Date of Hearing: June 23, 2026

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:HR 117 (

Author:Bauer-Kahan and Dixon) – As Introduced Ver:June 9, 2026

SUBJECT: Section 230 Of The Federal Communications Decency Act Of 1996

SYNOPSIS

Section 230 of the federal Communications Decency Act of 1996, the federal law that protects online platforms from liability for harms arising from third-party content, has been hailed as the law that created the modern internet, fostering free expression online and allowing an array of innovative services and spaces to flourish, from search engines to social media. It has also insulated platforms from liability for harms occurring on their platforms in an array of cases that shock the conscience.

Thirty years after its enactment, there is growing bipartisan call for reform to the statute. In the words of Justice Clarence Thomas, “[i]n the platforms’ world, they are fully responsible for their websites when it results in constitutional protections, but the moment that responsibility could lead to liability, they can disclaim any obligations and enjoy greater protections from suit than nearly any other industry.”^{^[1]}

In connection with the Legislature’s pronouncement of June 23rd, 2026, as Social Media Harms Victim Remembrance Day (ACR 224, Bauer-Kahan, Dixon), this bipartisan resolution calls for support for the reform effort, specifically by calling on Congress to adopt a pending proposal introduced by Members of Congress from across the aisle to sunset section 230 over the course of two years, ensuring that large technology companies that have benefitted from this immunity shield will participate in good faith efforts to reform the statute in a targeted manner.

The measure is author-sponsored and supported by, among others, Children Now, California Initiative for Technology & Democracy, Mothers Against Media Addiction, Parents RISE!, and Parents Together Action. It has no registered opposition.

EXISTING LAW:

Establishes, under Section 230 of the Communications Decency Act, that no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. (47 U.S.C. § 230(c)(1).)
Provides that no provider or user of an interactive computer service may be held liable on account of any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected. (Id. at (c)(2)(A).)
Provides that no cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with the provisions described above. (Id. at (e)(3).)
Defines for these purposes:
1. “Interactive computer service” as any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions. (Id. at (f)(2).)
2. “Information content provider” as any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service. (Id. at (f)(3).)

THIS MEASURE:

