DMCA is now an SEO attack surface Google won't fix

Two Press Gazette investigations into a marketing company. Both removed from Google search this year after anonymous DMCA complaints. Both complaints cited unrelated source material — a 2024 Verge article in one case, a deleted forum post about online casinos in the other. Neither had anything to do with the reporting they were being used to erase.

This is the story most of the industry is filing under "copyright weirdness." It isn't a copyright story. It's a search infrastructure story, and it exposes something the SEO industry has been slow to acknowledge: Google's DMCA process is now a scalable attack vector, and there is no defence built into the platform.

The pattern is worth taking seriously. Fake takedowns aren't a new phenomenon — I've been reading about them since at least 2018 — but the shape of what's happening now is different. The complaints are anonymous, routed through opaque hubs, cite obviously unrelated content, and they still work. A live, original page disappears from Google. The site owner finds out later, if at all. And the burden of restoring it falls on the person who was attacked.

That's the loop. And Google built it.

The process is doing what it was designed to do

Under the DMCA, Google is required to act on a facially valid notice. It is not required to adjudicate whether the copyright claim itself has any basis. Google's own transparency report says as much — it acknowledges that submitters may provide inaccurate information, that it cannot always verify, and that it cannot always notify site owners before removal.

That's not a bug. That's the statute working exactly as written. Roger Montti has laid out why Google's hands are relatively tied here, and he's right on the legal read.

But "the law made us do it" is only an interesting defence up to the point where the process starts being systematically abused. Which is the point we're at.

The two Press Gazette takedowns aren't isolated. The March notice also caught a follow-up piece on a completely different trade publication covering the same story. One complaint. Two removals. That is the outline of an attack, not the outline of a misunderstanding.

Why this is a competitive attack surface, not a copyright problem

Take a step back from the specifics of the Press Gazette case and think about what the DMCA notice-and-takedown system now offers, functionally, to a bad actor:

The DMCA is the only removal mechanism in the SEO stack that doesn't require compromising the target's systems.

• Anonymous submission
• No requirement to prove the underlying content is actually infringing
• Automatic removal from the world's largest discovery surface
• Reversal takes days to weeks, if it happens at all
• No cost to file
• No consequence for filing spurious notices at scale

If you were designing a system for attacking a competitor's organic search presence, and someone told you it already existed and Google was legally required to honour it, you would not believe them. And yet here we are.

The DMCA is the only removal mechanism in the SEO stack that doesn't require compromising the target's systems.

You don't need to hack anything. You don't need to build negative links. You don't need to buy expired domains or spin up scraper networks. You just need to file a piece of paperwork claiming ownership of something the target published. Google removes the page. The target's traffic drops. By the time the counter-notice moves through the system, the ranking has been reallocated to competitors and the news cycle has moved on.

That last piece is what makes this so viable against publishers specifically. A news story's commercial value is concentrated in its first 72 hours. Remove it from Google for a week and the story is functionally dead, even if it comes back later.

The scale is genuinely hard to measure

One of the more uncomfortable things about the current situation is that nobody outside Google actually knows how often this is happening. Lumen — the research project where DMCA notices are archived — holds tens of millions of URLs, but the archive doesn't distinguish between legitimate copyright enforcement and abuse. There is no public counter for "notices later determined to be spurious." There is no dashboard for "sites hit and then restored."

We know it happens because reputable publishers occasionally document it. But by definition, the cases we hear about are ones where a target with resources and audience noticed the drop, investigated, and had the platform to publish about it. Press Gazette is a trade publication for journalists. If a small B2B site or a service business gets hit with the same attack, they probably attribute the traffic drop to a Google update and move on.

Which is worth sitting with for a moment, because it changes what "we're seeing" actually means. What we're seeing is the visible tip of a process that's designed not to be visible.

The DMCA takedown that removes a page is the same DMCA takedown that removes evidence of the removal from the front page of the search results.

Google adds a footer noting that some results were removed and links to the Lumen record. Almost nobody reads that far. The removed URL doesn't sit there greyed out — it's simply gone. If you didn't know the page existed, you don't know it's missing.

Why this connects to the parasite SEO conversation

The Press Gazette investigation that got taken down was, specifically, reporting about parasite SEO — a practice where a company acquires established websites to piggyback on their existing Google authority and inject commercial content.

