Navigating the Evolving Reputation Law Landscape: AI Threats, Identification Tools and Legal Principles

The year 2025 was a slow burn in the reputation law arena. Despite the rapid advancement in technology and generative AI, the adequacy of the reputation legal toolkit to deal with issues arising out of these developments was not significantly tested. Nevertheless, a number of trends emerged, forecasting and establishing legal protections which will give confidence to individuals and businesses as they navigate the evolving reputational landscape.

Impact of AI threats

AI and disinformation remain themes which are causing day-to-day challenges in private and commercial matters, although, to date, resolving these issues has largely remained outside of the Courts.

Hostile actors have learned to deploy AI to their advantage; for example, by intentionally injecting false or misleading information into the sources from which AI systems draw (also known as AI poisoning). This can be achieved very easily, for example by doing something as simple as editing a publicly accessible resource (such as a Wikipedia page) with inaccurate content which then proliferates across AI models and search results. As this misinformation spreads, it creates a rapidly multiplying threat that can be extremely difficult to contain or correct. This is especially challenging in the compliance sector, where false or misleading information can have serious regulatory and reputational consequences, including restrictions on access to private and business banking services.

It remains to be seen whether traditional legal measures for addressing the misuse of AI will prove adequate, particularly in circumstances (which we often see) where the inaccuracy appears ancillary, or is buried in information which is true. Many conventional claims include threshold requirements which create significant barriers; in defamation claims, for example, claimants must establish serious harm, while claims for misuse of private information require demonstrating that the information in question attracts a reasonable expectation of privacy.

Data protection law, by contrast, is a strong contender to be one of the most effective tools in the claimant reputation toolkit against defendants that control and process personal data, given their obligation to ensure that such data is processed lawfully, accurately and fairly. Notably, the material complained of need not be defamatory, but rather inaccurate; the applicable limitation period is significantly more generous than in defamation (six years rather than one); and the safeguards which exist to protect individual’s personal and sensitive data operate within a different jurisdiction regime which is less strict than in more traditional defamation claims.  While defendants can still raise defences (or “exemptions”), these are largely untested in the Courts. Potential remedies include compensation, declaratory relief, and orders requiring the rectification of inaccuracies.

Data protection remedies are often deployed in the regulatory and compliance sectors, including in the increasing number of cases where individuals are “debanked” and access to financial services and financial institutions is restricted on the basis of information held within internal compliance or risk databases. Organisations can be compelled to disclose copies of the personal data they hold, including information recorded on such databases and relied upon in decision making. Where that data is inaccurate or misleading, individuals can seek its rectification or erasure, directly challenging the underlying factual basis for the negative sanction. 

Utility of third-party disclosure orders

Historically, individuals and businesses have relied on Norwich Pharmacal orders (NPO) across common law jurisdictions to obtain information that facilitates claims against wrongdoers. Under this regime, a claimant may apply to the Court for an order compelling a third party involved in wrongdoing (albeit innocently) to provide information enabling the claimant to pursue the primary wrongdoer.

In a reputation context, this has been particularly valuable where publishers of false and damaging information have attempted to cloak themselves in anonymity. For example, Nicklin J observed in Chirkunov v Person(s) Unknown & Ors [2024] EWHC 3177 (KB) that, in his Lordship’s experience, Norwich Pharmacal applications “remain very effective” in identifying anonymous online publishers, with major global technology companies (including those based in the US) complying routinely with, and rarely challenging, orders.

Yet despite this judicial endorsement, recent figures indicate a downward trend in the number of NPO applications being made and granted. And even where they are sought, the requirements can be difficult to satisfy. The respondent must be sufficiently mixed up in the wrongdoing, which will not always be true of modern intermediaries. A good illustration is the treatment of email service providers. In Davidoff v Google LLC [2023] EWHC 1958 (KB), which concerned an anonymous review posted using a Gmail-registered Trustpilot account, the Court declined to grant an NPO. Google’s involvement was limited to providing an email address; it had no role in enabling or facilitating the posting of the review itself (ie, the wrongdoing in question).

As a consequence, claimants are increasingly exploring alternative legal tools and jurisdictions to obtain remedies that can fill this gap.

What other identification tools can be leveraged?

Where Norwich Pharmacal relief is unavailable, issuing a claim against “persons unknown” and then applying for an order under CPR 31.17 forcing a third party to provide documents in relation to that “person unknown” may provide a narrower but still useful alternative. CPR 31.17 permits the Court to order a respondent to disclose specific documents where necessary and relevant to the proceedings. However, CPR 31.17 is confined to documentary disclosure and does not extend to broader categories of information. The courts have also cautioned against overuse of litigation against “persons unknown”: Warby J (as he then was) noted in Birmingham City Council v Afsar & Ors [2020] EWHC 864 (QB) that it’s the exception rather than the norm: “[t]he facility to sue individuals anonymously as "persons unknown" is a significant departure from one of the basic norms of civil litigation”. Claimants must also still demonstrate that any anticipated claim has a real prospect of success. It is far from a shortcut.

Given these constraints and the global footprint of many platforms, practitioners are increasingly turning to overseas mechanisms. In particular, US federal discovery under 28 USC § 1782 can be an effective mechanism where a platform or its servers are located in the United States. Section 1782 carries different thresholds to English relief and may be granted even where the respondent has no involvement in the underlying wrongdoing. Combined with domestic procedures, it can form part of a growing multi-jurisdictional strategy to identify individuals and entities behind co-ordinated reputational attack campaigns.

