceedings are commenced, only investigative requisitions interrupt limitation, and only if — on pain of nullity — they set out and characterise the offending words (section 65, para. 2): imprecise requisitions interrupt nothing (Cass. crim., 22 June 2010, no. 09-81.027). A simple criminal complaint does not suffice; a void writ has no interruptive effect. Two exceptions extend the period: it is one year for discriminatory defamation, insult and incitement (section 65-3); and interference with the presumption of innocence is barred three months after the act of publicity (section 65-1).

This calendar dictates an immediate reflex: secure the evidence. A bailiff’s report (constat de commissaire de justice) freezes the content, its URL and its date — and it also freezes what may later serve the case: in the truth defence, the supporting evidence must relate to facts predating the defamation (Cass. crim., 23 October 2007, no. 06-87.861). For videos, a full transcript is essential: courts have declined to rule on selected excerpts. Every day counts twice — for the deadline, and for the proof.

Two further points close the remaining escape routes. First, neither the victim’s late discovery of the content nor a subsequent bailiff’s report restarts the clock: these are not new publications, merely the recording of a distribution already completed (Cass. crim., 27 November 2001, no. 01-80.134). Second, where a hyperlink does reopen the period, there is no need to prove an intention to revive the defamation: making the text available to a new audience, from a new editorial context, is enough (Cass. crim., 2 November 2016, no. 15-87.163).

Acting without a trial: notice, delisting, right of reply

Not every remedy runs through a courtroom, and the fastest are often the most neglected.

Notifying the platform changed in nature with the EU Digital Services Act (Regulation (EU) 2022/2065). Article 16 requires hosting providers to operate a precise notice-and-action mechanism: a sufficiently substantiated notice — exact URLs, statement of reasons, identity of the notifier — gives the provider actual knowledge of the content and exposes it to liability if it remains passive. The platform’s decision must be reasoned (article 17), can be challenged through an internal complaint system (article 20), and then before a certified out-of-court dispute settlement body (article 21). In France, the SREN Law of 21 May 2024 reorganised the LCEN (the digital economy statute) around this framework and created an accelerated procedure on the merits to stop harm caused by online content — a self-standing route, distinct from the 1881 Law, which courts have begun to apply.

Delisting, next. It does not remove the content: it makes it undiscoverable through a name search — which, in practice, neutralises most of the harm. The framework was set by the Court of Justice of the EU in Google Spain (13 May 2014, C-131/12): the search engine is a data controller and must, on request, remove certain links from name-based results. For data relating to criminal proceedings, delisting is the rule unless access remains strictly necessary to inform the public (CJEU, 24 September 2019, C-136/17); it operates only on the EU versions of the engine (CJEU, 24 September 2019, C-507/17); and where the content is allegedly inaccurate, the applicant must provide reasonably available evidence, without first obtaining a ruling against the publisher (CJEU, 8 December 2022, C-460/20). The French Conseil d’État applied this grid in 2019. But executives and public figures must hear this clearly: prominence and a role in public or economic life weigh against delisting in the balance with the public’s right to information. The route stays open — refusal by the engine, complaint to the CNIL, judicial review — but its outcome depends on the applicant’s exposure.

The online right of reply, finally, now anchored in article 1-1 of the LCEN since the SREN Law: free and fast, but narrow. It lets you insert your version of the facts; it does not make the attack disappear. It combines usefully with the other remedies; it replaces none of them.

The civil route: the judge of urgency

Where the platform will not act, interim relief (référé) remains the fastest weapon. On the basis of article 835 of the Code of Civil Procedure — manifestly unlawful disturbance or imminent harm — French courts order content removal and blocking, impose daily penalty payments, and award provisional damages where the obligation to compensate is not seriously disputable. Two success factors recur in practice: unimpeachable evidence (bailiff’s report, full transcript) and a narrowly targeted application — broad, imprecise requests are refused.

One decisive point is often overlooked: interim proceedings do not provide an escape from the 1881 Law. The urgency judge remains competent to stop the attack, but cannot base the decision on disparagement where the statement targets reputation rather than products. The Court of Cassation accordingly quashed a decision ordering, under penalty payment, the removal of content imputing a “fraud upon a judgment” to a company, on the basis of disparagement and manifestly unlawful disturbance (Cass. 1st Civ., 18 October 2023, no. 22-20.428). Even under time pressure, the legal basis must be right.

Against an anonymous author, article 145 of the Code of Civil Procedure allows a court, before any trial, to order the platform or host to disclose identification data. Judges grant it where the motive is legitimate and the request proportionate; they confine it to data actually retained, and enforcement becomes markedly harder against platforms established outside the EU. It is an effective route — but one that is built, not improvised: the narrower the request, the better it fares.

As for damages, they are won on the terrain of economic evidence. French courts do not compensate an alleged downturn: they require proof of causation between the attack and the loss — witness statements, accounting data, gross margin, the share of the business affected. For a content creator as for a company, the compensation file is built from day one: terminated or suspended contracts, partners’ emails, audience statistics — everything that will later connect the drop in revenue to the offending content.

The criminal route: powerful, and full of traps

The criminal route retains two assets nothing else replaces: the force of an investigation — notably to identify the author — and the weight of a conviction. It runs through three channels: the simple complaint, which triggers an investigation but does not interrupt limitation; the complaint with civil-party petition, which sets the prosecution in motion; and the direct summons, the fastest but most demanding — a deposit is required, and an abusive summons exposes the claimant to a civil fine (article 392-1 of the Code of Criminal Procedure).

