Section 230 Cases: Immunity, Algorithms, and Product Design

Cases interpreting Section 230 of the Communications Decency Act have built, over nearly three decades, a broad shield for online platforms that host user-generated content, along with a growing set of exceptions where that shield does not apply. The through-line runs from Zeran v. AOL in 1997, which read the statute expansively, to Anderson v. TikTok in 2024, which treated a recommendation algorithm as the platform’s own speech and stripped away immunity. In between sit the rulings that define when a website becomes a co-creator of unlawful content, when contract promises override the shield, when product-design claims can proceed, and when the sale of a physical product falls outside the statute altogether.

Why the Statute Exists: Cubby and Stratton Oakmont

Two early-1990s decisions produced the dilemma Section 230 was written to solve. In Cubby, Inc. v. CompuServe, Inc. (S.D.N.Y. 1991), a court held that CompuServe was a mere “distributor” of forum content it did not review, comparable to a bookstore, and bore no liability unless it knew or had reason to know of defamatory material.¹ In Stratton Oakmont, Inc. v. Prodigy Services Co. (N.Y. Sup. Ct. 1995), the opposite result followed because Prodigy moderated its “Money Talk” board: the court treated it as a “publisher” and subjected it to liability for user posts.²

The combined message punished platforms that tried to clean up their services. Congress responded with a 26-word core provision declaring that no provider of an “interactive computer service” shall be treated as the “publisher or speaker” of information provided by another, along with an explicit protection for good-faith moderation.³

Zeran v. AOL: The Foundation

The first major test of the new statute produced its most consequential ruling. Kenneth Zeran had been the target of a hoax: someone posted messages on an AOL bulletin board advertising offensive T-shirts about the Oklahoma City bombing and listed Zeran’s home phone number. Death threats flooded in. Even after Zeran notified AOL, similar postings continued for days.⁴

Zeran argued that AOL should at least face “distributor” liability once it knew about the posts. The Fourth Circuit rejected the theory in Zeran v. America Online, Inc. (4th Cir. 1997), holding that distributor liability is a “species of publisher liability” and that Section 230 forecloses both. Notice-based liability, the court reasoned, would force platforms to investigate countless messages and chill the self-regulation Congress wanted to encourage.⁵

Zeran became the template. Courts cited it for years to dismiss claims against platforms hosting defamatory posts, fraudulent listings, forged merchandise, discriminatory housing ads, and offensive user profiles, sweeping in services from eBay and Craigslist to Yahoo and MySpace.⁶

Roommates.com: When a Platform Helps Create the Content

The most significant early limit came in Fair Housing Council of San Fernando Valley v. Roommates.com, LLC (9th Cir. 2008) (en banc). The site required users to disclose sex, sexual orientation, and family status through pre-populated drop-down menus. Fair housing organizations sued, alleging the design facilitated discrimination.⁷

The Ninth Circuit ruled that Roommates.com had forfeited its Section 230 immunity by becoming a co-developer of the allegedly unlawful content. A site that provides “neutral tools” for users to post their own content stays protected. One that designs a system forcing users to provide specific discriminatory information becomes “responsible, in whole or in part, for the creation or development” of that information, making it an “information content provider” under the statute.⁸

The court drew a sharp line between the mandatory questionnaire and an open-ended “Additional Comments” text box. The comments section kept its immunity because the site had not structured or prompted the responses.⁹ The “material contribution” test set out in the decision is now the primary framework courts use to decide when a platform crosses from hosting content to creating it.

Barnes v. Yahoo: When a Platform Makes a Promise

A narrow but important exception involves contract-based claims. In Barnes v. Yahoo!, Inc. (9th Cir. 2009), a Yahoo employee promised a user she would “personally walk” a request to remove unauthorized, indecent profiles to the responsible division. The user relied on the promise and stopped pursuing other avenues; Yahoo did not remove the profiles for roughly two months.¹⁰

The Ninth Circuit held that Yahoo’s negligence in failing to remove the profiles was barred by Section 230 because that claim treated Yahoo as a publisher. A promissory estoppel claim was not barred. The user was suing Yahoo “as the counter-party to a contract, as a promisor who has breached,” not as a publisher of third-party content.¹⁰