As reputational attacks become more sophisticated and the actors behind them harder to trace, identification tools will play an increasingly central role. The challenge for reputation practitioners is to assemble and deploy these mechanisms quickly, strategically and across borders, ensuring that anonymity does not become a refuge for those intent on causing harm.

Legal update - the rule in “Dingle” considered and affirmed

The Media and Communications List did not see much traffic in 2025 (in keeping with the broader trend concerning the declining number of new claims being issued more generally). One notable issue examined in June 2024 and October 2025 by the UK Supreme Court and Court of Appeal, respectively, however, has been the rule in Dingle, which carries important consequences for individuals and businesses where there is historic information about them online which is inaccurate or misleading.

The rule in Dingle

The rule in Dingle refers to the principle established in the case of Dingle v Associated Newspapers Ltd [1964] AC 37, which effectively stated that other publications containing the same or similar allegations to those pursued in defamation proceedings cannot be used as proof of a pre-existing bad reputation and are inadmissible in mitigation of damages.  Instead, to prove a pre-existing bad reputation a defendant should call evidence from “those who know [the Claimant] and have had dealings with him” [412].

Chowdhury Mueen Uddin v Secretary of State for the Home Department [2024] UKSC 21

This case concerned an appeal by Mr Mueen-Uddin to the UK Supreme Court of a decision by the High Court (subsequently upheld by the Court of Appeal) striking out his claim for defamation and breach of his data protection rights on the basis that it constituted an abuse of process. Mr Mueen-Uddin had brought proceedings against the Home Office for publishing a 143-page report in 2018 which included an allegation that he was guilty of war crimes and crimes against humanity.

As part of its decision to uphold Mr Mueen-Uddin’s appeal, the Court was required to consider the impact of the rule in Dingle in the context of whether the alleged harm was  real and substantial or whether the claim should be struck out because it was not “worth the candle” (also known as the Jameel abuse principle, established by the House of Lords’ decision in Jameel v Dow Jones, 2005).

There were a number of other media reports which pre-dated the Home Office report which made the same or similar allegations, which Mr Mueen-Uddin had not successfully legally challenged (due to a lack of funds). The High Court and the Court of Appeal treated these reports as conclusive evidence that Mr Mueen-Uddin's reputation was that he had been involved in the murder of the intellectuals in Bangladesh in 1971 and therefore the proceedings would not serve any actual purpose in vindicating his reputation; in other words, the  proceedings were of low value and not worth the candle.

The Supreme Court found that the only way in which these media reports could affect the value of the claim would be by operating in mitigation of damages. The rule in Dingle therefore applied. The Supreme Court found that the fact that the same defamatory information had been published previously was irrelevant, even in circumstances where the Claimant had previously taken no steps to contradict the libel.

Blake & Ors v Fox [2025] EWCA Civ 1321

This case concerned an exchange of defamatory tweets on Twitter in October 2020. Mr Blake, Mr Seymour and Ms Thorp each described Mr Fox as a “racist” on Twitter. Mr Fox responded with tweets labelling each of them a “paedophile”. The three claimants brought a libel claim against Mr Fox, and Mr Fox counterclaimed in libel against each claimant. 

At first instance, the High Court had dismissed Mr Fox’s counterclaim on the basis that that there were other pre-existing reports in the public domain which made the same allegation (ie, that Mr Fox was a racist), and the High Court therefore inferred that Mr Fox had acquired a bad reputation for being a racist, and as a result: (i) the tweets complained of had not caused serious harm to Mr Fox’s reputation and (ii) any harm that had been caused to Mr Fox’s reputation could not be attributed to the tweets complained of.

The Court of Appeal, however, found that this decision was expressly contrary to the rule in Dingle (which the Supreme Court had previously in Lachaux v Independent Print Ltd confirmed also applied in the context of assessing serious harm). Warby LJ clarified that for the purposes of assessing serious harm, the judge should have assessed whether the publication of the offending statements had probably caused some reputational harm that was serious. This is a threshold issue and, in the case of mass publication (as in this case), need not be a complex exercise.

Warby LJ also considered that the High Court had not properly engaged in an exercise of “isolation”, ie, the principle that a claimant should not be compensated for reputational harm caused by others. The principle of isolation could permissibly be used to rebut a claim that specific consequences have flowed from the publication complained of. It cannot however be relied on to demonstrate pre-existing bad reputation caused by third party publications which meant that the publication complained of was in some way less harmful. Warby LJ stated that this was “a line of reasoning unequivocally prohibited by Dingle, Lachaux and Mueen-Uddin”.

These decisions confirm that defendants cannot rely on prior publications to dilute damages and that serious harm must be assessed by the impact of the statements in question. For claimant individuals and businesses alike, these decisions assert the stability of the law and the protections it provides at a time where internet libels are often preserved in perpetuity.

Outlook

The development of AI presents both unprecedented challenges and evolving solutions in reputation law in 2026. As AI threats and disinformation campaigns become more sophisticated, both practitioners and the legal framework must continue to adapt to protect individuals and businesses from reputational harm.

The recent judicial affirmations of the Dingle principle by the UK Supreme Court and Court of Appeal provide critical clarity on how pre-existing publications should be treated in defamation proceedings, reinforcing that defendants cannot simply point to publication by others of the same allegations to diminish a claimant’s case.

The practical challenge of identifying bad actors leveraging AI in attacks requires reputation lawyers to deploy creative multi-jurisdictional and adaptive strategies, supplementing traditional tools like Norwich Pharmacal orders with mechanisms like US federal discovery. Practitioners must move quickly, think globally, and leverage both established legal principles and emerging tools to identify bad actors and vindicate their clients’ reputations.