Online Defamation in the UK: Website Operators, Posts and Removal

Defamatory material posted on a website, a social media platform, or a review site raises questions that print publication never had to answer: who is actually responsible when a stranger, not the platform, wrote the words, and what happens when the same post sits online for years. UK law has specific rules for both, and they differ between England and Wales, Scotland and Northern Ireland, most sharply in Northern Ireland. This guide explains the framework; it is general information, not advice on a specific post or claim.

Who Is Responsible for a Post Someone Else Wrote

When a defamatory statement appears in a comment, a review, or a social media post, the most straightforward target is usually the person who wrote it. But that person may be anonymous, based abroad, or simply unknown, which is why the law also addresses the platform hosting the content.

Section 5 of the Defamation Act 2013 creates a specific defence for a website operator sued over a statement posted on the site by someone else, distinct from any defence available to the actual author. The purpose is to avoid making platforms strictly liable for millions of user posts they did not write and may not have reviewed, while still giving a claimant a realistic route to a remedy when the true author cannot be pursued.

When the Website Operator Defence Fails

The section 5 defence is not unconditional. It is defeated if all of the following apply:

• the claimant could not identify the person who posted the statement;
• the claimant gave the operator a notice of complaint that complied with the requirements set out in the Defamation (Operators of Websites) Regulations 2013 (SI 2013/3028); and
• the operator failed to respond to that notice in accordance with those regulations.

The 2013 Regulations set out the detail: what information a valid notice of complaint must contain, and the steps and timescales an operator is expected to follow once it receives one, which can include passing the complaint to the poster or removing the material. An operator that follows the regulations correctly, for instance by promptly engaging with a valid notice, can retain the defence even though the underlying post remains defamatory.

The defence is also defeated if the claimant can show the operator acted with malice in relation to the post.

One point worth stating clearly, because it surprises people: an operator that moderates its site does not lose the defence just by moderating. Actively removing spam, enforcing community guidelines, or reviewing some content before it goes live does not, on its own, convert an operator into someone treated as if they had authored every unmoderated post that slips through. The defence is defeated by the specific notice-and-response failure described above, or by malice, not by the general fact that moderation happens.

Suing the Poster or Notifying the Platform

In practice, this creates two broad routes, and which one makes sense depends heavily on the facts:

• Suing the original poster. This directly targets the person responsible for the statement, but only works if that person can be identified and is realistically within the jurisdiction of the UK courts, or the case otherwise satisfies the non-domiciled-defendant filter in the Defamation Act 2013.
• Notifying the platform under section 5. This is often the more realistic option when a poster is anonymous or cannot be traced. It does not itself produce compensation from the platform in most cases if the platform follows the regulations correctly, but it can lead to the content being taken down, which is frequently the outcome someone actually wants.

These are not mutually exclusive, and the right combination depends on the specific circumstances, including how the statement is causing harm and how quickly a remedy is needed.

The Single Publication Rule and Why It Matters Online

Online material is different from a newspaper article in one important respect: it typically stays accessible indefinitely, and can be viewed, shared, or downloaded long after it was first posted. Without a special rule, each new view could arguably count as a fresh publication, restarting the limitation clock indefinitely and exposing operators and authors to claims over years-old material.

Section 8 of the Defamation Act 2013 addresses this with the single publication rule: where a person publishes a statement, and later publishes the same or a substantially similar statement, the one-year limitation period under the Limitation Act 1980, s.4A, generally runs from the date of the first publication, not the later one. The exception is where the later publication is in a manner that is materially different from the first, in which case a fresh limitation period can start.

This matters directly for archived articles, older social media posts, and search-indexed pages: their continued accessibility does not, by itself, keep restarting the clock. It also does not remove the court's separate discretion under s.32A to allow a late claim in appropriate circumstances.

After a Judgment: Removal Orders

Winning a claim does not automatically make defamatory material disappear. Section 13 of the Defamation Act 2013 gives the court power, after judgment, to order a website operator to remove the statement, or to order a distributor to stop distributing material that contains it. This is a targeted, court-backed route to takedown that sits alongside, and is more concrete than, simply asking a platform informally to remove content.

Scotland: A Separate Act

Sections 5, 8, 10 and 13 of the Defamation Act 2013 apply in England and Wales only. Scotland has its own framework in the Defamation and Malicious Publication (Scotland) Act 2021, and it works differently.

Instead of a section 5 notice procedure, section 3 of the 2021 Act generally stops defamation proceedings being brought against anyone who is not the author, editor or publisher of the statement, or an employee or agent of one of them responsible for its content. A person whose only involvement with an online statement is sharing it or providing a means to access it, such as a hyperlink, without altering it is not treated as its editor, provided that involvement does not materially increase the harm.