Bolger v. Amazon: Physical Products Sold Through a Platform

Section 230 cases are not confined to speech. In Bolger v. Amazon.com, LLC (Cal. App. 2020), a California appeals court held Amazon strictly liable for a defective laptop battery sold by a third-party seller through the “Fulfilled by Amazon” program. The battery exploded and caused severe burns. Amazon stored the product in its warehouse, packaged it in Amazon-branded materials, processed the payment, and shipped it to the buyer. The court found Amazon was a “pivotal” link in the chain of distribution and that Section 230 did not apply because the claim concerned Amazon’s role in physically distributing a dangerous product, not any role as a publisher of online content.¹¹

Amazon petitioned the California Supreme Court for review, arguing the appellate court had made policy decisions that belonged to the legislature.¹² The ruling remains a leading precedent for treating e-commerce platforms that fulfill and ship physical goods as within the chain of distribution.

Lemmon v. Snap and Herrick v. Grindr: Product Design Claims

Lower courts have opened a significant category of cases based on how a platform is designed, rather than what its users post. Two decisions mark the boundary.

In Lemmon v. Snap, Inc. (9th Cir. 2021), the parents of three teenagers killed in a 2017 high-speed car crash sued Snapchat, alleging its “Speed Filter” and gamification features (trophies and streaks) incentivized reckless driving. The district court dismissed under Section 230; the Ninth Circuit reversed. The claim targeted Snap’s design of the app, not its role as a publisher of user content, and the duty to design a reasonably safe product was “fully independent” of any publishing function.¹³ Snapchat later removed the Speed Filter.¹⁴

Not every design theory succeeds. In Herrick v. Grindr LLC (2d Cir. 2019), Matthew Herrick sued after an ex-boyfriend created impersonating profiles that lured more than 1,000 strangers to his home and workplace. He framed his claims as product liability and failure to warn, arguing the app was defectively designed because it lacked safeguards against impersonation. The Second Circuit affirmed dismissal, ruling that the claims were fundamentally about Grindr’s failure to remove third-party content and that labeling platform architecture a “design defect” could not evade Section 230 when the alleged defects only mattered because of user posts.¹⁵

Read together, the cases draw a workable line. If a dangerous feature exists independently of any user content, a design claim can proceed. If the real complaint is that the platform failed to police what users posted, Section 230 still applies.

Force v. Facebook, Gonzalez, and Taamneh: The Algorithm Question

A recurring modern question is whether Section 230 protects a platform’s use of algorithms to recommend, organize, or amplify third-party content. In Force v. Facebook, Inc. (2d Cir. 2019), families of victims of terrorist attacks alleged that Facebook had hosted and amplified content inciting violence. The Second Circuit upheld the Section 230 defense, treating algorithmic recommendation as ordinary publisher activity under Zeran. Facebook, the court said, provided a “neutral means by which third parties can post information of their own independent choosing online.” Judge Katzmann, concurring in part, warned that courts had recognized “extensive immunity … for activities that were undreamt of in 1996.”¹⁶

The Supreme Court came closest to interpreting Section 230 in its October 2022 term. In Gonzalez v. Google LLC, the family of a victim of the 2015 Paris attacks alleged that YouTube’s recommendation algorithm helped spread ISIS content and amounted to material support for terrorism. In the companion case Twitter, Inc. v. Taamneh, families of victims of a 2017 ISIS attack on a nightclub in Istanbul sued under the Justice Against Sponsors of Terrorism Act. The Court ruled unanimously in Taamneh that the platforms’ general provision of services to the public, including algorithmic recommendations, was “too attenuated and passive” to constitute knowing, substantial assistance to a specific terrorist act.¹⁷

Because the plaintiffs’ counsel in Gonzalez had conceded that their complaint was “materially identical” to the one in Taamneh, the Court issued a three-page per curiam opinion declining to reach Section 230 at all.¹⁸ The Supreme Court has still never issued a decision interpreting the statute.

