Online reputation management guide

Online reputation management (ORM) is the cross-disciplinary work of measuring, protecting, correcting and building how a person or an organisation is perceived across search engines, review platforms, social media and the answers of super intelligence assistants. Law, SEO, content, public relations, customer experience, analytics and crisis communication all belong to the same plan.

This guide separates online reputation management from “link deletion”. Removal is the narrowest and slowest branch of reputation work and is only possible where content is unlawful or breaches a platform policy. Lasting results come from managing legal removal, suppression, asset building, review management, crisis readiness, SI visibility and measurement together. Webtures calls this whole reputation architecture.

The guide covers the legal framework in Türkiye, the European Union, the United Kingdom and the United States, platform-by-platform request routes from Google to Ekşi Sözlük, fake review attacks, crisis protocols and how systems such as ChatGPT, Gemini and Google AI Overviews form an answer about a brand. The legal sections are general information, not legal advice; for a specific case, speak to your lawyer. Legislation and platform references were checked against official sources as of 20 October 2026.

What is online reputation management?

Online reputation management is the continuous work of making sure that what people find when they search for a brand or a person, and what they read in digital conversations, is accurate, current and balanced. The goal is not to erase every negative item. The goal is to remove unlawful content through legitimate routes, rebalance content that is disproportionately prominent and make accurate information easy to find.

ORM works across four layers that feed each other. A brand with strong, accurate sources in the search layer is more likely to get accurate answers in the machine layer, because SI systems that search the live web draw largely on the same sources.

Removal, suppression and building: the difference

Reputation work uses three forms of intervention. They are not alternatives; they run as parallel tracks in the same case.

• Removal: taking content down at the source, from a search engine or from a platform on a legal ground or for a policy breach. With the right ground it is the most durable method, but also the slowest and least predictable.
• Suppression: the content stays where it is, while more accurate and more useful results outrank it in brand searches. Effects show relatively quickly, but they are not permanent and need ongoing maintenance.
• Building: the brand tells its own story through owned assets and independent third-party sources. It is the slowest and most resilient method, and the one that matters most in the machine layer.

Where is the ethical line?

Removal is only used where there is unlawfulness or a platform policy breach. An accurate, current news story that a client dislikes is not a removal case. Suppression is used to rebalance information that is wrong, outdated or disproportionately prominent, not to hide accurate information. Building never involves exaggeration, fake testimonials or fake reviews. These three sentences are the first filter Webtures applies before accepting a reputation case.

Is personal reputation the same as corporate reputation?

No, but most cases manage both. Personal reputation centres on name searches, data protection and the right to be forgotten. Corporate reputation centres on brand searches, review platforms, employer brand and crisis communication. Content about a founder or senior executive often affects the company as well. For SI-specific aspects of brand reputation, see our article on SI reputation management.

Reputation management maturity model

The maturity model describes how prepared an organisation is for reputation risk on six levels. The level depends on whether processes are written down, owned and repeatable, not on budget. To move up a level, the work of the previous level has to become routine.

Reputation architecture: a seven-component approach

Webtures is a digital consultancy that has worked on search visibility and GEO/AEO from Istanbul and London for 16 years. The most common mistake we see in reputation cases is investing in a single track: only sending removal requests, or only producing content. Reputation architecture runs seven components on the same calendar:

1. Legal removal: source, search engine and platform requests for content with a valid ground, run together with a lawyer.
2. Suppression: increasing the share of accurate, useful results on the first page of a brand search.
3. Asset building: the corporate site, newsroom, executive profiles, independent coverage and verified profiles.
4. Review management: legitimate review requests, reply discipline and evidence-based appeals against fake review attacks.
5. Crisis readiness: severity levels, approval flow, ready statements and drills.
6. SI visibility: tracking how ChatGPT, Gemini, Perplexity and Google AI Overviews describe the brand, and fixing the sources behind the answers.
7. Measurement: reporting every component on one dashboard with before-and-after evidence.

This approach does not guarantee outcomes; no legitimate method can guarantee that content will be removed. What it delivers is a defensible decision on which route fits which content, and measurable progress. The service scope is described on our online reputation management services page.

How do you assess your level?

Once a year, score six dimensions from 1 to 5: monitoring coverage, removal capability (legal and platform), content and suppression strength, review management, crisis readiness and SI visibility. The lowest-scoring dimension is next year’s first investment priority. Score only processes you can evidence; “we do it but it is not written down” counts as one level lower.

The legal framework for online reputation management

This is not legal advice. This section is an operational map of the legal routes that exist in reputation cases. Every case is different; speak to a specialist lawyer before filing a request or a claim. References were checked against official sources as of 20 October 2026; legislation can change.

The legal route in online reputation management depends on where content is published, who it is about and which right it infringes. In Türkiye, data protection, personality rights and press law decide; in the EU, the GDPR and the Digital Services Act; in the UK, the Defamation Act 2013 and the UK GDPR; in the US, Section 230, the DMCA and FTC rules.

Türkiye: KVKK, Law 5651, the Press Law and personality rights

Article 9 of Law 5651 no longer exists. For years the most common route was Article 9, which let a person claiming a personality-rights breach obtain an access-blocking or content-removal order from a criminal judgeship of peace. The Constitutional Court annulled the whole article by its decision of 11 October 2023 (E.2020/76, K.2023/172). The decision was published in the Official Gazette on 10 January 2024 and took effect nine months later, on 10 October 2024. The Court had already found in its Keskin Kalem Yayıncılık judgment (27 October 2021) that the regime structurally caused violations of freedom of expression. As of 20 October 2026 no replacement article is in force; bills are pending before Parliament’s Digital Media Committee (Constitutional Court decision, current text of Law 5651).

Routes in use today. For personality-rights breaches the main route is a claim under Articles 24-25 of the Turkish Civil Code to prevent, stop and declare the attack unlawful, combined with an interim injunction under Article 389 onwards of the Code of Civil Procedure; non-pecuniary damages fall under Article 58 of the Code of Obligations. For content that breaches private life, Article 9/A of Law 5651 remains in force: the request goes to the administration, which acts within four hours, the measure goes to a criminal judgeship of peace within 24 hours and the judge decides within 48 hours. Article 8 covers access blocking for a list of specified crimes. Law 7590, in force since 31 July 2026, transferred the administrative functions under Law 5651 from the Information and Communication Technologies Authority (BTK) to the Cyber Security Directorate; check the current application channel before filing.

Direct requests to social networks. Social network providers with more than one million daily users from Türkiye must answer user requests within 48 hours under Additional Article 4 of Law 5651. Under Law 7578, from 1 November 2026 this duty extends from personality-rights and privacy requests to all user requests (Official Gazette, 1 May 2026).

Right to be forgotten. The Court of Cassation’s Assembly of Civil Chambers defined the right to be forgotten in its decision of 17 June 2015 (E.2014/4-56, K.2015/1679), grounding it in Article 24 of the Civil Code and Article 20 of the Constitution. In the N.B.B. application (No. 2013/5653, 3 March 2016) the Constitutional Court held that keeping an outdated news story accessible violated the right to honour and reputation (N.B.B. decision). The 2020 provision added to Article 9, which allowed a judge to order that a name not be associated with URLs, fell with the article and has not applied since 10 October 2024. For search engines, data protection law is now the most practical route.