Includes the following recitals:
1. Section 230 of the federal Communications Decency Act of 1996, which was intended to create a liability shield for neutral online platforms from most harms arising from third-party content, helped create the modern internet, fostering free expression online and allowing an array of innovative services and spaces to flourish, from search engines to social platforms; and
2. Thirty years after its enactment, this well-intentioned law has become outdated and has led to destructive real-world consequences by absolving Big Tech companies of legal responsibility for their own design decisions and their own facilitation of third-party abuse, which is a protection not available to brick-and-mortar businesses; and
3. Enacted in response to court decisions suggesting that online platforms could face liability for user-generated content if they engage in any content moderation, Section 230 was intended to promote development of the nascent internet and encourage “Good Samaritan” efforts by platforms to voluntarily screen objectionable material; and
4. Section 230(c)(1) provides that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” Section 230(c)(2) protects platforms from liability for good-faith efforts to restrict access to material that is “obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable,” and Section 230(e)(3) preempts enforcement of contrary state laws; and
5. Section 230 was intended to encourage and empower online platforms to self-regulate harmful and offensive material by immunizing them from liability for decisions made in the course of responsible content moderation but instead has been used by Big Tech companies as a license to take a hands-off approach to content moderation and willfully disregard known abuses on their platforms; and
6. Section 230 was intended to provide protections only for the types of online services offering users a great deal of control over the information that they receive but instead has been used by Big Tech companies to shield new online products being willfully designed and deployed in a manner that deprives users of that control; and
7. Courts have interpreted Section 230 expansively, shielding Big Tech companies from civil liability in a vast range of cases, including ones involving harassment and stalking, sexual exploitation and abuse, identity theft, scams against seniors, organized crime, the sale of illegal drugs, child sexual abuse, serial predators on dating apps, dissemination of child sexual abuse material, online retailers selling suicide kits, incitement to violence, and terrorist recruitment, and enabled these market-dominant platforms to disregard even grave offline consequences as acceptable collateral damage of their online growth; and
8. Courts have applied Section 230 immunity even in cases where platforms have affirmatively solicited, edited, promoted, or algorithmically curated harmful content, refused to remove illegal material after repeated notices, or profited from illegal activities facilitated through their services; and
9. This immunity regime denies victims justice and has undermined incentives for today’s most powerful companies to implement reasonable safety features, act on actual knowledge of illegal material, avoid making material misrepresentations to consumers, or design products that minimize foreseeable harms to users, which effectively transfers the costs of platform-facilitated abuse onto victims while platforms reap historic profits; and
10. The harms facilitated by platforms and shielded by Section 230 fall disproportionately on vulnerable populations, including children, women, and minorities who face online abuse, harassment, stalking, nonconsensual intimate imagery, exploitation, and other violations that silence their voices and chill their participation in online life; and
11. Section 230’s sweeping immunity has kept the public in the dark about platform design choices and safety practices, as most cases are dismissed before evidence can be discovered, with harmful practices often revealed only through congressional investigations, whistleblower disclosures, or not at all; and
12. Section 230’s broad grant of immunity stands in sharp contrast to regulatory frameworks in other jurisdictions, including the European Union’s Digital Services Act, which require platforms to implement notice-and-takedown procedures and other accountability measures; and
13. The United States Supreme Court has declined multiple opportunities to construe Section 230 more narrowly in line with its original intent, despite divided courts’ requests for clarification, making legislative action necessary to address the expansive judicial interpretation of the immunity shield’s application; and
14. Three decades of experience with Section 230 has demonstrated that voluntary promises from Big Tech companies have not adequately addressed platform-facilitated harms, and that targeted and surgical reform of Section 230 is necessary to restore fundamental principles of legal responsibility, decades of state and federal product liability and negligence jurisprudence, and parity with brick-and-mortar businesses, which must internalize the costs of foreseeable harms caused by their products and services through liability insurance, safety innovations, a reasonable degree of transparency, and responsible business practices; and
15. To the extent some courts allowed cases to proceed, Big Tech is now taking new measures to avoid liability and frustrate plaintiffs, including by adding new terms to their terms of service agreements and enforcing forum selection clauses, arbitration clauses, choice-of-law, class action waivers, and jury waivers; and
16. With the advancement of generative artificial intelligence, Big Tech has begun claiming in court that the output of its own chatbots are entitled to Section 230 immunity despite it clearly not being the type of third-party content Section 230 was designed to address; and
17. California, as home to many of the world’s most profitable Big Tech companies and as a state with strong consumer protection and civil rights traditions, has a compelling interest in ensuring that federal law does not shield powerful corporations from accountability for facilitating egregious harms inflicted on California residents; and
18. A growing, bipartisan coalition, including multiple presidents, state attorneys general, members of Congress from both parties, legal scholars, victim advocates, and some technology industry leaders, has called for Section 230 reform to restore basic and reasonable accountability for a corporation’s own actions and representations; and
19. In December 2025, United States Senators Lindsey Graham (R-South Carolina), Dick Durbin (D-Illinois), Chuck Grassley (R-Iowa), Sheldon Whitehouse (D-Rhode Island), Josh Hawley (R-Missouri), Amy Klobuchar (D-Minnesota), Marsha Blackburn (R-Tennessee), Richard Blumenthal (D-Connecticut), Ashley Moody (R-Florida), and Peter Welch (D-Vermont) introduced the Sunset Section 230 Act, which would repeal Section 230 two years after the date of enactment; and
20. Congresswoman Harriet Hageman (R-Wyoming) introduced the Sunset to Reform Section 230 Act; and
21. The two-year sunset window is not intended to remove all reasonable protections but rather to provide a firm deadline to ensure that Big Tech participates in Section 230 reform efforts in good faith in order to restore appropriate balance and accountability.
Calls upon Congress to reform Section 230 of the federal Communications Decency Act of 1996 to restore meaningful accountability for powerful online companies, beginning with the first step of passing the bipartisan effort to sunset Section 230.

COMMENTS:

1) Authors’ statement. According to the authors:

While Section 230 served a valuable purpose in the development of the internet, three decades after its enactment the law has become outdated. Its expansive grant of immunity has enabled some of history’s most profitable companies to disregard or facilitate foreseeable harms as an acceptable cost of growth, with courts dismissing cases involving harassment and stalking, sexual exploitation, child sexual abuse material, scams targeting seniors, terrorist recruitment, and other serious offenses. Unlike brick-and-mortar businesses, which can face significant liability for certain foreseeable harms occurring on their premises or in connection with their products, dominant platforms generally face no equivalent legal pressure to invest in effective safety measures or responsible product design. The harms fall disproportionately on children, women, LGTBQ+ individuals, and non-white people. Meanwhile, the Supreme Court has declined multiple opportunities to narrow Section 230’s application, making congressional action necessary.

This resolution calls on Congress to reform Section 230, starting with passage of the bipartisan Sunset Section 230 Act, introduced by Senators Dick Durbin and Lindsey Graham. That legislation would sunset Section 230 after two years, creating a window for Congress to enact targeted, surgical reforms that restore basic principles of legal accountability. By urging this first step, the Legislature signals California’s support for a structured federal process to reexamine and modernize the immunity framework, preserving what works while closing the loopholes that have shielded platforms from accountability for decades.

