Reputation management in the United States: route map

Reputation management in the United States is not one law and not one court. It is a set of separate routes: state defamation law for false statements, state privacy law and public-record rules for personal information, a federal credit-reporting statute for background checks, a new federal duty for platforms on intimate images, and each platform's own rules for everything else. A federal statute, Section 230, also means that the site hosting a post is usually not the one you can sue for it.

So the skill is sorting the problem before you write to anyone. A false post by a stranger, an accurate but unflattering news story, a home address on a people-search site, an old item in a background report and a nude image shared without consent each have a different first move in the US, and the wrong first move can cost money or make things louder. This guide is that sorting map for a reader in the United States, with the clocks and limits that we could confirm.

This is information, not legal advice. Defamation, privacy torts and anti-SLAPP rules are mostly set state by state, facts decide cases, and your own attorney in the right state decides what applies to you. Federal statutes and agency pages were read directly for this guide; where a state rule or a source could not be read, the text says so rather than guess.

48 hourstime a covered platform has to remove a reported intimate image and known identical copies after a valid request

45 daystime a business has to respond to a California request to delete, correct or know, extendable once by another 45

7 yearsreporting limit for most adverse items in a consumer report, with 10 years for bankruptcies

FTC guidance on the TAKE IT DOWN Act; California Attorney General CCPA page; 15 U.S.C. 1681c(a), as read on the agency and Cornell Legal Information Institute pages. The credit-report limits have exceptions for large credit, insurance and high-salary jobs.

Which US route fits which reputation problem

Each row below names one first route and the main reason it fails. The right-hand column matters most: in the US, the most common mistake is using a route built for a different kind of content.

Related readUAE Defamation Law Online: Claim, Complaint, Limits

Read the table by the content, not by how upsetting it is. Two equally damaging posts can sit in different rows, and a route that works for one will not move the other.

Defamation in the US is state law, so the state decides

Defamation means a false statement of fact, published to others, that harms someone's reputation. That is the general idea everywhere in the US, and the details are set by each state: what counts as a statement of fact rather than opinion, which categories of statement are treated as harmful in themselves, how fault is judged, whether a retraction request is required or reduces damages, and how long you have to sue.

We did not read a state statute or court decision for this guide, so we state no limitation number and no state test. That is deliberate. Limitation periods for defamation are short in many places, and a number from the wrong state is the most expensive error in this field. Ask an attorney licensed in the state where you live or where the author lives, on day one, what the clock is and when it started.

Two practical questions do most of the sorting before any lawyer is paid. Is it a statement of fact that can be proved false? "She took the deposit and never did the work" is checkable; "she is the worst contractor in town" is opinion, and a letter about it usually fails. And is it true, or substantially true? If the core is accurate, the claim is weak however badly it reads. Whether you count as a public figure also changes the fault standard, and that is a legal question, not a feeling.

Related readGDPR Right to Erasure Exceptions: When Refusal Is Lawful

A claim against an anonymous author has an extra step, because the court has to be asked to identify the person. That is a legal procedure with its own state rules and costs, and it only makes sense when the statement is clearly false, clearly harmful and clearly actionable. Before taking it, ask whether a platform report would stop the harm at lower risk.

Section 230: why the platform is usually not the one you pursue

Section 230 of Title 47 of the US Code is the reason a lawyer's letter to a forum host about a user's post so often goes nowhere. Section 230(c)(1) says that no provider or user of an interactive computer service is to be treated as the publisher or speaker of information provided by another information content provider. Section 230(c)(2) protects good-faith voluntary action to restrict access to material the provider considers objectionable. In outline, a site that hosts a user's post is generally not liable for it as the author is, and can still remove content under its own rules.

The definition does quiet work. An information content provider is any person or entity responsible, in whole or in part, for the creation or development of the information, as defined in section 230(f)(3). A site is not shielded for material it helped create. A site that merely displays a stranger's post is a different case.

What Section 230 leaves outside its shield

Section 230(e) lists exceptions. Nothing in the section impairs enforcement of certain federal criminal statutes. Nothing in it limits or expands any law pertaining to intellectual property, which is why a copyright notice can work against a site where a defamation claim cannot. It does not limit the Electronic Communications Privacy Act or similar state laws, and it leaves certain sex-trafficking claims open. States may enforce consistent state laws, but no liability can be imposed under a conflicting state or local law.

Related readDefamation law France: claim, proof and the clock

The practical reading for reputation work: if the problem is a photograph you took and someone reposted, you have a copyright route. If the problem is a false sentence by a stranger, the platform's rules are your first lever and the author is the legal target.