KVKK and search engines. According to Personal Data Protection Board decision 2020/481 of 23 June 2020, search engines are data controllers: the person first applies to the search engine and, if unsuccessful, complains to the Board, which balances the person’s rights against the public’s right to information using criteria annexed to the decision (Board decision 2020/481). The Authority covers the topic in detail in its April 2025 booklet on the right to be forgotten (KVKK publication). Its summary decision 2020/927 adds that claims that a news story is untrue belong before the courts, not the Board.

KVKK Articles 11, 13 and 14. Data subjects can learn whether their data is processed, request information, ask for correction, ask for erasure or destruction when the statutory conditions are met, ask for these actions to be notified to third parties who received the data, object to adverse outcomes produced solely by automated analysis and claim compensation for unlawful processing. The controller must conclude the request within 30 days and, as a rule, free of charge (Art. 13). A person whose request is refused, answered inadequately or not answered in time may complain to the Board within 30 days of learning the answer and in any event within 60 days of the request; applying to the controller first is mandatory (Art. 14). Source: Law No. 6698.

Press Law Article 14: right of reply and correction. Since Law 7418, online news sites fall within the definition of periodicals. A person whose personality rights are harmed or about whom untrue statements are published can send a reply and correction within two months of publication. Daily publications must print it within three days; online news sites within one day, with a link to the story. If it is not published, the person can apply to a criminal judgeship of peace within 15 days, and the judge decides within three days without a hearing (Press Law No. 5187). The route does not remove content, but readers see the other side in the same place, and it is often faster than a long lawsuit.

Criminal provisions. The Turkish Criminal Code provisions most often seen in reputation cases are insult (Art. 125; committing it publicly increases the penalty), violation of privacy (Art. 134), unlawfully disclosing or obtaining personal data (Art. 136), blackmail (Art. 107), publicly disseminating misleading information (Art. 217/A) and offences against IT systems (Arts. 243-244). Turkish law does not define a separate offence for sharing intimate images without consent; such cases are assessed under the privacy and personal data provisions (Turkish Criminal Code No. 5237).

Fake consumer reviews. An amendment to the Regulation on Commercial Advertising and Unfair Commercial Practices, published on 1 July 2026 and in force since 1 August 2026, allows only buyers of a product or service to post reviews online, bans publishing reviews from channels where the purchase cannot be verified, requires reviews to stay online for at least a year without filtering positive from negative, and bans agreements or services to produce untrue reviews (Official Gazette, 1 July 2026).

Criminal records and published judgments. Criminal records are archived and deleted under the conditions and periods of the Criminal Records Law No. 5352 (Arts. 9 and 12). That process is not the same as removing a news story or a judgment published online; the latter can only be addressed through data protection, personality-rights and search engine requests. A “court record removal” offer that ignores this distinction is a promise that cannot be kept.

European Union: GDPR, DSA and CJEU case law

GDPR Article 17, right to erasure. Erasure can be requested where the data is no longer necessary, consent is withdrawn and there is no other legal ground, the person objects, the data was processed unlawfully, erasure is a legal obligation or the data was collected for information society services offered to a child. The right is not absolute: freedom of expression and information, legal obligations, public health, archiving and research, and legal claims are exceptions (Art. 17(3)). The controller replies within one month, extendable by two further months for complex or numerous requests (Art. 12(3)), and the person may complain to a supervisory authority (Art. 77). Source: GDPR (Regulation 2016/679).

Google Spain (C-131/12, 13 May 2014). The Court of Justice held that a search engine operator is a controller and that a person can, under certain conditions, ask for name-search results linking to third-party pages to be removed even where the publication itself is lawful. The person’s role in public life can tip the balance towards the public’s right to information (C-131/12).

Google v CNIL (C-507/17, 24 September 2019). EU law requires de-referencing on the versions of the search engine for all Member States, not on all versions worldwide. The operator must take measures that effectively prevent, or at least seriously discourage, EU users from reaching the removed links. The Court added that EU law does not prohibit a national authority from ordering worldwide de-referencing after balancing the rights (C-507/17). A vendor’s promise of “worldwide deletion” is therefore not something that happens by itself.

GC and Others (C-136/17, 24 September 2019). Special categories of data and information about criminal proceedings are protected in search engines too. Even where a link stays, the operator must order results so that they reflect the person’s current legal position, with up-to-date links first (C-136/17). This is directly useful in cases ending in acquittal or discontinuance.

TU and RE v Google (C-460/20, 8 December 2022). A person claiming that information is manifestly inaccurate must show it with evidence that can reasonably be required of them; they do not need a court decision before applying to the search engine. Where sufficient evidence is provided, the operator must grant the request (C-460/20).

Digital Services Act Article 16, notice and action. Since 17 February 2024 all hosting services must offer a mechanism to report illegal content. A valid notice contains a substantiated explanation of why the content is illegal, its exact location such as the URL, the notifier’s name and email, and a statement of good-faith belief that the notice is accurate and complete. Restrictions come with a statement of reasons (Art. 17). The free internal complaint system (Art. 20), out-of-court dispute settlement (Art. 21), trusted flaggers (Art. 22) and measures against frequent manifestly unfounded notices (Art. 23) apply to online platforms. Source: DSA (Regulation 2022/2065).

EU AI Act Article 50. The duty for deployers to disclose that deep fake content was artificially generated or manipulated has applied since 2 August 2026. The amending Regulation 2026/1744, adopted in July 2026, gave generative systems placed on the market before that date until 2 December 2026 to meet the machine-readable marking duty, and added a new ban on systems that generate non-consensual intimate images, applying from 2 December 2026 (Regulation 2024/1689, Regulation 2026/1744).

Fake review ban. Provisions added to the Unfair Commercial Practices Directive by Directive 2019/2161 have, since 28 May 2022, treated submitting or commissioning fake consumer reviews, and claiming that reviews come from real consumers without reasonable checks, as unfair in all circumstances (Directive 2019/2161).

United Kingdom: Defamation Act 2013 and UK GDPR

Serious harm threshold. In England and Wales a statement is defamatory only if it has caused or is likely to cause serious harm to reputation; for a body trading for profit, serious harm means serious financial loss (s.1). Courts have jurisdiction over a person who is not the author, editor or publisher only if it is not reasonably practicable to sue the primary party (s.10), and after judgment a website operator can be ordered to remove the statement (s.13). Source: Defamation Act 2013.

Website operator defence (s.5). An operator that did not post the statement loses the defence if the claimant could not identify the poster, sent a valid notice of complaint and the operator failed to follow the regulations. Under the Defamation (Operators of Websites) Regulations 2013, the operator passes a valid notice to the poster within 48 hours, and the poster has until the end of the fifth day to respond. If the poster cannot be contacted, does not respond or agrees to removal, the content is removed within 48 hours. Weekends and bank holidays do not count towards the 48 hours.

UK GDPR. The erasure grounds largely mirror the GDPR; since 31 March 2026 an additional ground covers data processed because of a malicious person’s allegation that was investigated and closed with no further action. The response period is one month, extendable by two; under the Data (Use and Access) Act 2025 the clock starts at the latest of receipt of the request, any requested identification or any fee. Since 30 September 2026 the UK’s data protection regulator is the Information Commission, which succeeded the ICO.