Here the 1881 formalism deploys its full rigour. The originating act must, on pain of nullity, specify and characterise the offending words and cite the applicable statutory provision (section 53); it cannot plead insult and defamation cumulatively for the same words; and a void act does not interrupt limitation — so a drafting error costs twice, first the nullity, then the time bar. Since the Law of 23 March 2019, the investigating judge does not investigate the truth of the facts or good faith (section 51-1): those debates are reserved for trial.

The influencer: defending an economic asset

For a content creator, reputation is no abstraction: it is the asset that carries brand deals, monetisation and audience. The attack can be quantified — and recent French legislation has sharpened tools precisely for it.

Pile-on harassment (raid numérique) first. Since the Law of 3 August 2018, online harassment is committed by each participant in a coordinated pile-on, even where each posted only a single message: it suffices that the statements were made in concert, or successively by people who knew they formed part of a repetition (article 222-33-2-2 of the Criminal Code). Penalties rise to two years’ imprisonment and a €30,000 fine where the acts are committed online. “I only posted one tweet” protects no one anymore.

Deepfakes, next. Since the SREN Law of 21 May 2024, article 226-8 of the Criminal Code expressly punishes the publication of visual or audio content generated by algorithmic processing and depicting a person’s image or words without consent, where it is not obviously labelled as generated. The penalties — one year and €15,000 — rise to two years and €45,000 where the content is published online. Fake profiles fall under digital identity theft (article 226-4-1), where appropriate combined with privacy and image-rights claims, which French courts compensate.

Then there is the takedown video, a genre of its own. Before any action, one discipline: obtain a full transcript and a bailiff’s report covering the video, its views and its comments. Courts refuse to characterise words from selected excerpts; and it is on the whole — tone, context, factual basis — that defamation, insult or protected debate on a matter of public interest will be decided.

Dedicated analysis : Influencers under attack online: pile-on harassment, deepfakes and fake profiles.

The company and its executive: cross-fire attacks

An attack on a business rarely has a single target: the same post may impute fraud to the executive (defamation of a natural person), discredit the company (defamation of a legal person) and run down its products (commercial disparagement). Three regimes, three deadlines, sometimes three forums — in a single publication. The company sues for its own reputation; the executive has a personal claim if personally targeted; the two actions combine but never merge.

The most delicate litigation involves former employees and business partners, where free speech and whistleblower status enter the debate. The Criminal Chamber has just set the framework with remarkable clarity, in a case where a former associate had published a LinkedIn article imputing fraud and regulatory breaches to his co-associate.

The lesson cuts both ways. For the company under attack: even a self-proclaimed “whistleblower” answers for accusations he failed to verify seriously, or made to settle scores. For the executive tempted to reply in public: criticism anchored in a debate of public interest and a solid factual basis is, conversely, strongly protected. Finally, where the attack takes the form of a false report — to a professional body, a regulator, an employer — the remedy lies outside the 1881 Law altogether: false accusation (article 226-10 of the Criminal Code) carries five years’ imprisonment and a €45,000 fine, with an ordinary limitation period that leaves time to act.

Dedicated analysis : Online reviews, former employees and whistleblowers: companies and executives under attack.

Choosing the route: the decision table

No remedy is right in the abstract; each serves an objective. The table below summarises the parameters we weigh, in practice, in the first days of a case.

Frequently asked questions

Does the three-month period restart every time the content is shared?

Not as a rule: time runs from the first posting (Cass. crim., 30 January 2001, no. 00-83.004), and a mere website update changes nothing. It does restart upon a genuine new publication: a hyperlink pointing directly to the offending text (Cass. crim., 2 November 2016, no. 15-87.163) or the deliberate reactivation of a deactivated site (Cass. crim., 7 February 2017, no. 15-83.439). The effect of a simple social-media share remains debated: prudence dictates treating the initial period as the only one.

Can you act against an anonymous author?

Yes. Article 145 of the Code of Civil Procedure allows a court, before any trial, to order the platform or host to disclose the author’s identification data. The measure is granted where the motive is legitimate and the request proportionate; in practice it runs up against data-retention periods and platforms established outside the EU. The criminal route, for its part, places identification in the hands of investigators.

Is a negative review by a customer or former employee defamation?

It depends on its target and content. Criticism — however harsh — of products or services is disparagement, not defamation (Cass. 1st Civ., 20 September 2012, no. 11-20.963); the imputation of a specific dishonourable fact (fraud, embezzlement) falls under the 1881 Law; a purely subjective opinion, with no specific fact, may be neither — or may be an insult. An employee’s freedom of expression is protected unless it degenerates into abuse. The exact characterisation dictates the deadline, the forum and the outcome: it is the analysis to run before any cease-and-desist letter.

Does delisting make the content disappear?

No: it removes the link from name-based search results on the EU versions of the engine (CJEU, 24 September 2019, C-507/17), but the content remains online and reachable by other paths. It is nonetheless often the most effective practical measure, since name searches are the main vector of the harm. For an executive or a public figure, the balancing against the public’s right to information makes the outcome less certain: the application must be built accordingly.

An online reputation attack is litigation in its own right: rigorous characterisation, evidence secured without delay, and a route chosen by objective — removal, invisibility, compensation or conviction. The decisive factor is usually neither the gravity of the words nor the emotion they provoke: it is time. Three months pass quickly; evidence disappears faster still.