{"course":{"slug":"cloud-and-shipping","title":"Shipping It","url":"https://addaly.com/learn/cloud-and-shipping","level":"intermediate","track":"build"},"lesson":{"slug":"when-somebody-reports-your-users","title":"The email about one of your users","url":"https://addaly.com/learn/cloud-and-shipping/when-somebody-reports-your-users","position":66,"of":74,"minutes":9,"answer":"Have one monitored address, preserve the evidence before you act on any serious report, verify who is really asking and give only what is demanded.","keyIdea":"Have one monitored address, preserve the evidence before you act on any serious report, verify who is really asking and give only what is demanded, and learn which copyright and disclosure regime applies to you before the first notice arrives rather than during it."},"body":{"format":"markdown","text":"## An inbox you have not prepared for\n\nAt some point a message arrives that is not about your code. Somebody says a user is impersonating them. A company says your user posted their copyrighted material. A parent says a child is being harassed. A police force or a court asks for data about an account. Somebody wants their own data deleted, and somebody else wants that same data preserved.\n\nThese arrive to whichever address is on your site, usually at an awkward moment, and the cost of improvising is high, for you and for the person the message is about. The preparation is small and it is mostly done in advance.\n\n## Have a place for it to land\n\nOne published address for abuse reports and legal notices, monitored by more than one person, with an auto-acknowledgement giving a reference number and a realistic timeframe. Do not use a personal address, and do not make it the same as support, or serious notices will queue behind password resets.\n\nWrite one page describing what you do when a report arrives: who reviews it, what evidence you collect, what actions are possible, and how the person reported is told. Publish the summary. A process nobody can see looks arbitrary from both sides.\n\n## Preserve first, decide second\n\nThe first action on any serious report is the same as in a security incident: keep the evidence. Snapshot the content, the account state, the timestamps and the relevant logs, before any moderation action changes them, and store that snapshot outside the normal deletion path.\n\nThis matters because your ordinary retention rules and a user's deletion request will otherwise remove the exact material the complaint concerns. This project's own design handles that with a legal-hold record: content and identifying details preserved as a separate row that survives deletion of the account and the content, held under a legal obligation rather than kept for convenience. The general principle transfers: a preservation obligation is a documented exception to your retention rules, applied narrowly, not a reason to keep everything.\n\n## Copyright notices, where the law differs\n\nA notice claiming your user has posted somebody else's work is common, and the correct handling depends entirely on where you are.\n\nThe shape of the disagreement, stated fairly: the United States regime offers platforms a safe harbour conditioned on removing material expeditiously on a valid notice, with a counter-notice procedure that can restore it. The European regime places different obligations on some platforms, including efforts to prevent re-upload for certain services, and its implementation varies by member state. India's rules impose their own timelines and intermediary conditions. Several countries are actively revising these rules, and how any of them apply to material generated by a model is unsettled: courts in multiple jurisdictions are hearing the question now, and the answers are not in yet.\n\nWhat that means for you: identify the regime you operate under before you receive your first notice, follow it, and do not invent a policy on the day. Nothing in this course is legal advice, and this is a subject where a wrong assumption is expensive.\n\nWhat you can do regardless of jurisdiction: require notices to be specific, keep a record of every one, tell the affected user what was removed and why unless you are legally barred from doing so, and offer a route to dispute it. Automatic removal on any unverified claim is how honest users get silenced by whoever complains loudest.\n\n## Requests from authorities\n\nThe rules differ by country and the specifics matter, so the general habits are what to take away:\n\n- **Verify the request.** Confirm it came from the body it claims, through a channel you can check. Impersonation of law enforcement to obtain user data is a documented technique and has succeeded against large platforms.\n- **Read what is actually demanded.** A request to preserve data is not a request to hand it over. Preservation is usually the immediate obligation; disclosure typically needs its own legal instrument.\n- **Give only what is asked for.** Over-disclosure is the common mistake and it is your user's privacy being spent.\n- **Get advice** when the request is broad, unusual, or from another country. This is the second place in this module where a professional is the right answer.\n- **Tell the user** if you are permitted to. Some orders prohibit it; where they do not, notifying is generally the right default and many platforms commit to it publicly.