Intimate images and fake reviews. Sharing, or threatening to share, an intimate photograph or film without consent has been an offence under s.66B of the Sexual Offences Act 2003 since 31 January 2024; since 6 February 2026, creating a purported intimate image of an adult without consent is also an offence (s.66B). Since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 has banned commissioning fake reviews, concealing incentivised reviews, suppressing negative reviews and publishing reviews without reasonable steps to prevent fake ones (Schedule 20).

United States: Section 230, DMCA and the FTC rule

Section 230 (47 U.S.C. §230). An online service provider is not treated as the publisher of content provided by someone else and is not liable for good-faith moderation. Federal criminal law and intellectual property law fall outside this protection (47 U.S.C. §230). In practice, US platforms generally cannot be forced to remove allegedly defamatory content; removal decisions rest largely on their own rules.

DMCA §512. A copyright notice must include a signature, identification of the work and of the infringing material, contact details, a good-faith statement and an accuracy statement under penalty of perjury. A person who knowingly materially misrepresents infringement can be liable for damages, costs and attorneys’ fees (§512(f)). After a counter-notice, the material is restored within 10 to 14 business days unless the claimant files suit (17 U.S.C. §512). Using the DMCA to remove content without a copyright claim is therefore both an ethical and a legal risk.

Defamation standard. Under New York Times v. Sullivan (1964) a public official can recover damages for a false statement about official conduct only by proving “actual malice”, meaning knowledge of falsity or reckless disregard for the truth (376 U.S. 254). For US-sourced content, the legal route is therefore often slower than suppression and building. Expungement or sealing of US criminal records varies by state and requires a court order; no private company can sell it as a service.

FTC fake review rule (16 CFR Part 465). In force since 21 October 2024, the rule bans fake reviews and testimonials, buying reviews for a particular sentiment, undisclosed insider reviews, presenting a company-controlled review site as independent, suppressing reviews through groundless threats or intimidation, and buying or selling fake social media indicators (16 CFR Part 465).

TAKE IT DOWN Act (Pub. L. 119-12, 19 May 2025). The Act made it a crime to knowingly publish non-consensual intimate depictions, including digital forgeries. Covered platforms had to set up a notice-and-removal process by 19 May 2026, remove content within 48 hours of a valid request and make reasonable efforts to remove known identical copies (Pub. L. 119-12).

Which route for which content?

How removal methods differ

The strategic rule: try the most durable, lowest-risk route first and start suppression and building in parallel. Investing in a single route both slows things down and creates dependency on one vendor.

Evidence standard

Every case uses the same evidence set, shared across legal proceedings, platform reports and reporting.

1. URL and timestamp: screenshot, full-page PDF and an independent web archive record; where needed, notarised or expert evidence.
2. Content text: with publication date, publisher and author.
3. Spread map: which sites, languages and accounts carry the same content.
4. Evidence of harm: measurable effects such as traffic, conversion, customer or contract loss.
5. Source information: domain registration (RDAP) data, hosting provider, account history.
6. Correspondence log: requests to the site and platform, replies and reasons for refusal.

Platform-by-platform removal handbook

Each platform assesses content under its own rules and local law; none gives a vendor the power to “guarantee removal”. This section summarises, platform by platform, on what grounds and through which official channel you can make a request, and what to watch for. It relies on the platforms’ help pages live as of 20 October 2026; apart from figures the platforms publish themselves, no timing or success-rate estimates are given.

Google Search

Google’s removal channels are distinct and should not be confused. What they share: Google does not delete content from the web, it only removes results from its own Search. The content stays on the site and can be reached by direct link; telling a client “the content was deleted” is misleading.

Results about you. This Google tool regularly checks whether your phone number, home address or email appear in Search alongside your name, sends alerts and makes removal requests easier. Some features are rolling out only in certain markets and for users over 18; check availability in your account (Results about you help page).

Geographic limits of the right to be forgotten. Google de-lists results on the versions for countries applying European data protection law and uses location signals to restrict access for users in the requester’s country; it does not de-list outside the EU. Public role, source, age and sensitivity of the information decide the assessment.

What to watch for. Results from government, education and newspaper sites are generally not removed. Re-submitting the same URL without new evidence does not change the outcome. Google’s spam policies also state that sites subject to many valid legal or personal information removals can be demoted in ranking (Google Search spam policies).

Bing and DuckDuckGo

Bing offers a separate right-to-be-forgotten form for European residents; the UK and Switzerland are also on its country list, and requests are assessed on whether information is inadequate, inaccurate, no longer relevant or excessive (Bing privacy request form). Old results for pages already removed at source are handled through the content removal tool in Bing Webmaster Tools. DuckDuckGo says it sources traditional link results largely from Bing, alongside its own crawler (DuckDuckGo result sources), so a fix in Bing usually carries over to DuckDuckGo.

Google Business Profile reviews

Google Maps policy bans fake engagement, incentivised reviews and conflicts of interest, which include current or former employees, contractual relationships, competitors and family members. Businesses may not offer payment, discounts or freebies for posting a review or removing a negative one; they may ask for genuine reviews without incentives (Google Maps user contributed content policy).

• Reporting: the “Report” option next to the review, or the Reviews Management Tool. The check typically takes several days.
• Appeal: a one-time appeal is available for rejected reports, with up to 10 reviews per appeal and the result sent by email.
• Limits: Google asks businesses not to report a review just because they disagree with or dislike it, and does not get involved in disputes between businesses and customers (Manage inappropriate reviews).
• Review extortion: if a sudden spike of 1-2 star reviews is followed by a demand for money or favours, use Google’s separate extortion form. Google advises not to pay or engage; the form asks for screenshots of the demands, links to the reviews and identifiers of the attacker (Report review extortion).

Meta: Facebook and Instagram

The fastest route is the report link next to the content. Privacy reports can only be made for yourself, your child or someone you legally represent, and Meta says it can only remove content in specific circumstances (Meta privacy violation report). Impersonation accounts can be reported even by people without a Facebook account (impersonation report). Copyright and trademark infringements have separate forms (copyright, trademark). Intimate images shared without consent are removed under the Community Standards; Facebook and Instagram are StopNCII partner platforms.

X

X’s private information policy bans sharing, without consent, home addresses or locations, government IDs, non-public phone numbers and emails, financial information and medical data. Names, birthdates, workplaces, and gossip, rumours and allegations are not private information under this policy, so “there are false allegations about us” usually does not succeed through this channel (X private information policy). There is a DMCA-based copyright form, a DSA form for illegal content in the EU and a separate channel for formal legal requests (X EU reporting page). In-app reports do not always receive a reply; on X, counter-narrative and suppression are often more effective.

TikTok

Content that breaks the Community Guidelines can be removed globally; content that is only illegal under one country’s law is generally restricted in that country. In the EU, use the in-app “Report illegal content” route and select a country and reasons. The defamation category asks you to show that the statement is false and seriously harmful (TikTok illegal content reporting). Copyright and trademark infringements have separate forms (copyright form). Content spreads very fast on TikTok, so the first hours of the crisis protocol are decisive.

YouTube

Privacy: requests are, as a rule, made by the person concerned, who must be uniquely identifiable. Image, full name, contact, ID and financial information, and SI-altered voice or image are covered; YouTube may first give the uploader time to remove or edit the content (YouTube privacy complaint). Defamation: YouTube requires a court order in some cases and expects claims to be specific and strongly supported; there is a country-specific form, including one for Türkiye (YouTube legal complaints). Copyright: the owner or an authorised representative submits a removal request (copyright removal request). Removed videos can be re-uploaded, so monitoring must be continuous.