2) Section 230: with great power comes limited responsibility. Section 230 of the federal Communications Decency Act of 1996 (CDA), which creates a liability shield for online platforms from harms arising from third-party content, has been hailed as the law that created the modern internet, fostering free expression online and allowing an array of innovative services and spaces to flourish, from search engines to social media.^{^[2]} It has also come with a destructive side, absolving platforms of responsibility for virtually all third-party abuse facilitated by their services—“a protection not available to print material or television broadcasts.”^{^[3]} As University of Virginia School of Law Professor Danielle Keats Citron writes:

A brick-and-mortar business that makes it easy for third parties to stalk and invade the privacy of victims faces tort liability for enabling the abuse. A hard-copy magazine that published user-submitted nonconsensual porn encounters a blizzard of privacy lawsuits. But when those activities happen online, companies are shielded from liability. We have Section 230 to thank for that.^{^[4]}

Such harms, Professor Citron argues, are disproportionately visited upon women, children, LGTBQ+ individuals, and non-white people, depriving them of the opportunity to participate fully in online life at the expense of their civil rights and liberties. This section addresses the purpose and text of Section 230, key judicial precedents that interpreted it broadly, and stakeholder calls for reform.

Congress’s intent: encourage Good Samaritans to self-regulate. Section 230’s initial purpose was to encourage online companies to engage in good-faith moderation of offensive content. It was prompted by Stratton Oakmont v. Prodigy Servs. Co.,^{^[5]} a New York State trial court case in which Stratton Oakmont – of Wolf of Wall Street infamy – sued Prodigy, a social network, for allegedly defamatory statements posted on Prodigy’s bulletin board by a user. At issue was the proper analogy to brick-and-mortar counterparts under longstanding defamation law. Publishers, such as book or newspaper publishers, are strictly liable for publishing defamatory content. By contrast, distributors, such as book stores, libraries, or newsstands, do not face such liability unless they know or have reason to know of the defamation.^{^[6]} The court concluded that Prodigy was subject to publisher liability because it functioned like a newspaper by advertising and implementing a practice of controlling content posted on its site. The court contrasted Prodigy’s active content moderation with a case that found that CompuServe, which did not screen posts on its site, operated more like a newsstand and thus was subject to the more lenient distributor liability standard.^{^[7]}

Recognizing that the logic of this ruling could create a perverse incentive for sites to altogether eschew content moderation,^{^[8]} Congress amended section 230 into the CDA, a broader effort to restrict minors’ access to online pornography that, except for Section 230, was eventually invalidated for violating the First Amendment.^{^[9]} The sponsors of Section 230, then-Representatives Ron Wyden (D-Ore) and Chris Cox (R-Calif), were optimistic that the internet could largely self-regulate without government interference. According to Cox, their aim was to “protect[] speech and privacy on the internet from government regulation, and incentiviz[e] blocking and filtering technologies that individuals could use to become their own censors in their own households.”^{^[10]}

The crux of Section 230 is contained in subdivision (c), which is entitled “Protection for ‘Good Samaritan’ blocking and screening of offensive material.” First, subdivision (c)(1) addresses the Stratton Oakmont holding by specifically shielding platforms from publisher liability: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”^{^[11]} Second, to encourage content moderation, subdivision (c)(2) provides a safe harbor for “any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.” Section 230 also preempts enforcement of contrary state laws^{^[12]} and enumerates exemptions for enforcement of federal criminal statutes, intellectual property laws,^{^[13]} communications privacy laws, and knowing facilitation of sex trafficking.^{^[14]}

Courts’ interpretation: near-blanket protection for Bad Samaritans. Section 230(c)(1)’s liability shield has been applied expansively to immunize platforms from virtually all lawsuits arising from third-party content. A key early ruling extended this immunity to a website’s knowing failure to remove defamatory content. Zeran v. Am. Online, Inc.^{^[15]} held that AOL was not liable for failing to remove anonymous posts claiming that Oklahoma businessman Kenneth Zeran was selling merchandise with offensive slogans celebrating the 1995 Oklahoma City bombing. Inundated with angry calls and death threats and unable to identify the anonymous poster, Zeran sued AOL, claiming that it was liable as a distributor for failing to timely remove the posts after he had repeatedly reported them. AOL invoked Section 230, claiming that it immunized computer service providers from all claims based on third-party posts.^{^[16]} The Fourth Circuit agreed, stating:

By its plain language, § 230 creates a federal immunity to any cause of action that would make service providers liable for information originating with a third-party user of the service. Specifically, § 230 precludes courts from entertaining claims that would place a computer service provider in a publisher’s role. Thus, lawsuits seeking to hold a service provider liable for its exercise of a publisher’s traditional editorial functions – such as deciding whether to publish, withdraw, postpone or alter content – are barred.^{^[17]}

Because removing content was a traditional editorial function, the imposition of distributor liability in this context was “merely a subset, or a species of publisher liability, and is therefore also foreclosed by § 230.”^{^[18]} Leaving distributor liability intact “could produce an impossible burden for service providers, who would be faced with ceaseless choices of suppressing controversial speech or sustaining prohibitive liability.”^{^[19]} Thus, Zeran, like many victims of online harassment, was left without recourse for activities that, in the offline world, would result in a publisher’s liability.