Anderson v. TikTok: Algorithms as First-Party Speech

The Third Circuit pushed algorithmic liability further in Anderson v. TikTok, Inc. (2024). The mother of a ten-year-old who died attempting the “Blackout Challenge” sued TikTok, alleging its recommendation algorithm promoted the video to her daughter through the “For You Page.” The court held that TikTok’s algorithm constitutes the platform’s own “expressive activity” or “first-party speech.” Because Section 230 immunizes only “information provided by another information content provider,” the algorithm’s curation and promotion of specific content to specific users fell outside that protection.¹⁹

The court leaned on the Supreme Court’s reasoning in Moody v. NetChoice, LLC (2024), which had characterized algorithmic curation as editorial discretion protected by the First Amendment. The Anderson court used that same characterization to reach a different conclusion about immunity: if the algorithm is TikTok’s own speech, then the harm it causes is TikTok’s responsibility, not something shielded by Section 230.²⁰ TikTok has sought rehearing by the full Third Circuit.

The Social Media Addiction Litigation

The largest active test of Section 230’s limits is In re: Social Media Adolescent Addiction/Personal Injury Products Liability Litigation (MDL No. 3047), a consolidated action in the Northern District of California. Filed in 2022, the case combines individual claims, school district suits, and state attorney general actions against Meta, Instagram, Snapchat, TikTok, YouTube, Google, and Alphabet, alleging the platforms are defectively designed to maximize screen time and induce addictive behavior in minors.²¹

Judge Yvonne Gonzalez Rogers has drawn distinctions consistent with Lemmon and Herrick. Claims about the platforms’ failure to provide effective parental controls, lack of time-restriction options, and use of appearance-altering filters were allowed to proceed because, in the court’s words, “there is a defect and a harm separate and apart from publication of any third-party content.” Claims based on the platforms’ use of algorithms to promote addictive engagement were dismissed as attempts to hold platforms liable for publishing decisions.²²

In a related California state court bellwether, a jury in March 2026 found Meta and Google liable for negligence in designing features that contributed to a plaintiff’s mental health distress. The jury awarded $3 million in compensatory damages and $3 million in punitive damages, rejecting the Section 230 defense on the ground that the platforms’ “interactive operational features” harmed users regardless of the specific third-party content viewed.²² The federal MDL has a jury trial scheduled for February 2027.²¹

Walters v. OpenAI: Generative AI Enters the Picture

Generative AI raises a distinct question: if an AI system produces false or harmful content on its own, rather than hosting what a user posted, does the company behind it have any Section 230 defense to speak of? The leading case is Walters v. OpenAI, LLC (Ga. Super. Ct. 2025). Radio host Mark Walters sued after ChatGPT falsely told a journalist that Walters had been accused of fraud and embezzlement. OpenAI failed to obtain dismissal at the motion-to-dismiss stage, with the court finding that OpenAI actively promoted ChatGPT’s reliability in ways that induced users to treat its outputs as factual.²³

On May 19, 2025, however, the court granted summary judgment for OpenAI. It ruled that no reasonable user in the journalist’s position would have understood ChatGPT’s output as “actual facts” given the tool’s known hallucination risks and disclaimers, that Walters had not shown OpenAI acted negligently or with actual malice, and that Walters himself conceded he had suffered no actual damages.²³

Legal scholars have noted that existing Section 230 frameworks may not map neatly onto generative AI. Systems that retrieve and summarize existing data, like search engines, may be treated as neutral tools, while those that generate original content through predictive algorithms may look more like publishers or content creators.²⁴ Courts have not yet definitively placed generative AI on that spectrum.

Statutory Carve-Outs Applied by Courts

Section 230 carries built-in exceptions for federal criminal law, intellectual property claims, and electronic privacy violations. The most significant additional exception came with the Fight Online Sex Trafficking Act (FOSTA) in 2018, which removed Section 230 protection for claims related to sex trafficking. In Does 1-6 v. Reddit, Inc. (9th Cir. 2022), the court read the exception narrowly. To overcome Section 230 under FOSTA, a plaintiff must show that the website’s own conduct independently violated the underlying criminal statute, not just that the site hosted or profited from third-party content related to trafficking.²⁵

The TAKE IT DOWN Act, enacted in May 2025, targets non-consensual intimate imagery, including deepfakes, by requiring platforms to remove such content within 48 hours of a valid request. It gives enforcement authority to the Federal Trade Commission and creates federal criminal penalties for publishing or threatening to publish non-consensual intimate images, with sentences of up to two years for adult-related offenses and three years for material involving minors.²⁶

Moody v. NetChoice: The First Amendment Backdrop

Not a Section 230 case in the strict sense, the Supreme Court’s 2024 decision in Moody v. NetChoice, LLC (consolidated with NetChoice, LLC v. Paxton) has nonetheless reshaped the doctrine around it. The cases involved facial First Amendment challenges to Florida and Texas laws restricting large platforms’ ability to moderate content.