Reddit

Reddit moderators are volunteers; they can remove content from their community but cannot delete it from the site, and only Reddit admins can ban users site-wide (role of moderators). Posting personal information breaks the rules (personal information rule). For content that does not break the rules, legal requests from private parties are assessed under local and international law and the content may be geoblocked in that country; removal requests are published to the Lumen database (Reddit legal requests). That last point matters: the legal request itself can become public and amplify the issue.

LinkedIn

Fake profiles can be reported, and the reported member is not told who reported them (fake profile report). LinkedIn states that in some countries, including the United States, it generally requires a court order before removing content on defamation grounds and in many cases cannot act on defamation notices; notices are made under penalty of perjury and may be forwarded, with your contact details, to the poster (LinkedIn legal notices).

Trustpilot

Under Trustpilot’s September 2026 guidelines for businesses and reviewers, businesses may not be selective with invitations, may not pre-screen for happy customers and may not ask for incentivised reviews. A review can be flagged for harmful or illegal content, personal information, advertising, not reflecting a genuine experience or concerning the wrong business; flagged reviews generally stay online during assessment, and only flags for harmful or illegal content are hidden meanwhile. Businesses that misuse the platform can receive a consumer warning on their profile (guidelines for businesses, guidelines for reviewers).

Glassdoor

Employers can flag reviews from the review itself or the Employer Center; Glassdoor aims to decide within 72 business hours and limits repeat flags (Glassdoor content reporting). It says it does not take sides in contract or NDA disputes, removes trade secrets and makes final decisions at its sole discretion. Employers may not ask employees to prove whether they posted a review. For employer brand, the lasting route is replying and genuinely improving.

Şikayetvar and Ekşi Sözlük

Şikayetvar: under its community rules, a complaint is written from a real account about the user’s own experience in the last 12 months; personal data such as national ID numbers, addresses or IBANs is not published; misleading, criminal or anti-competitive content is removed. A brand’s owner, employees, relatives or competitors may not write complaints, and brand replies may not redirect users to outside channels or ask for personal data (Şikayetvar community rules). A complaint shows as “Çözüldü” (resolved) when the user posts an approved thank-you message or rates the process 4-5 stars; complaints older than three years are removed automatically, and words like “fraudster” are not published unless confirmed by a court ruling (Şikayetvar help). The most effective route is a fast, solution-focused brand reply.

Ekşi Sözlük: complaints about entries concerning a person are accepted only from that person, the company’s authorised representative or a lawyer; third-party complaints are ignored (Ekşi Sözlük contact). Unlawful entries and entries subject to court orders can be deleted. Once a topic is opened it usually stays; the strategy is to report unlawful entries with evidence and strengthen accurate information elsewhere, not to remove the topic.

News sites

News sites offer three routes: an editorial correction request where there is a factual error, the right of reply and correction under Article 14 of the Turkish Press Law, and claims or data protection requests where content is unlawful. Publishers may resist removal on grounds of newsworthiness; asking them to add an acquittal, discontinuance or correction to the story is often faster and more defensible than removal.

Wikipedia and Wikidata

On Wikipedia the norm is sourced correction, not removal. Paid contributors must disclose employer, client and affiliation under the Wikimedia Terms of Use and English Wikipedia policy (paid-contribution disclosure). The conflict of interest guideline strongly discourages connected people from editing articles directly; changes are proposed on the talk page with the Edit COI template (conflict of interest guideline). Unsourced or poorly sourced contentious material about living people is removed without waiting for discussion (BLP policy). The Wikimedia Foundation generally does not monitor or edit content. On Wikidata, an item needs a Wikipedia sitelink, a clearly identifiable entity backed by serious public sources, or a structural need (Wikidata notability). Success comes from independent, reliable sources, not from “finding the right editor”.

Google Knowledge Panel

A person or organisation can claim the panel from the search result and verify by signing in to one of the listed official sites or profiles; not every panel can be claimed, and local businesses use Business Profile instead (Knowledge Panel verification). Verified users send feedback through “Suggest edits”; Google may prioritise it but does not write custom descriptions (feedback on content about you).

Court records and criminal records

No private company can delete a court record. What can be done is to run the legal process with a lawyer and prepare separate search engine and data protection requests for its online traces.

Non-consensual intimate imagery: emergency protocol

This is the highest-priority category. The aim is to stop the spread in the first hours and protect the person affected.

1. Collect evidence: URL, screenshot and upload time. Do not download the content or share it with anyone.
2. StopNCII: if the person in the image is over 18, a hash of the image is created on their own device; the image is not sent. Partner platforms such as Facebook, Instagram, TikTok, Reddit, X and Bing review matches under their own policies (how StopNCII works). Under-18s use the Take It Down service.
3. Platform reports: to every platform carrying the content, at the same time.
4. Google: the non-consensual intimate imagery removal form; Google also tries to remove duplicates.
5. Law enforcement: the public prosecutor in Türkiye; the police in the UK, plus the Revenge Porn Helpline for adults (Revenge Porn Helpline). In the US, covered platforms must remove content within 48 hours of a valid request under the TAKE IT DOWN Act.
6. Legal process: in Türkiye, Law 5651 Art. 9/A, Criminal Code Art. 134 and compensation routes are assessed with a lawyer.

Platform summary table

Review management and fake review attacks

Review management means collecting customer reviews legitimately, replying promptly and consistently, reporting policy-breaching reviews with evidence and turning reviews into product and service improvements. The goal is not to raise a star rating but to manage credibility. Fake or selective review practices are now explicitly banned in many countries, which makes review management a compliance matter.

Fake review bans: four legal systems

Source links are in the legal framework section.

Legitimate removal grounds

Platforms remove a review because it breaks their rules, not because the business objects to it. A report that is not backed by three things, the absence of a relationship with the business, the policy clause breached and concrete evidence, is usually rejected.

Detecting a fake review attack

• Many one-star reviews in a short window, for example 24 to 72 hours.
• Similar sentence patterns and similar spelling mistakes.
• Reviewers posting the same text about other businesses.
• New accounts without photos or with only one review.
• Timing that matches a competitor campaign, a public controversy or an extortion message.

Responding to a fake review attack

1. Collect evidence: screenshots, profile links, timestamps and a comparison with transaction records.
2. Report one by one: report each review with the relevant policy clause instead of bulk, unexplained reports.
3. Appeal: use the platform’s appeal route for rejected reports.
4. Go to the police if there is extortion: a wave of negative reviews combined with a payment demand is a suspected crime; do not pay, and report it to the platform and to law enforcement.
5. Make a short statement: if needed, say the reviews are being examined and have been reported to the platform; do not argue with reviewers in public.

What not to do: buy fake positive reviews, instruct employees to “give five stars”, ask for positive reviews in exchange for discounts or gifts, or invite only satisfied customers (review gating).

Collecting reviews legitimately

1. Send one invitation through one channel within a reasonable time after the transaction.
2. Keep the wording neutral: “Would you share your experience?”, not “Give us five stars”.
3. Do not offer incentives for positive reviews.
4. Invite all customers without pre-screening for satisfaction.
5. Reply to negative reviews professionally within a reasonable time, for example 48 hours.

Review reply examples

Negative but genuine review: Hello [Name], thank you for sharing your experience. We looked into [specific issue] with our team and have [corrective step]. If you would like, contact us via [channel]; we would like to resolve this with you directly.