This seminal ruling “set[] the template for all future courts.”^{^[20]} Following its logic, courts have extended Section 230 immunity well beyond the defamation context, consistently concluding that online intermediaries are not liable for harms originating from third-party content.

In Ramey v. Darkside Products, Inc.,^{^[21]} for example, the court found Section 230 blocked a nude dancer’s lawsuit against an online advertising service that displayed intimate photos of the dancer that were posted without her consent, even though it had actual notice that the photographs were a highly offensive intrusion on her privacy.^{^[22]}

In Jones v. Dirty World Entertainment Recordings LLC,^{^[23]} the court held that section 230 blocked a defamation action by Sarah Jones, a cheerleader and public school teacher, who was featured in anonymous postings in The Dirty, an online tabloid. The postings showed pictures of her with a football player and stated she had “slept with every other Bengal Football player.” The website’s administrator not only refused to remove the content, he added his own degrading commentary. Nevertheless, the court held that Section 230 immunity applied because the administrator, even though he selected the statements for publication, did not materially contribute to their defamatory content.^{^[24]}

In GoDaddy.com, LLC v. Toups,^{^[25]} the court found Section 230 blocked a class action suit by a group of women against GoDaddy, an internet service provider, for hosting “revenge porn” websites that published sexually explicit photographs of the women without their consent. The plaintiffs asserted that section 230 “‘was never intended to bless criminal activities occurring on websites’” and does not protect publishing content that is unlawful or unprotected by the First Amendment.^{^[26]} The court rejected this argument, concluding that Section 230 provides immunity “even when the posted content is illegal, obscene, or otherwise may form the basis of a criminal prosecution.”^{^[27]}

Section 230 has also been held to bar claims for negligence—the most common type of tort lawsuit in the brick-and-mortar world^{^[28]}—against platforms for failing to take minimal precautions to protect their users against foreseeable harms by third parties. This has been especially consequential for large social media companies, which did not exist when Section 230 was enacted but today have billions of users and are among the most profitable companies in the world.

In Doe v. MySpace, Inc.,^{^[29]} a 13-year-old girl was able to create an adult account on MySpace, thereby circumventing privacy defaults. An adult male user contacted, arranged to meet, and sexually assaulted her. The court held that section 230 barred the victim’s lawsuit against MySpace for failing to take reasonable precautions to ensure minors’ safety, because it was “merely another way of claiming that MySpace was liable for publishing the communications and they speak to MySpace’s role as a publisher of online third-party-generated content.”^{^[30]}

In Beckman v. Match.com,^{^[31]} a victim of a sexual assault and knife attack sued the online dating service, arguing it negligently exposed her to “‘a serial murderer who used the website as a vessel to facilitate attacks on unsuspecting women.’”^{^[32]} Citing Doe v. MySpace, the court concluded that the victim’s claims traced back to Match.com’s status as a publisher of third-party dating profiles.^{^[33]}

In Herrick v. Grindr,^{^[34]} Matthew Herrick’s ex-boyfriend created fake profiles under Herrick’s name on Grindr, a dating app for gay and bisexual men. The profiles advertised his “rape fantasies,” leading to hundreds of strangers coming to Herrick’s home and workplace, interpreting his resistance as part of the supposed fantasy. Herrick repeatedly pleaded with Grindr to remove the fake profiles, but it took no action.^{^[35]} The court rejected Herrick’s assertion that Grinder provided a defective product and had failed to warn him of the danger, stating that these claims were “inextricably related to Grindr’s role in editing or removing offensive content — precisely the role for which Section 230 provides immunity.”^{^[36]} Herrick’s lawyer, Carrie Goldberg, later stated that Section 230 is “the single greatest enabler of every asshole, troll, psycho, and perv on the internet.”^{^[37]}