Vacating and remanding, the Court reaffirmed that when platforms curate, filter, or prioritize content, they engage in “expressive activity” protected by the First Amendment. Justice Kagan, writing for the majority, held that ordering a platform to carry content against its editorial judgment raises the same concerns as ordering a newspaper to print a reply. The Court rejected Texas’s argument that it had a valid interest in “correcting the mix of viewpoints” on private platforms.²⁷

The effect on Section 230 litigation runs in two directions. The decision strengthened the argument that platforms have constitutional rights to make editorial choices. It also gave lower courts, as the Third Circuit showed in Anderson, a way to strip Section 230 protection by treating algorithmic curation as the platform’s own first-party speech rather than someone else’s information.

Where the Case Law Stands

The basic rule from Zeran is intact: platforms generally cannot be held liable for what their users create. Around that rule, courts have built recognizable exceptions. Platforms that help develop unlawful content lose immunity under the Roommates.com material-contribution test. Contract-based claims survive under Barnes. E-commerce platforms that fulfill and ship physical products face strict product liability under Bolger. Product-design claims proceed under Lemmon when the harm is independent of user content, and stop under Herrick when it is not. And Anderson v. TikTok has opened a new front by treating algorithmic curation as the platform’s own speech, potentially outside Section 230’s reach entirely. The 2026 bellwether verdict against Meta and Google, the federal MDL trial set for February 2027, and the unresolved status of generative AI mean the boundaries of Section 230 will keep being redrawn case by case.

1
Yale Journal on Regulation. Interpreting the Ambiguities of Section 230
2
Brookings Institution. Interpreting the Ambiguities of Section 230
3
Electronic Frontier Foundation. Section 230 Legislative History
4
Electronic Frontier Foundation. Zeran v. America Online, Inc.
5
Justia. Zeran v. America Online, Inc., 958 F. Supp. 1124
6
Electronic Frontier Foundation. CDA 230 Legal Cases
7
U.S. Court of Appeals for the Ninth Circuit. Fair Housing Council v. Roommates.com, LLC
8
Electronic Frontier Foundation. Fair Housing Council v. Roommates.com
9
FindLaw. Fair Housing Council v. Roommates.com, LLC
10
U.S. Court of Appeals for the Ninth Circuit. Barnes v. Yahoo!, Inc.
11
Justia. Bolger v. Amazon.com, LLC
12
UNC Journal of Law and Technology. Did California Court Overstep Its Authority in Amazon Marketplace Liability Case
13
U.S. Court of Appeals for the Ninth Circuit. Lemmon v. Snap, Inc.
14
Harvard Journal of Law and Technology. Lemmon v. Snap, Inc.
15
FindLaw. Herrick v. Grindr LLC
16
Congressional Research Service. Section 230: An Overview
17
SCOTUSblog. Twitter, Inc. v. Taamneh
18
U.S. Supreme Court. Gonzalez v. Google LLC, 598 U.S. 617
19
U.S. Court of Appeals for the Third Circuit. Anderson v. TikTok, Inc.
20
EPIC. Anderson v. TikTok Third Circuit Analysis
21
U.S. District Court, Northern District of California. In Re Social Media Adolescent Addiction MDL
22
Lawfare. Does Product Liability Offer a Route Around Section 230
23
Harvard Law Review. Beyond Section 230: Principles for AI Governance
24
University of Chicago Business Law Review. Generative AI Meets Section 230
25
Morrison Foerster. Ninth Circuit FOSTA Restriction on Section 230
26
University of Baltimore Law Review. The Take It Down Act’s 48-Hour Deadline
27
U.S. Supreme Court. Moody v. NetChoice, LLC