Review that does not match records: Hello, we could not find a transaction matching this experience in our records. We have reported the review to be checked under the platform’s rules. If there has been a mistake, please contact us via [contact].

Never share a customer’s personal details, order details or health information in a reply; that can become a bigger reputation and data protection problem than the review itself. For SI-assisted reply workflows, see our article on SI customer review management.

Star rating maths: how many reviews do you need?

If the current average is R, the current number of reviews n, the target average T and the number of new five-star reviews x:

x = n × (T − R) ÷ (5 − T)

Example: a business with 100 reviews averaging 4.0 needs 100 × 0.5 ÷ 0.5 = 100 new five-star reviews to reach 4.5, as many as it already has. For the same business, a 4.3 target means about 43 and a 4.7 target about 234 new five-star reviews. That is the most optimistic scenario, where every new review is five stars. An offer that says “a few reviews will take you to 4.8” either gets the maths wrong or plans fake reviews.

Review management checklist

• Profiles for all locations are claimed and verified.
• A response time target is written down (for example 48 hours).
• Reply templates fit the brand voice and contain no personal data.
• A fake review detection and reporting workflow is written down.
• Reviews are analysed monthly by topic, sentiment and location.
• Reviews lead to product and service improvements.
• Staff are trained on the rules for asking for and replying to reviews.
• A review management protocol for crises is defined.

Suppression and asset building: rebalancing search results

Suppression is the work of reducing the impact of content that cannot be removed, or will take long to remove, by increasing the visibility of more accurate and more useful results in brand searches. The content stays where it is; what changes is the balance of information people see on the first page. That is why suppression is always planned together with asset building.

When to remove and when to suppress

The golden rule: removal and suppression are not alternatives but two parallel tracks. Legal proceedings can take months; the first page of a brand search should not be left uncontrolled for that whole time.

The first page of a brand search: a ten-result map

The first page of a search for the brand name is the most visible shop window of reputation and the main measurement area for suppression work. Classify each first-page result by how far you control it. AI Overviews, “People also ask”, video and news blocks are added to the map as separate rows, because they draw attention before the classic blue links.

Webtures’ working target is for at least six of the first ten organic results in a brand search to be owned or semi-controlled. This does not make a negative result disappear; it stops it being the reader’s only source, even if it stays on the first page.

Owned asset architecture

Each asset layer surfaces for different queries. “Brand + is it legit” tends to bring forums and complaint sites, while “brand + founder” brings LinkedIn profiles and news. Assets are planned around these query families.

• Core layer: corporate website, corporate blog or newsroom, team and leadership pages, an investor relations page where relevant.
• Profile and authority layer: LinkedIn company page and executive profiles, active social accounts, company database listings, industry association memberships, the Google Knowledge Panel.
• Publishing layer: expert articles in industry media, podcasts and conference talks, data-led reports, real customer case studies.
• Community layer: transparent corporate accounts on Q&A platforms, GitHub for technology companies, genuine user communities.

Suppression content must stand on its own

Content created to push a negative result down must offer value to readers in its own right. Google’s spam policies treat mass production of low-value pages to manipulate rankings as scaled content abuse, and content that exploits a third-party site’s ranking signals as site reputation abuse (Google Search spam policies). Google also says there are no special optimisations needed to appear in its SI features and that fundamental SEO best practices still apply.

Effective content types include: brand narrative such as the founding story, mission and production process; expertise such as industry analysis and methodology; verifiable customer cases, certifications and awards; documented replies to false claims, without naming individuals; education and community contributions. Consistency and source strength matter more than volume.

Authority and link strategy

In suppression work, a page’s ranking is strengthened by the independent references it earns. Buying links to influence rankings, however, breaches Google’s link spam policy and can cause lasting damage to the brand.

• Safe sources: industry associations and chambers, university collaborations, genuinely newsworthy announcements, supplier and customer pages based on real business relationships, free tools and open-source projects.
• Avoid: link farms, private blog networks (PBNs), comment spam, “500 backlinks” packages, unlabelled paid articles.

Google Knowledge Panel and Wikidata

The Google Knowledge Panel is an information box that Google generates automatically about an entity. It draws on various web sources Google collects; the official site, Wikipedia, Wikidata and consistent social profiles are common among them. The panel is also an entity signal that affects how SI systems describe the brand.

1. Show the name, logo, address, founding year and social profiles consistently on the official site; add Organization structured data with sameAs links.
2. Use the same name, logo and description across social profiles.
3. Support the Wikidata item only with verifiable sources; items that fail the notability criteria can be deleted.
4. If a panel appears, claim it through Google’s verification process and send change suggestions that way.
5. If there is a Wikipedia article, do not edit it directly; propose sourced changes on the talk page (details in the platform section).

Video and social layer

As video and social results take a larger share of brand searches, these channels become part of suppression work. On YouTube, a brand channel, executive interviews and product explainers; on LinkedIn, regular expert posts from executives; on Instagram and TikTok, human stories. The X account should be active and verified before a crisis, because it will be the first announcement channel during one.

How to measure suppression

The SI era: GEO/AEO and machine reputation

Machine reputation is the sum of the answers that systems such as ChatGPT, Gemini, Perplexity, Google AI Overviews and AI Mode give when asked about a brand. People now ask “Is X trustworthy?” of an assistant rather than a search box, and often decide on a single summary answer. Reputation management therefore covers how the machine describes the brand, beyond the ten blue links.

How are SI answers formed?

An SI assistant’s answer about a brand usually draws on three sources:

1. Training data: web content the model saw during training. It can be dated; corrections after the training cut-off may be missing.
2. Live retrieval: current pages fetched through web search while answering. Google explains that AI Overviews and AI Mode retrieve relevant pages from its Search index, gather additional results through related sub-queries (query fan-out), and that there are no additional requirements to appear in these features (Google: AI features and your website).
3. User context: the previous conversation, language, location and personalisation settings.

Machine reputation therefore differs from a classic search result in two ways: it can rely on older information, and it can generalise from a single source into an inaccurate summary. The common ground is just as clear: in systems that search the live web, strong, current and accurate sources are the best guarantee of an accurate answer.

Reputation risks in the machine layer

How do you measure machine reputation?

Measurement uses a fixed prompt set covering brand, founder, product, comparison and risk questions: “Is X trustworthy?”, “Who founded X?”, “What is the difference between X and Y?”, “Are there complaints about X?”, “What services does X offer?” The same prompts are run every month in the same language and location, and logged, in ChatGPT, Gemini, Perplexity and Google AI Overviews. Because answers vary from run to run, each prompt is asked more than once and dated screen recordings are kept.

The measurement method and metrics are explained in detail in how SI visibility is measured, and the service scope for machine reputation on our SI reputation management page.

Correcting a wrong SI answer

1. Find the source: check the citations shown in the answer and the classic search results for the same question. Wrong information usually comes from a specific page.
2. Fix it at source: if the error is on your own site, correct and date it; if it is on a third-party source, request a documented correction.
3. Strengthen accurate information: a clear page on the official site that answers the question directly, consistent profiles and independent sources.
4. Use in-product feedback: report the error with the feedback options on the answer; if it involves personal data, use the provider’s privacy request channel.
5. Measure again: rerun the same prompt set after the fix and log the change.