Using Section 230, Backpage.com was able to shield itself from several lawsuits brought by young sex trafficking victims.^{^[38]} Backpage wasn’t simply a passive conduit for the sexual exploitation of minors; it helped traffickers avoid restrictions on sex ads with minors. A Senate investigation revealed that “Backpage regularly edited ads to remove keywords that would identify them as objectionable or illegal, rather than removing them outright—so ads with words like ‘teenage,’ ‘rape,’ and ‘little girl,’ would still be published, just with those words removed.”^{^[39]} While this led to the passage of the Stop Enabling Sex Traffickers Act and the Allow States to Fight Online Sex Trafficking Act (SESTA/FOSTA), which creates an exemption from Section 230 for knowing facilitation of sex trafficking,^{^[40]} the high bar set for proving a platform has actual knowledge of the harm has made the exemption difficult to enforce.^{^[41]} As a result, the CDA – which was intended to protect children from online harms – continues to insulate from liability “social networks that have served as hunting grounds for child predation.”^{^[42]}

Discussing cases such as these, Professor Citron and George Washington University School of Law Professor Mary Anne Franks write that “state and lower federal courts have extended Section 230’s legal shield far beyond what the law’s words, context, and purpose support. Platforms have been shielded from liability even when they encourage illegal action, deliberately keep up manifestly harmful content, or take a cut of users’ illegal activities.”^{^[43]} “The common thread weaving through these cases is that the courts have sapped §230’s Good Samaritan concept of its meaning.”^{^[44]}

Broader impacts of section 230. Proponents of Section 230 argue that it has been crucial to the development of the modern internet. Free from the specter of liability, search engines could link to all manner of websites, social media companies could welcome all subscribers, and online forums could allow all manner of discourse.^{^[45]} But this has come with immense tradeoffs, “particularly for women, children, and minorities who lose their ability to speak, work, and love.”^[46] Professor Citron argues:

Just as the law’s broad interpretation frees platforms to publish accounts of current events, it gives them license to encourage online abuse that silences victims. It provides social media platforms a free pass to host posts by civil rights protestors and sexual predators. It lets sites solicit political commentary and hidden-camera feeds. It enables companies to design their platforms to enhance the visibility of user-generated art and deepfake sex videos. Section 230 is why the internet is filled with war footage and death threats, encyclopedia entries and rape videos, restaurant reviews and nonconsensual pornography.

[. . .]

We must not lose sight of the fact that although platforms don’t shoulder responsibility for online abuse that they enable, someone is paying. Victims of online abuse experience never-ending privacy invasions, emotional suffering, and reputational damage. They have difficulty getting and keeping jobs. Their family, friends, and colleagues abandon them when they most need support. They stop engaging online and offline their self-expression is chilled their voices are silenced. Section 230 ensures that victims cannot sue the entities that have solicited their suffering.^{^[47]}

Defamation, privacy invasions, and sexual depredations are by no means the only harms that Section 230 has shielded. Section 230 has blocked liability for a vast range of harms,^[48] including fraudulent scam ads on Facebook and Instagram,^[49] the unlawful online sale of firearms,^[50] the lethal sale of heroin laced with fentanyl to a teenager who was connected to the dealer after posting a request to “score heroin”,^[51] algorithmically amplified terrorist content,^[52] and Amazon’s removal of consumer reviews warning about the dangers of sodium nitrite “suicide kits” in a case involving the deaths by suicide of two teenagers.^[53]

By externalizing these costs onto users, digital platforms enjoy what Harvard Law Professor Rebecca Tushnet has termed “power without responsibility.”^{^[54]} Urging Section 230 reform before Congress, Professor Franks argued:

Rather than encouraging the innovation and development of measures to fight online abuse and harassment, (c)(1) removes incentives for online intermediaries to deter or address harmful practices no matter how easily they could do so. It effectively grants powerful corporations a super-immunity, encouraging them to pursue profit without internalizing any costs of that this pursuit. It eliminates real incentives for tech corporations to design safer platforms or more secure products. Section 230(c)(1)'s preemptive immunity ensures that no duty of care ever emerges in a vast range of online scenarios and eliminates the incentives for the best positioned party to develop responses to avoid foreseeable risks of harm.^{^[55]}

This free pass creates a “‘moral hazard,’ ensuring that the multibillion-dollar corporations that exert near-monopoly control of the Internet are protected from the costs of their risky ventures even as they reap the benefits.”^{^[56]}

Section 230’s sweeping grant of immunity stands in contrast with the obligations imposed on offline actors, placing them at a competitive disadvantage relative to their online counterparts. It impacts the enforcement of laws abroad,^{^[57]} and has stunted the development of the law in the US, depriving courts of their traditional function of developing and shaping remedies tailored to novel problems.