Anti-SLAPP: the risk on the sender's side of the letter

A SLAPP is a lawsuit filed mainly to burden someone for speaking on a matter of public concern, and anti-SLAPP statutes let a defendant ask a court to dismiss such a claim early and, in many versions, to recover costs. Anti-SLAPP protection is mostly a matter of state law, and the states differ in how broadly they define protected speech, how fast the motion must be filed, and whether fees are awarded. We could not read a state statute for this guide, so we do not say which states have one.

What follows is true as a risk rule whichever state you are in. If you sue over a review, a news story, a complaint about a business or a post on a matter other people care about, ask your attorney early whether an anti-SLAPP motion is available to the other side and what it would cost you if you lost. The cost can exceed the harm you were trying to stop.

Privacy torts and public records: what you can and cannot recall

Many states recognize some of four traditional privacy claims: intrusion into private affairs, public disclosure of private facts, false light, and use of a person's name or likeness. Which of the four a state accepts, and how it defines them, differs from state to state, and we did not read a state source for this guide. The category that matters most to reputation is disclosure of private facts, and it comes with a hard limit: information that is already public, or of legitimate public concern, is a poor basis for a claim.

Related readGermany defamation online: claims, crime, takedown

So the US has no general right to have accurate information removed because it is old or embarrassing. Court filings, property records and news reports about public events are generally treated as public. The routes that do work are narrower:

• Platform and publisher policy, where many publishers have an update process and platforms remove doxxing and harassment.
• Record-level remedies, where a court sealed, expunged or corrected a record and the source and aggregators must be updated. The rules are state specific and not read for this guide.
• Opt-outs for data brokers and people-search sites, which are voluntary, backed in some states by privacy statutes.

State privacy laws: California as the worked example

The US has no single federal consumer privacy statute. A growing number of states have passed their own, and the rights differ in detail. We read the California Attorney General's page on the California Consumer Privacy Act and use it as the example. We did not read other states' laws, so check your own state's statute.

As that page describes it, California residents can ask a business what it has collected about them, to delete it, to correct it, and to opt out of its sale or sharing. Businesses have 45 calendar days to respond to requests to know, delete and correct, extendable by another 45 days if they notify you, and no more than 15 business days to act on an opt-out request.

The limits are the point for reputation work. The page says the law excludes publicly available information from government records, such as property records, and exempts consumer credit reporting information. A deletion right reaches data a business collected from you, not a news story or a stranger's post.

The FCRA: when your reputation sits in a background report

If the damage comes from an employment screening, tenant screening or credit report rather than from a web page, the Fair Credit Reporting Act is the relevant federal law, and it does something rare in the US: it puts a time limit on how long certain accurate information can be reported. Section 1681c(a) of Title 15 sets the periods. Bankruptcy cases cannot be reported after more than 10 years. Civil suits, civil judgments and arrest records cannot be reported after seven years, or until the governing statute of limitations has expired if that is longer. Paid tax liens run seven years from payment, accounts placed for collection or charged to profit and loss seven years, and other adverse information seven years, with records of criminal convictions excluded from that last category.

Related readIndia Defamation Online: Claim, Clock and Takedown

Section 1681c(b) says those limits do not apply to reports used for a credit transaction of $150,000 or more, underwriting life insurance with a face amount of $150,000 or more, or employment at an annual salary of $75,000 or more. So a high-salary role can see items an ordinary job screening cannot.

Two points follow. First, an item that is inaccurate, or older than its limit, is something you can dispute with the reporting agency, and that is a more reliable US route than any web takedown. The dispute procedure itself sits in section 1681i, which we could not read for this guide, so use the agency's dispute form and the FTC's consumer pages for the steps. Second, the FCRA governs consumer reports, not search results: a news story that mentions an old case is not a consumer report and does not expire under these rules.

The TAKE IT DOWN Act and the platform routes

For intimate images shared without consent, including images that were digitally created or altered, there is a federal platform duty. The Federal Trade Commission's business guidance says the TAKE IT DOWN Act requires covered platforms to set up a process for victims to request removal of intimate photos or videos, and the platform-duty section takes effect on May 19, 2026. When a platform receives a valid request, it must remove the content and make reasonable efforts to remove known identical copies within 48 hours. The FTC enforces the Act, and the guidance says it covers digital forgeries, meaning images created or altered with software, an app or artificial intelligence.

