A defamatory comment on a forum, a photo reused without permission on a social network, a site that refuses to delete your personal data after several reminders: we often find ourselves powerless in these situations. Protecting rights on the Internet is not limited to installing antivirus software or choosing a strong password. It involves knowing the legal mechanisms that can be mobilized and understanding how to document an infringement before it disappears.
Reporting illegal content and filing a complaint: two distinct processes
When we come across content that infringes on our rights (defamation, identity theft, unauthorized use of an image), the first reflex is often to report it directly to the platform. The Digital Services Act now requires hosts to provide notification channels for certain serious offenses, particularly violence, incitement to hatred, or sexual exploitation of minors.
This reporting to the platform is not a formal complaint. Reporting content does not trigger any legal proceedings. The platform may remove the content, but it has no obligation to compensate you or pursue the author. To seek redress or initiate legal action, a report must be made to the competent authorities or a formal complaint must be filed.
The confusion between these two processes can waste precious time. We think we have acted by clicking “report,” while the evidence of the offense sometimes disappears with the removal of the content. The correct sequence: capture the evidence first (timestamped screenshot, archiving the URL), then report. This type of methodology is structured step by step by Mindtrap’s online assistance, identifying the right contacts based on the nature of the infringement.
Exercising the right to delete personal data: what the CNIL really sanctions
Requesting the deletion of personal data from a website or online service seems simple on paper. In practice, responses vary: some organizations process the request in a few days, while others ignore it or drown it in endless procedures.
The CNIL’s annual report for 2025 shows that litigation related to individuals’ rights and trackers has intensified. Sanctions are no longer aimed solely at large platforms: medium-sized sites are also concerned when they do not comply with deletion or rectification requests.
Refusal of cookies: keep the evidence
One point that traditional cybersecurity guides overlook: the refusal of cookies must be as effective as their acceptance. In practice, some sites use “dark patterns” that deliberately complicate refusal. If you notice that a site continues to track your browsing despite your refusal, the CNIL considers this an infringement.
Keeping evidence of your refusal or withdrawal of consent significantly strengthens a complaint. A screenshot of the cookie banner with the date, a copy of your request sent by email: these simple elements transform a vague complaint into an admissible file.
- Take a screenshot of the cookie banner at the time of refusal, with the date and URL visible.
- Send your deletion request by email rather than through an internal form, to have a timestamped acknowledgment of receipt.
- In the absence of a response within a month, file a complaint with the CNIL attaching your initial request and proof of its sending.
Training data for AI models: a new area of digital rights
Claims related to data used to train artificial intelligence models constitute a recent aspect of digital rights. The CNIL has begun to specifically regulate this issue, publishing guidelines on the exercise of individuals’ rights in this context.
The rights of access, rectification, and opposition also apply to training data. If your personal information (published texts, images, professional profiles) has been collected to feed an AI model, you can theoretically exercise your rights with the entity responsible for the processing.
The concrete problem: identifying who collected what. Unlike a traditional website with an identifiable privacy policy, the chains of data collection for training are often opaque. The starting point remains the same as for any online infringement: document what you observe, identify the data processor, and formalize a written request.
Reporting mechanisms of the Digital Services Act: what changes concretely
The Digital Services Act has introduced an obligation for hosting services to have channels that allow for the rapid notification of certain serious offenses to the competent authorities. This obligation goes beyond the simple “report” button visible to the user.
Which content is affected by enhanced reporting
The targeted categories include content related to violence, incitement to hatred or terrorism, sexual exploitation of children, and human trafficking. For these cases, platforms must transmit the information to judicial or law enforcement authorities, not just moderate the content.
- For hateful or threatening content, reporting to the platform may trigger an automatic transmission to the authorities if the content falls within the categories specified by the DSA.
- For an infringement of image rights or defamation that does not fall under these serious categories, reporting remains useful but does not replace direct legal action.
- In all cases, compiling a file of evidence before reporting remains the most protective approach for the victim.
The boundary between what falls under platform reporting and what requires a formal complaint depends on the nature of the infringement. Identifying the correct category of infringement conditions the effectiveness of the process. A poorly directed report can delay processing by several weeks.
Protecting one’s rights online relies less on technical tools than on a method: capturing evidence, identifying the right contact, formalizing the request in writing. Mechanisms exist, from the right to erasure to the obligations of the DSA. What makes the difference is activating them in the right order and at the right time.