Building reputation for SI: GEO/AEO principles

1. Entity clarity: the brand name, founder, location and sector are written the same way everywhere.
2. Structured data: Organization, Person and, where appropriate, FAQPage schema. Schema helps with rich results; it is not required for Google’s SI features.
3. Source diversity: no dependency on a single site; aim for independent news, industry and academic sources.
4. Direct answers: pages that answer “What is X?” and “Is X trustworthy?” clearly in the first paragraph.
5. Freshness: dates, data and references kept current.
6. Third-party verification: the brand’s claims should be verifiable in independent media. The wider framework is on our GEO services page.

Deepfake and synthetic content attacks

Synthetic voice, images and video are a fast-growing form of reputation attack. Detection signals include lip-sync and lighting inconsistencies, missing or contradictory metadata, a short history on the first posting account and coordinated speed of spread.

1. Document the content with URL, screen recording and timestamp without re-sharing it.
2. Report it to the platform under its manipulated or synthetic media rules.
3. Assess legal routes with your lawyer under personality rights, data protection and the relevant criminal provisions.
4. Keep the public statement short and factual: say the content is fake and legal action has started; do not retell the claim.

The deep fake transparency rules of the EU AI Act and related rules on synthetic content are summarised in the legal framework section.

The shifting balance in the SI era

Reputation crisis management

A reputation crisis is a situation in which a claim, event or piece of content spreads quickly enough to affect customers, employees, investors or regulators. What manages a crisis is not a perfect first statement but verification, a single voice and record-keeping discipline in the first hours.

Crisis severity levels

The first 60 minutes of a crisis

1. Verify: is the content real, what is the context, who is the original source?
2. Classify: set the SEV level.
3. Convene the crisis desk: communications, legal, operations and leadership.
4. Pause planned communication: suspend scheduled campaigns and posts.
5. Record: screenshots, URLs and timestamps.
6. Measure spread: mentions per minute and channel split.
7. Draft the first statement: a short holding statement limited to verified information.

The first 24 hours and the first 7 days

Stakeholder map

Holding statement examples

The texts below are starting drafts for the communications team; adapt them to the facts and get legal approval before publishing.

Confirmed incident (SEV1): As of [date] we are aware of [incident]. Our priority is the safety and support of the people affected. We are examining every aspect and cooperating with the authorities. We will share verified information via [channel].

Unverified allegation (SEV2): We are following reports about [allegation] and investigating whether they are accurate. To avoid speculation we will only share verified information. For questions: [contact].

Niche community (SEV3): We have received your feedback about [topic]. We are looking into it and will share a concrete response by [date].

Six rules of crisis communication

1. Speed beats perfection. Silence in the first hours fills the gap with speculation.
2. Empathy first, legal second. A statement written only in legal language reads as cold; legal approval is still required.
3. One voice. Everyone is pointed to the same spokesperson and the same text.
4. Concrete action. “We are looking into it” is not enough; say what will be done, when and by whom.
5. Do not repeat the claim. Rephrasing the allegation in every reply reinforces it.
6. Keep records. Every decision is documented with a timestamp.

Before a crisis: a ready crisis page

A ready crisis page (dark site) is a light page or subdomain, able to run independently of the main site, that goes live during a crisis. It contains a status summary, frequently asked questions, press statements and a crisis contact line. The domain, hosting, design template and content skeleton are prepared in advance; during the crisis only the facts are filled in. The page also serves as a current, official source for SI systems.

After a crisis

When the crisis closes, four things happen: a review recording what happened, why and what was learned; a 90-day repair and content plan; updates to early warning, approval flow and spokesperson training; and a before-and-after comparison of brand search, review rating, sentiment and SI answers.

Reputation monitoring, measurement and KPIs

Reputation monitoring means regularly scanning content published about the brand across search, news, social media, forums, reviews and SI, and triggering alerts at predefined thresholds. Reputation that is not measured cannot be managed; and measurement without process is just a tool.

Monitoring architecture

Keyword set for monitoring

Define at least four clusters for every brand: brand (“X”, “X reviews”), founder and executives (“X CEO”, full names), product and service (“X price”, “X alternative”) and risk (“X complaint”, “X scam”, “is X legit”). The risk cluster is the heart of the early warning system; an automatic alert should fire when a new URL appears in it.

Tool categories

Process first, tools second. On the free tier, Google Alerts, Google Search Console (brand queries and page performance), Google Business Profile notifications and web archives such as archive.org are enough to start. As scale grows, add social listening, media monitoring, SERP rank tracking, multi-location review management and SI visibility tracking tools. When choosing a tool, ask about data sources, Turkish language support, historical data retention and export options.

Reputation KPI set

Reporting structure

Keep the monthly report short: an executive summary with three findings and three actions, a before-and-after map of the brand search, review and sentiment trends, an SI visibility table, work done and next month’s plan. The quarterly report adds trend analysis, competitor comparison, incident reviews and a strategy update. Every removal request is linked to the evidence folder with its date, ground, channel and outcome.

Proactive reputation defence

Proactive defence means shrinking the attack surface before a crisis. Every unowned digital asset, fake account, forgotten campaign site or unnecessarily exposed piece of personal data can be an entry point for a reputation attack.

Digital asset inventory

At least once a year, list: domains (main brand, country extensions, common misspellings), active and abandoned social accounts, fake accounts, corporate email and executive profiles, directory and marketplace profiles, old campaign and microsites, blog and publishing platforms, code repositories.

Domains, usernames and trademarks

• Defensive domain registration for the main brand and common misspellings.
• The same username on every platform, reserved even on platforms you do not use.
• Monitoring for lookalike and typosquatting domains.
• Trademark registration: TÜRKPATENT in Türkiye, EUIPO in the EU, the UK Intellectual Property Office in the UK. Registration is also the basis for using platforms’ trademark infringement forms.

Executive protection

Founders and senior executives are the brand’s most vulnerable point. Core measures are regular checks of name searches, professional content on LinkedIn and in industry media, media training, personal security (no exposed addresses or phone numbers) and limiting the visibility of family members.

HR-related risks

Employer reviews directly affect hiring. Constructive exit interviews, realistic hiring promises, open communication and voluntary employee advocacy deliver more lasting results than trying to remove reviews.

Contract, communication and data discipline

• A written social media policy for employees and a single-spokesperson rule during crises.
• Confidentiality and reputation clauses in supplier contracts.
• No personal phone numbers or emails of executives on the corporate site; former employees’ details removed.
• Up-to-date KVKK and GDPR privacy notices; internal correspondence and meeting notes protected by access controls.
• SPF, DKIM and DMARC configured on the corporate email domain; fake emails sent in your brand’s name are a common form of reputation attack.

Early warning system

Thresholds are calibrated to the brand’s normal volume; 20 mentions can be a crisis for a small brand and an ordinary hour for a large one.

Red flags when buying reputation services, and vendor due diligence

In the reputation services market, legally defensible services and offers that carry clear criminal risk are often sold from the same catalogue. The “negative link removal” offers that land in corporate inboxes are usually not a service but a transfer of risk: the legal responsibility for the removal stays with the brand, not the vendor. If the same vendor offers both “we exercise your data protection rights” and services such as account sales or “unbans”, assume the clean-looking items run on the same infrastructure.