Related readDefamation law South Africa: claim, defenses, clock

Three limits matter. The FTC pages we read do not define what makes a request valid, so follow the platform's own removal form and keep a record of what you sent and when. The Act's criminal provisions could not be read in this session, because the congress.gov page was not available to us, so we say nothing about them here. And the duty covers intimate content: it is not a route for an insulting post, a false review or an unflattering photo. For platform reports in general, quote the exact rule broken and attach the URL: that is more likely to be acted on than a general complaint. For leaked or intimate content, our leak removal page explains how a case is run.

The right order of operations, with an invented scenario

The order is the part that most people get wrong. A reliable sequence moves from the lowest-risk route to the highest, and sets the legal clock at the start rather than the end.

1. Preserve and sortCapture the URL, date and full page before anything changes, and do not reply in public. Then mark each page as false statement, accurate but unwelcome, personal data, background-report item or intimate image.
2. Set the legal clockAsk an attorney in the right state what the defamation clock is and when it began, and whether anti-SLAPP exposure exists.
3. Use the platform or publisher routeFile reports under the exact rule broken, or ask the editor for an update with evidence.
4. Use the statutory or commercial requestSend privacy requests, data broker opt-outs, FCRA disputes or the TAKE IT DOWN request where it fits.
5. Decide on a letter or a claimOnly for a clear false statement of fact where the lower-risk routes failed, and only after the anti-SLAPP check.
6. Strengthen accurate pagesPublish accurate profiles and pages you control, so what searchers and AI assistants find first is complete.

Here is an invented scenario with generic parties and stated assumptions. A self-employed contractor in a US state finds three things: an anonymous forum post claiming she took deposits and vanished, which is false; her home address on two people-search sites; and an old civil judgment, now paid, on a tenant-screening report. Assume no court order exists and that all three were found on the same day.

The timings are ranges from experience, not promises. The one fixed point is the legal clock, which is why it is set first.

What US law will not do, and the tactics that backfire

Some outcomes are not available in the US, and a route that promises them should be treated with suspicion.

Related readOnline Harassment Laws by Country: Where Each Route Leads

• Removal of accurate, lawful reporting. The US has no general right to be forgotten that removes accurate news because it is old. A publisher may update or unpublish at its own discretion, and a request that makes the story look suppressed can become a second story.
• Removal of public records through a privacy request. State privacy statutes tend to exempt publicly available information.
• Fake reviews, fake profiles or paid manipulation. These breach platform rules and, depending on the facts, consumer-protection law, and they can turn a recoverable problem into a permanent one. We do not recommend them.

A court order against an author does not itself change what a search engine lists: search engines and AI assistants decide on their own. Suppression is the technical word for that last route: it moves accurate, better content above results you cannot remove, and it never changes the original page.

Your next step: sort first, then pick one route

Before contacting anyone, write each problem on one line and mark its type from the first table. Then act on the lowest-risk route for each, and ask an attorney about the clock and anti-SLAPP exposure before you send any legal letter. Reputation Partners works through that sorting on private audits, and the first output is the same table, filled in for your own file.

Questions people ask

Can I get a news article removed in the United States?

There is no general right to have accurate reporting removed. You can ask the publisher to correct a factual error, add an update or, in some cases, consider unpublishing, and decisions rest with the editor. A claim in court needs a false statement of fact, and it carries state-specific clocks and anti-SLAPP risk. A lawyer should check both first.

Can I sue a website for a defamatory comment?

Usually the claim lies against the person who wrote the comment, not the site. Section 230 says a provider of an interactive computer service is not treated as the publisher of information provided by another content provider. Exceptions exist, including for material the site helped create, but they are narrow. A report under the site's own rules is the usual first move.

Is there a US law like the right to be forgotten?

Not as a general federal right. The US has narrower tools: credit-report limits under the FCRA, state privacy statutes such as California's, platform and publisher policies, and removal duties for intimate images. Which applies depends on the content type. Public records and accurate news are usually outside these rights.

What does the TAKE IT DOWN Act actually require?

According to the FTC's guidance, covered platforms must provide a process for victims to request removal of intimate photos or videos, and must remove the content and known identical copies within 48 hours of a valid request. It covers digitally created or altered images. It does not cover ordinary embarrassing or false content.

How long do old items stay on a background check?

Under 15 U.S.C. 1681c(a), most adverse items cannot be reported after seven years and bankruptcies after more than 10, with civil suits, judgments and arrest records governed by the longer of seven years or the statute of limitations. Convictions are excluded from the general seven-year category, and large credit, insurance or salary thresholds lift the limits.

Do state privacy laws let me delete things about me from the internet?

They let you ask businesses to delete data they collected from you, and in some states to correct it or stop its sale. They generally do not reach public records, news stories or posts by other people. California's page gives businesses 45 days to answer a deletion request, extendable once by another 45.