Section 230 has also kept the public in the dark about the safety practices of platforms. As Catholic University Law Professor Mary Graw Leary recently testified before Congress, most Section 230 cases are dismissed at the initiated pleading stage, before evidence can be discovered by plaintiffs. As a result, many of the harmful practices of some online platforms have been discovered only through Congressional investigations – such as the Backpage investigation – and through the revelations of whistleblowers.^{^[58]} Facebook whistleblower Frances Haugen, who testified before Congress that she believed the platform prioritized profit over the wellbeing and safety of users, specifically recommended reforming Section 230.^{^[59]}

Calls for reform. Nearly three decades into its existence, Section 230 has been consistently applied in a manner that shields companies, some of which are the most profitable in history, that knowingly or recklessly aid abusers and cause victims harm. The free market has not fixed this problem. While some cases have created cracks in the Section 230 shield (see Comment #3),^{^[60]} and numerous judges including Justice Clarence Thomas have questioned its broad application,^{^[61]} the Supreme Court has declined several opportunities to impose limits on Section 230.^{^[62]} As a result, a growing, bipartisan chorus – including Presidents Biden and Trump,^{^[63]} the National Association of Attorneys General,^{^[64]} and several Members of Congress^{^[65]} – has called for Section 230 reform. As Section 230 litigator Carrie Goldberg writes:

Most industries would also like to be free from liability for harms their product, services or staff could cause their customers. But the reality is, legal responsibility for one’s products and services is the cost of doing business and drives safety innovation. Other business owners purchase liability insurance and—for the sake of reputation, low insurance premiums and morality—run businesses that don’t harm customers or the general public.

All in all, Section 230 is a government subsidy to the industry least in need and least deserving of it. It’s time to fix 230—and if the Supreme Court won’t do it, legislators must act.^{^[66]}

3) Cracks in the shield. Courts have emphasized that Section 230 immunity is not limitless.^{^[67]} Section 230 is not “an all-purpose get-out-of-jail-free card”^{^[68]} that “create[s] a lawless no-man’s-land on the internet.’”^{^[69]} The Ninth Circuit has “consistently eschewed an expansive reading of the statute that would render unlawful conduct ‘magically . . . lawful when [conducted] online,’ and therefore ‘giv[ing] online businesses an unfair advantage over their real-world counterparts.’”^{^[70]}

Under Ninth Circuit precedent, Section 230(c)(1) immunity exists for “(1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker (3) of information provided by another information content provider.”^{^[71]} With respect to the third prong, Section 230 protection extends only to claims that “derive[] from the defendant’s status or conduct as a publisher or speaker.”^{^[72]} If, instead, the claim “springs from something separate from the defendant’s status as a publisher, such as from . . . obligations the defendant has in a different capacity,” Section 230 immunity does not apply.^{^[73]} Examples of such cases include:

Yahoo’s promise and subsequent failure to remove revenge pornography and defamatory content, as the asserted liability derived from contract principles.^{^[74]}
A networking website owner’s unlawful failure to warn a woman who was raped by two users of the website who posed as talent scouts to lure her to a fake audition, where it was alleged that an outside source had informed the owner about the predatory scheme.^{^[75]}
A city ordinance that required short-term home rental websites to refrain from completing booking transactions for properties not registered with the city, and to refrain from collecting or receiving a fee for “facilitating or providing services ancillary to a vacation rental or unregistered home-share.”^{^[76]}
Snap’s allegedly defectively-designed app, which promoted content that encouraged two teen boys who died in a high-speed car accident to drive at dangerous speeds.^{^[77]}
The claim that Google aided and abetted terrorism by sharing advertising revenue with ISIS.^{^[78]}
Platforms that processed payments for unlawful purchases of virtual chips for illegal casino apps.^{^[79]}

Taken together, these cases establish that Section 230 does not shield conduct that can be characterized as the platform’s own unlawful act.^{^[80]}

Two recent groundbreaking lawsuits have found social media companies liable for harming users, based on the novel legal theory that social media design features, as opposed to third party content, were the source of harm. In both cases, the courts rejected the platforms’ arguments that section 230 blocked the lawsuits, concluding that the companies’ design choices were harmful independent of third-party content.

First, a New Mexico jury found Meta violated the state’s Unfair Practices Act by hiding what it knew about the dangers of child sexual exploitation on its platforms and impacts to child mental health. “Meta’s design features enabled pedophiles and predators to engage in child sexual exploitation on Meta’s platforms. Evidence from those witnesses and other industry experts also demonstrated that Meta intentionally designs its platforms to addict young people and, contrary to Meta’s public commitments, expose them to dangerous content related to eating disorders and self harm.”^{^[81]} The jury ordered Meta to pay a total of $375 million in civil penalties.