That context matters. The takedowns aren't happening to random publishers. They're happening to publishers who were investigating specific companies with a demonstrated interest in manipulating Google's ranking systems. Whether or not any particular takedown is traceable back to a specific bad actor is beyond what the public evidence can prove. But you don't need to prove intent to notice that the incentive structure is doing its job.

If you are running a parasite SEO operation, and a trade publication runs an investigation that could threaten your commercial position, filing a DMCA notice against that coverage is — in the current system — a rational move. The expected value calculation is straightforward: cost to file is near-zero, probability of removal is meaningful, penalty for filing spuriously is negligible, and even a temporary removal delays the story's spread and dilutes its ranking authority against your own site.

The same logic applies far beyond parasite SEO. Any competitive dispute where organic search is a material commercial channel now has DMCA takedown as an available tactic. Reputation management firms know this. Some agencies almost certainly know this. It would be surprising if it were not already being used.

What Google could do, and probably won't

I want to be fair to Google here, because the legal framework really does constrain their options. But it doesn't constrain them completely.

Google could require verified identity for DMCA submissions above a certain volume threshold. They could apply a submitter reputation score — a filer whose previous notices were successfully counter-noticed loses standing. They could delay removal for a short review window when a notice cites source material that is obviously unrelated by URL pattern or content hash. They could publish aggregate statistics on notice validity so the scale of abuse is visible to the industry.

They will probably do none of this at speed, because the legal safe harbour Google enjoys under the DMCA is contingent on acting expeditiously on facially valid notices. Anything that looks like Google adjudicating claims moves them closer to being a decision-maker on copyright disputes, and closer to a liability position they've spent 25 years avoiding.

So what actually happens, in the near term, is that this attack surface stays open. Sites get hit. Some notice. Most don't. The pattern continues.

The honest limits

There's a version of this piece that overplays the hand — that treats every disputed ranking movement as potential DMCA sabotage and encourages a wave of paranoia. I don't want to write that piece. Fake takedowns are one of many things that can happen to a site's search visibility, and probably not the most common. Real algorithmic changes, technical issues, and genuine content quality problems remain the dominant explanations for most traffic drops.

I also can't tell you, from public evidence, how widespread this is. What I can tell you is that the mechanism exists, the incentive exists, the barrier is near-zero, and the documented cases have specific characteristics — anonymous filers, unrelated source citations, targets who were reporting on competitive activity — that suggest coordination rather than accident.

Reasonable people can look at the same evidence and land in different places on how urgent this is. Where I'd push back on the more relaxed reading is this: the cases we see are the cases that were both large enough to notice and public enough to report. The base rate is almost certainly higher than the visible cases suggest. That's the shape of any attack that also erases evidence of itself.

---

What this means for how you work

For most UK businesses reading this, the practical implication isn't "install DMCA monitoring software." It's more foundational than that. If your organic search traffic is a material commercial channel — and for most of the businesses I work with, it is — then you need to be able to detect when specific high-value pages have been deindexed, and you need to know it fast.

That means monitoring your own indexed URL count against your sitemap on a regular schedule. It means having Search Console alerts configured for manual actions and coverage changes. It means, if you're a publisher, subscribing to Lumen queries for your own domain so that DMCA notices against your URLs are visible to you as they're filed. It means, if you ever discover a page has been removed on DMCA grounds you don't recognise, filing a counter-notice immediately rather than emailing Google support and waiting.

None of this is glamorous work. It's the kind of technical hygiene that a lot of SEO scopes skip because it doesn't produce visible wins. But when the attack surface expands the way it has here, defence-in-depth against removal — not just optimisation for ranking — becomes part of what a competent SEO scope looks like.

The wider point, for the industry, is worth stating plainly. The story we tell ourselves is that Google search is a meritocratic surface where quality content ranks and technical hygiene compounds. That story has always been partially true. What DMCA abuse illustrates is that the surface is also administrative — it can be manipulated by paperwork, not just by content and links. Any competitive market where paperwork is a viable attack vector will eventually see that paperwork weaponised. It's happening now. It will get worse before it gets better. And the fix, if one comes, will come from statutory reform or from Google unilaterally tightening its own process — neither of which anyone should be holding their breath for.

For now, the best you can do is assume the system works as designed, understand that "as designed" now includes a category of adversarial use it wasn't built for, and structure your monitoring accordingly.