Twelve red flags

1. Guarantee language: “guaranteed removal”, “100% success”, “we will never let you down”. No platform gives a vendor the power to guarantee removal.
2. Secret method: no explanation of which channel will be used, on what ground.
3. Claimed inside access: promises of “contacts” or special connections at a platform, news site or public body.
4. Promise to delete court records: criminal and court records are handled only by the competent authorities under statutory procedure; a private company cannot delete them.
5. Mixed catalogue: removal services alongside account sales, “unbans”, “recovery” of hijacked accounts, follower or trend sales.
6. Public account offers: offers of government email accounts or official identity access.
7. Unverifiable scale: customer numbers without sources, empty case studies, broken counters.
8. Template testimonials: near-identical, unverifiable client quotes.
9. No company identity: no legal entity name, address, registration number or leadership details; a newly registered domain that contradicts claimed experience.
10. Scope-free offer: a request for upfront payment without scope, delivery criteria, reporting, termination terms or a contract.
11. Bulk, high-pressure selling: unpersonalised cold email, urgency pressure, “decide now” language.
12. Double language: ethics and compliance language on the website, a list of unlawful services in the sales message.

Legal classification of typical offers

The table below is a general risk map of offers common in the reputation market; any specific case is assessed with a lawyer.

Six stages of vendor due diligence

Questions to ask a vendor

Identity and structure: What is your full legal name and registration number? Where are your head office and operations? Who is the ultimate beneficial owner? How long have you operated? Where are you tax resident? Which three clients can give a written reference?

Method: Exactly which methods does your “removal” service use? What share of your requests go to sources, search engines and platforms? Which legal grounds do you use? Do you send copyright notices for content with no copyright claim? Are changes on news sites editorial or commercial? Do you use subcontractors?

Compliance and ethics: Can you share your KVKK and GDPR compliance policy? Do you sign a data processing agreement? In which countries is client data stored? Which requests do you refuse? What happens if you fail?

Measurement and reporting: Which metrics define success? How often do you report? Do you provide before-and-after screenshots and archive records? How can we verify your success rate?

Contract and technical: Is there a liability cap and an indemnity for third-party claims? Do you hold professional indemnity insurance? What are the termination and data return terms? How do you manage Search Console or Business Profile access, and do you share access logs?

Answers that end the conversation

End the conversation if you hear any of these: “We can’t share our method”, “We have contacts at the platform”, “We can delete the court record”, “We can buy and transfer accounts”, “We de-index with DMCA notices”, “Guaranteed removal”, “Payment first, process later”, “We can’t give references for confidentiality reasons”, “We don’t sign contracts”.

Clauses a contract should contain

Vendor scorecard

Score each criterion from 1 to 5 and multiply by the weight. Suggested decision threshold: below 3.5, do not work together; 3.5 to 4.2, test with a pilot; 4.2 and above, consider a long-term engagement. A vendor scoring 1 on lawfulness of methods is excluded whatever its total.

Scenario playbooks

The playbooks below summarise the first steps for the ten most common reputation situations. Each is a starting plan; legal steps run with a lawyer and communication steps through the organisation’s approval flow.

1. A false news story

Situation: a news site has reported an undocumented allegation about the brand, and the story is on the first page of the brand search. First 24 hours: archive the story, contact the editor, answer the allegations point by point with documents, consider the right of reply and correction, set the legal route with a lawyer and, in parallel, publish an official statement with the accurate information. Measurement: the story’s position, publication of a correction or reply, brand search and sentiment.

2. An old court case or conviction

Situation: news or a judgment about a case from years ago is causing problems in job applications. Right approach: check with a lawyer whether the statutory conditions for deleting the criminal record are met; apply to search engines on data protection and right-to-be-forgotten grounds; if there was an acquittal or discontinuance, ask for the story to be updated. Wrong approach: paying an intermediary that sells “court record removal”.

3. Non-consensual intimate images

First hours: record the URL and timing without downloading the content, create a hash through StopNCII, report to platforms and Google, contact law enforcement. First day: legal process and referral to psychological support. Afterwards: monitoring for re-uploads and digital footprint clean-up. The detailed protocol is in the platform section.

4. A coordinated fake review attack

Symptom: many one-star reviews with similar wording in a short time. Action: an evidence pack, reporting each review with evidence, appeals for rejections, police and platform reports if money is demanded, a short public statement. Avoid: buying fake positive reviews.

5. Account takeover

First hour: change passwords, enable two-step verification, close open sessions, use the platform’s official account recovery channel, inform followers. First day: forensic review, removal of unauthorised posts, a police report. Afterwards: vulnerability analysis and staff training. Account recovery only happens through the platform’s official channel; third-party “recovery” offers are a separate risk.

6. An extortion email

Situation: a message saying “pay or we publish” or “pay or hundreds of negative reviews will arrive”. Do: do not reply or pay, keep the message with full headers, report it to the police and prosecutors, make preventive reports to the relevant platforms, start the rapid removal protocol if content is published. Do not: negotiate, pay or reply with threats.

7. A personal attack on an executive

First separate whether the attack is personal or corporate; usually it is both. Personal data requests for name searches, legal action, a corporate statement where needed and the executive’s physical security are handled together.

8. A forum thread

For a topic opened on platforms such as Ekşi Sözlük or Reddit, first measure visibility and spread. If the content is accurate: reply and improve. If it is false: request a documented correction. If it contains insults or personal data: a platform report and legal action. Removal attempts often amplify the topic (the Streisand effect).

9. A video exposé

First hours: platform report, measuring spread, listing copies. First day: legal assessment and, where needed, a counter-statement or video. Removed videos can be re-uploaded, so monitoring must be continuous.

10. A data breach claim

First hour: verification with the information security team and a legal assessment. In Türkiye the data controller must notify the Personal Data Protection Board as soon as possible and at the latest within 72 hours of becoming aware of the breach; under the GDPR, the supervisory authority is notified without undue delay and, where feasible, within 72 hours. First day: informing affected people and a public statement. Afterwards: forensic review, process improvement and reputation repair.

Ethical principles and governance

In reputation management, ethics is not an add-on but the method itself. Content removed by the wrong method turns into a bigger reputation crisis than the original content once it comes to light. Webtures measures every reputation case against one question: “If we do this, can we still defend it in public six months from now?”

Core principles

1. Lawfulness: every method complies with the law of the countries we operate in and with platform rules.
2. Transparency: clients are told plainly what can and cannot be done.
3. Proportionality: the intervention matches the size of the problem.
4. Accuracy: reputation is never built on false information.
5. Privacy: personal data is protected and processed only as far as necessary.
6. Accountability: every decision and request is recorded.

What Webtures does not do

• Write or buy fake reviews, or instruct employees to post reviews.
• Send fake copyright notices, fake court orders or unfounded legal notices.
• Build inside-access relationships with staff at platforms, news sites or public bodies.
• Buy or sell accounts, or access third-party accounts.
• Produce negative content about competitors.
• Promise guaranteed removal or claim that court records can be deleted.

Client acceptance policy

Every new reputation case starts with identity and legal entity verification, an assessment of whether the problem is legal or commercial, a misuse risk check and a written ethics commitment. Requests whose aim is to harm third parties, hide accurate information of public interest or influence an ongoing investigation are declined.

Records and audit trail

Every case keeps the client’s written request, the legal assessment, requests made and replies received, reasons for acceptance or refusal and the approver. These records are the basis of both internal audit and defence in any legal proceedings. For borderline cases, an ethics review involving a lawyer and an independent expert is recommended.