\n\n## Emergencies are different\n\nA credible threat to life (a suicide note, a specific threat of violence, material involving a child) is not a process question. Have the emergency route written down: which authority you contact in your country, what you preserve, and who can act at three in the morning. For the specific case of child sexual abuse material, most jurisdictions impose reporting duties on platforms and there are national bodies that receive those reports; find yours before you need it.\n\n## Keep the count\n\nOnce a quarter, count what arrived: reports by type, actions taken, appeals, reversals. Two reasons. It tells you whether your moderation is accurate, since a high reversal rate means the first decision is wrong too often. And several regimes now require transparency reporting past a size threshold, so the habit of counting is easier to start early than to reconstruct later."},"check":{"question":"A message arrives claiming a user posted copyrighted material. The user has meanwhile requested account deletion under your privacy policy. What is the correct first action?","options":[{"text":"Complete the deletion, since a privacy request takes precedence over a third-party claim","correct":false,"tempting":"Treats deletion rights as absolute; every regime that grants them also recognises exceptions where another obligation requires retention."},{"text":"Snapshot and preserve the relevant content and records outside the deletion path, then handle both requests","correct":true},{"text":"Remove the content immediately and close the report as resolved","correct":false,"tempting":"Acting on an unverified claim without a record or a route to dispute it is how legitimate content and users get removed by whoever complains."},{"text":"Suspend the deletion request until the complainant provides a court order","correct":false,"tempting":"Sets an unrealistic bar and delays a right the user may hold, when the narrow answer is to preserve the specific material rather than freeze everything."}]},"prev":{"slug":"the-day-you-are-breached","title":"The first day of a security incident","url":"https://addaly.com/learn/cloud-and-shipping/the-day-you-are-breached"},"next":{"slug":"managed-or-self-hosted","title":"What to run yourself, and what to pay for","url":"https://addaly.com/learn/cloud-and-shipping/managed-or-self-hosted"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'The email about one of your users', in Shipping It. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/cloud-and-shipping/when-somebody-reports-your-users (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"The email about one of your users","courseTitle":"Shipping It","module":{"index":7,"slug":"security-after-the-short-list","title":"Security after the short list"},"answer":null,"keyIdea":"Have one monitored address, preserve the evidence before you act on any serious report, verify who is really asking and give only what is demanded, and learn which copyright and disclosure regime applies to you before the first notice arrives rather than during it.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"an-inbox-you-have-not-prepared-for","runs":[{"text":"An inbox you have not prepared for"}]},{"t":"p","runs":[{"text":"At some point a message arrives that is not about your code. Somebody says a user is impersonating them. A company says your user posted their copyrighted material. A parent says a child is being harassed. A police force or a court asks for data about an account. Somebody wants their own data deleted, and somebody else wants that same data preserved."}]},{"t":"p","runs":[{"text":"These arrive to whichever address is on your site, usually at an awkward moment, and the cost of improvising is high, for you and for the person the message is about. The preparation is small and it is mostly done in advance."}]},{"t":"h2","id":"have-a-place-for-it-to-land","runs":[{"text":"Have a place for it to land"}]},{"t":"p","runs":[{"text":"One published address for abuse reports and legal notices, monitored by more than one person, with an auto-acknowledgement giving a reference number and a realistic timeframe. Do not use a personal address, and do not make it the same as support, or serious notices will queue behind password resets."}]},{"t":"p","runs":[{"text":"Write one page describing what you do when a report arrives: who reviews it, what evidence you collect, what actions are possible, and how the person reported is told. Publish the summary. A process nobody can see looks arbitrary from both sides."}]},{"t":"h2","id":"preserve-first-decide-second","runs":[{"text":"Preserve first, decide second"}]},{"t":"p","runs":[{"text":"The first action on any serious report is the same as in a security incident: keep the evidence. Snapshot the content, the account state, the timestamps and the relevant logs, before any moderation action changes them, and store that snapshot outside the normal deletion path."}]},{"t":"p","runs":[{"text":"This matters because your ordinary retention rules and a user’s deletion request will otherwise remove the exact material the complaint concerns. This project’s own design handles that with a legal-hold record: content and identifying details preserved as a separate row that survives deletion of the account and the content, held under a legal obligation rather than kept for convenience. The general principle transfers: a preservation obligation is a documented exception to your retention rules, applied narrowly, not a reason to keep everything."