Section 30 lets a Scottish court in defamation proceedings order a website operator to remove a statement or to display a notice that it is subject to the proceedings, and order a distributor to stop distributing it. Section 32 sets a one-year limitation period with its own single publication rule: where the same person publishes a statement to the public and later republishes the same or a substantially similar statement, a claim over the later publication is treated as arising on the date of the first, unless the manner of the later publication is materially different.

Northern Ireland: A Genuinely Different Position

Anyone assuming the rules above apply UK-wide should stop and check, because Northern Ireland's defamation law diverges sharply on exactly this point. The Defamation Act (Northern Ireland) 2022 does not include a website-operator defence equivalent to section 5, and it does not include a single publication rule equivalent to section 8. Nor does it have an equivalent of section 10, which in England and Wales limits claims against anyone other than the author, editor or publisher, or of the section 13 power to order removal of a statement.

The practical consequence is significant: Northern Ireland retains the older multiple publication rule, under which each fresh access, download, or view of a statement can, in principle, give rise to a new cause of action with its own limitation period, rather than the clock running only from first publication. Combined with the absence of a website-operator defence, this leaves platforms and authors more exposed in relation to material accessed in Northern Ireland than in England and Wales. A review carried out by Northern Ireland's Department of Finance concluded, in a report published in summer 2024, that it was too soon to legislate further on these points, meaning the divergence is presently a deliberate, reviewed policy position rather than an oversight likely to be corrected imminently.

For the fuller picture of Northern Ireland's defamation regime, see the site's dedicated Northern Ireland defamation laws page.

Defamation and Data Protection: Related, Not the Same

A defamatory post about someone is also, almost always, their personal data. That overlap means a complaint sometimes has a second possible route: a request or complaint under UK data protection law rather than, or alongside, a defamation claim.

These are genuinely different legal frameworks with different tests, different regulators, and different remedies. A defamation claim is about a false statement harming reputation; a data protection complaint, such as a request to have search results or personal data delisted or erased, is about the handling of personal data and does not require proving the material is false or defamatory. But in some situations, particularly involving old or search-indexed material, they can lead to a similar practical outcome, such as content becoming harder to find or being removed. Readers dealing with old or persistent search results about themselves may find the site's guide to the right to be forgotten in the UK a useful complementary route to explore alongside, not instead of, specialist legal advice on defamation.

Getting Advice

Online defamation cases often turn on details, such as exactly what notice was given to a platform, when material first appeared, and whether a later repost counts as materially different, that are easy to get wrong without legal training. Anyone dealing with a specific defamatory post, whether as the person affected or as an operator who has received a complaint, should get advice from a solicitor before deciding how to respond. This guide cannot assess an individual case and is not a substitute for that advice.

This guide explains the general framework for online defamation in the UK. It is not legal advice on a specific post, complaint, or claim, and anyone facing an actual dispute should get advice from a solicitor before acting.

Frequently Asked Questions

Can I sue a website for something a user posted about me?

You can try, but section 5 of the Defamation Act 2013 gives website operators a defence in England and Wales when they are sued over user-generated content. The defence is defeated only if you could not identify the poster, you served a compliant notice of complaint under the 2013 Regulations, and the operator failed to respond correctly, or if the operator acted with malice.

Does moderating a website remove its legal protection?

No. Moderating content, such as removing spam or enforcing community guidelines, does not by itself defeat the section 5 defence. The defence is defeated by a specific notice-and-response failure or by proof of malice, not by the general fact that moderation takes place.

Should I sue the person who posted something or go after the platform?

It depends on whether the poster can be identified and is realistically within reach of the UK courts. If they cannot be traced, notifying the platform under the section 5 procedure is often the more realistic route, particularly where the goal is to get the content removed.

Does the limitation clock restart every time an old post is viewed?

Generally no, in England and Wales. The single publication rule in section 8 of the Defamation Act 2013 means the one-year limitation period usually runs from the first publication, not from every later view, unless a later republication is materially different from the original.

Is Northern Ireland's online defamation law the same as England and Wales?

No, and the difference matters. Northern Ireland has no website-operator defence and has kept the multiple publication rule, so accessing material there can create a fresh cause of action each time, unlike the single publication rule that applies in England and Wales.

Can a court force a website to take down defamatory content?

After a claimant wins a case, section 13 of the Defamation Act 2013 lets the court order a website operator to remove the statement or a distributor to stop distributing it.

Is a defamation claim the same as a data protection complaint about a post?

No, they are different legal routes with different tests. A defamation claim concerns a false statement harming reputation, while a data protection complaint concerns the handling of personal data. They can sometimes reach a similar practical outcome, such as removal of content, but one does not substitute for the other.