Checklists for legal requests

This is not legal advice; speak to your lawyer. The lists below show what information a request needs to contain; they are not ready-to-file templates. The text of any request should be prepared by a lawyer based on the facts of the case and current law.

What a KVKK request should contain

• The applicant’s identity and contact details, with the request made in writing or by a method set by the Board.
• The URLs where the data appears and a short description of the content.
• Which personal data is processed (name, image, address, health data and so on).
• A clear statement of the Article 11 request: erasure, correction, notification to third parties who received the data.
• The ground: the data is outdated, the purpose of processing has ended, the processing is unlawful.
• Attachments: ID, screenshots and archive records, documents showing the current position (for example an acquittal).
• Diary note: the controller’s 30-day response period, followed by the 30-day and 60-day limits for a Board complaint.

Search engine personal data and de-listing request

• The full URL of the search result and the search where it appears (for example a name search).
• The type of personal information and proof of the link to the person.
• An explanation of public role: if the person has a role in public life, why the right to information no longer prevails.
• The age of the information, the current legal position (acquittal, discontinuance, correction) and supporting documents.
• If the information is manifestly inaccurate, evidence of the inaccuracy that can reasonably be provided.
• If refused, a record of the reasons and the next step (KVKK Board complaint, or a supervisory authority in the EU).

Preparing a court and injunction file

• The right said to be infringed and a concrete explanation (personality rights, private life, commercial reputation).
• URL list, content text, publication dates and publisher details.
• All records from the evidence standard and any expert or notarial reports.
• Previous requests to the content provider and platform, and their replies.
• An explanation of harm and urgency (for an interim injunction).
• Power of attorney and the competent court, decided with the lawyer.

What a GDPR Article 17 erasure request should contain

• The requester’s identity and contact details.
• The URLs concerned.
• The Article 17(1) ground or grounds relied on.
• Context: time elapsed, absence of public interest, current legal position.
• A reminder of the response period: one month, extendable by two where needed, and the right to complain to a supervisory authority if refused.

What a DSA Article 16 notice should contain

• A substantiated explanation of why the content is illegal and the relevant legal rule.
• The exact location, such as the full URL.
• The notifier’s name and email address.
• A statement of good-faith belief that the information is accurate and complete.

UK section 5 notice of complaint

• The complainant’s name and email address.
• The statement itself, where it was posted and why it is defamatory.
• The meaning the complainant attributes to it, and which parts are factually inaccurate or opinions not supported by fact.
• Confirmation that the complainant cannot identify the poster.
• Whether the complainant’s name and email may be shared with the poster.

Review report evidence pack

Online reputation management glossary

Frequently asked questions about online reputation management

What does online reputation management do?

Online reputation management keeps the information people see about a brand or person in search results, review platforms, social media and SI answers accurate and balanced. It covers removing unlawful content through legitimate routes, rebalancing disproportionately prominent content, strengthening accurate information and preparing for crises.

Can a negative news story be deleted from Google entirely?

Google does not delete content from the web; under certain conditions it removes results from its own Search. The story itself only comes down if the publisher removes it or a court orders it. If the story is accurate and in the public interest, removal is neither lawful nor ethical; the right route is a reply, an update request and rebalancing the brand search.

What can be done in Türkiye now that Article 9 of Law 5651 is annulled?

The Constitutional Court’s annulment took effect on 10 October 2024, and as of 20 October 2026 no replacement article is in force. For personality-rights breaches, claims and interim injunctions under Articles 24-25 of the Civil Code are used; for privacy breaches, Article 9/A of Law 5651; for personal data, KVKK requests; and for press coverage, the right of reply and correction under Article 14 of the Press Law. Which route fits should be decided with a lawyer.

Does the right to be forgotten apply to companies?

The right to be forgotten mainly protects individuals’ personal data. Google states that legal entities usually cannot use this route under European privacy law. Better routes for companies are platform policies, claims based on personality and commercial reputation rights, the right of reply and correction in press law, and suppression and building.

Can you trust a guaranteed removal promise?

No. Google, Meta, Trustpilot and other platforms assess content under their own rules and local law; none gives a vendor the power to guarantee removal. An offer with a guarantee either relies on risky methods such as fake notices, inside access or unauthorised interference, or is a promise that cannot be kept.

Can negative reviews be removed?

Only if they breach platform policy. No genuine experience, conflict of interest, personal information, harassment or off-topic content are legitimate grounds; the business disagreeing with the review is not. For a genuine negative review, the most effective route is a fast, professional reply and actually fixing the problem.

How long does suppression take to work?

It depends on the authority of the negative content, competition in the brand search, the strength of owned assets and the quality of new content. No fixed timeframe or ranking guarantee can be given. The right approach is to map the first page of the brand search at the start and report progress monthly against the same measures.

What should I do if SI assistants give wrong information about my brand?

First find the sources behind the answer; wrong information usually comes from a specific page. Correct the error at source or request a documented correction, publish a current page on the official site that answers the question directly, build consistent profiles and independent sources, use in-product feedback, and rerun the same prompt set at regular intervals.

Why is buying fake reviews risky?

Fake reviews are banned in Türkiye under the Regulation on Commercial Advertising and Unfair Commercial Practices, in the EU under the Unfair Commercial Practices Directive, in the UK under the DMCC Act 2024 and in the US under the FTC rule, and they breach platform policies. Detection can lead to deleted reviews, warnings on the profile and sanctions; and being found out is a reputation crisis in itself.

What should you check when buying reputation management services?

Verify the vendor’s legal entity, methods, legal grounds, references and data security. Do not work with a vendor that will not explain its method, offers guarantees, promises to delete court records, sells services such as accounts from the same catalogue or will not sign a contract. Removal, de-listing and suppression should be defined separately and measurably in the contract.

Sources and next steps

The legal and platform information in this guide was checked against the official sources below as of 20 October 2026. Legislation and platform policies change; check the current text before making a request.

Türkiye: Law No. 5651, Constitutional Court E.2020/76, K.2023/172, Constitutional Court N.B.B. decision, KVKK Law No. 6698, KVKK Board decision 2020/481, KVKK right to be forgotten publication, KVKK data breach notification, Press Law No. 5187, Turkish Criminal Code No. 5237, Commercial Advertising Regulation amendment, Law No. 7578.

European Union: GDPR, DSA, EU AI Act, Regulation 2026/1744, Directive 2019/2161, CJEU judgments C-131/12, C-507/17, C-136/17, C-460/20.

United Kingdom: Defamation Act 2013, Defamation (Operators of Websites) Regulations 2013, UK GDPR Art. 17, Sexual Offences Act 2003 s.66B, DMCC Act 2024 Schedule 20.

United States: 47 U.S.C. §230, 17 U.S.C. §512, 16 CFR Part 465, TAKE IT DOWN Act.

Platforms: Google removal policies, Google Maps contribution policy, X private information policy, YouTube legal complaints, Reddit legal requests, LinkedIn legal notices, Trustpilot guidelines for businesses, Şikayetvar community rules, StopNCII.

Related guides

To go deeper, read our articles on SI reputation management, SI customer review management, measuring SI visibility and digital PR for SI answers.

Let’s review your reputation architecture together.

To see the first page of your brand search, your review profiles and what SI assistants say about your brand in one view, explore our online reputation management services or book a call with our team.