}]},{"t":"h2","id":"copyright-notices-where-the-law-differs","runs":[{"text":"Copyright notices, where the law differs"}]},{"t":"p","runs":[{"text":"A notice claiming your user has posted somebody else’s work is common, and the correct handling depends entirely on where you are."}]},{"t":"p","runs":[{"text":"The shape of the disagreement, stated fairly: the United States regime offers platforms a safe harbour conditioned on removing material expeditiously on a valid notice, with a counter-notice procedure that can restore it. The European regime places different obligations on some platforms, including efforts to prevent re-upload for certain services, and its implementation varies by member state. India’s rules impose their own timelines and intermediary conditions. Several countries are actively revising these rules, and how any of them apply to material generated by a model is unsettled: courts in multiple jurisdictions are hearing the question now, and the answers are not in yet."}]},{"t":"p","runs":[{"text":"What that means for you: identify the regime you operate under before you receive your first notice, follow it, and do not invent a policy on the day. Nothing in this course is legal advice, and this is a subject where a wrong assumption is expensive."}]},{"t":"p","runs":[{"text":"What you can do regardless of jurisdiction: require notices to be specific, keep a record of every one, tell the affected user what was removed and why unless you are legally barred from doing so, and offer a route to dispute it. Automatic removal on any unverified claim is how honest users get silenced by whoever complains loudest."}]},{"t":"h2","id":"requests-from-authorities","runs":[{"text":"Requests from authorities"}]},{"t":"p","runs":[{"text":"The rules differ by country and the specifics matter, so the general habits are what to take away:"}]},{"t":"ul","items":[[{"text":"Verify the request.","b":true},{"text":" Confirm it came from the body it claims, through a channel you can check. Impersonation of law enforcement to obtain user data is a documented technique and has succeeded against large platforms."}],[{"text":"Read what is actually demanded.","b":true},{"text":" A request to preserve data is not a request to hand it over. Preservation is usually the immediate obligation; disclosure typically needs its own legal instrument."}],[{"text":"Give only what is asked for.","b":true},{"text":" Over-disclosure is the common mistake and it is your user’s privacy being spent."}],[{"text":"Get advice","b":true},{"text":" when the request is broad, unusual, or from another country. This is the second place in this module where a professional is the right answer."}],[{"text":"Tell the user","b":true},{"text":" if you are permitted to. Some orders prohibit it; where they do not, notifying is generally the right default and many platforms commit to it publicly."}]]},{"t":"h2","id":"emergencies-are-different","runs":[{"text":"Emergencies are different"}]},{"t":"p","runs":[{"text":"A credible threat to life (a suicide note, a specific threat of violence, material involving a child) is not a process question. Have the emergency route written down: which authority you contact in your country, what you preserve, and who can act at three in the morning. For the specific case of child sexual abuse material, most jurisdictions impose reporting duties on platforms and there are national bodies that receive those reports; find yours before you need it."}]},{"t":"h2","id":"keep-the-count","runs":[{"text":"Keep the count"}]},{"t":"p","runs":[{"text":"Once a quarter, count what arrived: reports by type, actions taken, appeals, reversals. Two reasons. It tells you whether your moderation is accurate, since a high reversal rate means the first decision is wrong too often. And several regimes now require transparency reporting past a size threshold, so the habit of counting is easier to start early than to reconstruct later."}]}],"check":{"question":[{"text":"A message arrives claiming a user posted copyrighted material. The user has meanwhile requested account deletion under your privacy policy. What is the correct first action?"}],"options":[{"text":[{"text":"Complete the deletion, since a privacy request takes precedence over a third-party claim"}],"correct":false,"tempting":[{"text":"Treats deletion rights as absolute; every regime that grants them also recognises exceptions where another obligation requires retention."}]},{"text":[{"text":"Snapshot and preserve the relevant content and records outside the deletion path, then handle both requests"}],"correct":true,"tempting":null},{"text":[{"text":"Remove the content immediately and close the report as resolved"}],"correct":false,"tempting":[{"text":"Acting on an unverified claim without a record or a route to dispute it is how legitimate content and users get removed by whoever complains."}]},{"text":[{"text":"Suspend the deletion request until the complainant provides a court order"}],"correct":false,"tempting":[{"text":"Sets an unrealistic bar and delays a right the user may hold, when the narrow answer is to preserve the specific material rather than freeze everything."}]}],"order":[3,0,2,1],"why":null},"prev":{"slug":"the-day-you-are-breached","title":"The first day of a security incident","minutes":10},"next":{"slug":"managed-or-self-hosted","title":"What to run yourself, and what to pay for","minutes":9}}}