Second, a jury in Los Angeles found YouTube and Meta’s negligent design of their products was a substantial factor in causing the plaintiff’s mental health distress. She testified that her compulsive use of social media as a child led to anxiety, depression, and thoughts of self-harm. The jury agreed that addictive features like infinite scroll, autoplay, push notifications, and algorithmic curation of content exacerbated her mental health condition. The jury ordered Meta and YouTube to pay the plaintiff $3 million in compensatory damages, with 70% assigned to Meta.^{^[82]}

In May of 2025, Congress passed the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks (TAKE IT DOWN) Act, which protects victims’ non-consensual intimate images from spreading online. Unlike FOSTA and SESTA, which act as a carve-out from Section 230, failure to respond to a takedown request constitutes an unfair or deceptive practice under the Federal Trade Commission Act. This provides a significant remedy for victims of intimate privacy violations once the violations occur.

4) What this measure would do. This resolution declares that Section 230 was a well meaning law that was instrumental to the development of the fledgling internet, but has, in the three decades since its passage, been stretched well beyond its initial intent. It now serves to shield major platforms from liability even when they’ve facilitated or profited from harmful content, leading to destructive real-world consequences that fall disproportionately on children, women, LGBTQ+ individuals, and non-white people. This is inconsistent with general principles of liability applied to brick-and-mortar businesses.

The resolution cites the federal bipartisan push to sunset section 230 in order to reform it. These measures, introduced in the Senate by Senators Lindsey Graham and Dick Durbin, and in the House by Harriet Hageman, would sunset section 230 over the course of two years, giving a substantial runway to develop targeted reforms that ensure platform liability is more consistent with general principles of liability applicable to brick-and-mortar businesses.

Some stakeholders have proposed narrowing amendments. For instance, Professor Citron has proposed to exclude platforms that “purposefully or deliberately solicit, encourage, or keep up material that they know or have reason to believe constitutes stalking, harassment, or intimate privacy violations.” Second, if a platform seeks immunity for intimate privacy violations, cyber stalking, and cyber harassment, Citron proposes that platforms must demonstrate that they meet a duty of care based on “reasonable steps” specified by Congress, such as implementing reporting mechanisms for intimate privacy violations.^[83]

The resolution doesn’t call for a specific solution – it simply calls for sunsetting section 230 to provide a firm deadline to ensure that powerful technology companies participate in Section 230 reform efforts in good faith in order to restore appropriate balance and accountability.

ARGUMENTS IN SUPPORT: A coalition of supporters jointly write:

The undersigned organizations are in SUPPORT of HR 117, which calls for reform of Section 230 of the federal Communications Decency Act. The resolution points out that while Sec. 230 was originally intended to operate as a “Good Samaritan” law and shield platforms from liability in cases where they responsibly moderated content, it has instead been used as a tool by big tech to protect platforms that willfully disregard known abuses on their platforms.

It is past time for the federal government to curb these abuses and reform Section 230.

REGISTERED SUPPORT / OPPOSITION:

Support

Alexander Neville Foundation

Carson J. Bride Effect

Children's Advocacy Institute University of San Diego School of Law

Children Now

California Initiative for Technology & Democracy (CITED)

Emmy's Champions

Issue One

Mothers Against Media Addiction (MAMA)

Parents RISE!

Parents Together Action

Opposition

None on file.

Analysis Prepared by: Josh Tosney / P. & C.P. / (916) 319-2200

Doe ex rel. Roe v. Snap, Inc. (2024) 144 S. Ct. 2493 (Thomas, J., dissenting from denial of certiorari). ↑
See e.g., Kosseff, The Twenty-Six Words that Created the Internet (2019); Jeffrey D. Neuburger, “United States: Commerce Dept. Petitions FCC to Issue Rules Clarifying CDA Section 230,” (Aug. 7, 2020) Mondaq, https://www.mondaq.com/unitedstates/social-media/971694/commerce-dept-petitions-fcc-to-issue-rules-clarifying-cda-section-230 [https://perma.cc/JQ85-2FYE]; Danielle Keats Citron, “How to Fix Section 230” (2023) 103 B.U.L. Rev. 713, 717. ↑
Quinta Jurecic, “The politics of Section 230 reform: Learning from FOSTA’s mistakes” (Mar. 1, 2022) Brookings, https://www.brookings.edu/articles/the-politics-of-section-230-reform-learning-from-fostas-mistakes/;
Michael Rustad & Thomas Koenig, “The Case for a CDA Section 230 Notice-and-Takedown Duty” (2023) 23 Nev.L.J. 533, 536. ↑
The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age (2022), p. 84. ↑
Stratton Oakmont v. Prodigy Servs. Co. (Sup.Ct. May 24, 1995, INDEX No. 31063/94) 1995 N.Y. Misc. LEXIS 229 (unpublished). ↑
Cubby, Inc. v. Compuserve, Inc. (S.D.N.Y. 1991) 776 F.Supp. 135, 139; Cianci v. New Times Publishing Co. (2d Cir. 1980) 639 F.2d 54, 61 (Friendly, J.) (quoting Restatement (Second) of Torts § 578 (1977). ↑
Stratton Oakmont v. Prodigy Servs. Co., supra, 1995 N.Y. Misc. LEXIS 229, at *10, discussing Cubby, Inc. v. Compuserve, Inc. (S.D.N.Y. 1991) 776 F.Supp. 135, 140. ↑
Fair Hous. Council v. Roommates.com, LLC (9th Cir. 2008) 521 F.3d 1157, 1163, discussing Stratton Oakmont, supra, 1995 N.Y. Misc. LEXIS 229. ↑
Reno v. ACLU (1997) 521 U.S. 844, 874. ↑
Richmond Journal of Law and Technology (2020) https://jolt.richmond.edu/2020/08/27/the-origins-and-original-intent-of-section-230-of-the-communications-decency-act/. ↑
The term “interactive computer service” means any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions. (47 U.S.C. § 230(f)(3).) ↑
47 U.S.C. § 230(e)(3). ↑
The Ninth Circuit has construed this exception as applying only to federal intellectual property laws. ↑
47 U.S.C. § 230(e). ↑
(4th Cir. 1997) 129 F.3d 327. ↑
Id. at pp. 329-331. ↑
Id. at p. 330. ↑
Id. at p. 332 ↑
Id. at p. 333. ↑
Eric Goldman, “The Ten Most Important Section 230 Rulings” (2017) 20 Tul. J. Tech. & Intell. Prop. 1, 3 ↑
Ramey v. Darkside Prods. (D.D.C. May 17, 2004, Civil Action No. 02-730 (GK)) 2004 U.S.Dist.LEXIS 10107, at *1. ↑
Id. at p. 16. ↑
(6th Cir. 2014) 755 F.3d 398, 401, 403. ↑
Id. at p. 405 ↑
(Tex. Ct. App. 2014) 429 S.W.3d 752. ↑
Id. at p. 759. ↑
Id. at p. 760. ↑
Id. at p. 759. ↑
Doe v. MySpace Inc. (5th Cir. 2008) 528 F.3d 413. ↑
Id. at p. 420. ↑
D.Nev. (May 29, 2013), No. 2:13-CV-97 JCM (NJK)) 2013 U.S.Dist.LEXIS 78339, at *13. ↑
Id. at *11. ↑
Id. at *13. ↑
(S.D.N.Y. 2018) 306 F. Supp. 3d 579. ↑
Id. at p. 584. ↑
Id. at p. 588. ↑
Jessica Testa, “Revenge Porn Lawyer Carrie Goldberg Has Taken On Psychos, Stalkers, and Trolls. Now She Confronts Her Own Worst Demons,” (Jul. 17, 2019) Elle, https://www.elle.com/culture/books/a28401678/carrie-goldberg-nobodys-victim-interview/. ↑
See e.g. M.A. v. Vill. Voice Media Holdings (E.D.Mo. 2011) 809 F.Supp.2d 1041. ↑
Quinta Jurecic, “The politics of Section 230 reform: Learning from FOSTA’s mistakes (Mar. 1, 2022) Brookings, https://www.brookings.edu/articles/the-politics-of-section-230-reform-learning-from-fostas-mistakes/. ↑
Stop Enabling Sex Traffickers Act and the Allow States to Fight Online Sex Trafficking Act (SESTA/FOSTA) legislation package. (See P.L. 115-164, 113 Stat. 1253.) ↑
See e.g. M.H. v. Omegle.com, LLC (M.D.Fla. Jan. 10, 2022, No. 8:21-cv-814-VMC-TGW) 2022 U.S.Dist.LEXIS 4543, at *13 (dismissing case against Omegle, a social media site that let users talk to strangers, in which an 11-year old girl was connected with a predator who extorted nude images from her). ↑
Danielle Keats Citron, “How to Fix Section 230” (2023) 103 B.U.L. Rev. 713, 726. ↑
“What’s the Harm? The future of the First Amendment: The Internet as a Speech Machine and Other Myths Confounding Section 230 Reform” (2020) U Chi Legal F 45, 46. ↑
Danielle Keats Citron, “How to Fix Section 230” (2023) 103 B.U.L. Rev. 713, 727. ↑
Michael Rustad & Thomas Koenig, “The Case for a CDA Section 230 Notice-and-Takedown Duty” (2023) 23 Nev.L.J. 533, 536. ↑
Danielle Keats Citron, “How to Fix Section 230” (2023) 103 B.U. L. Rev. 713, 716. ↑
Id., p. 718. ↑
Id. at pp. 536-7. ↑
Suddeth v. Meta Platforms, Inc. (N.D.Cal. Mar. 24, 2026, No. 25-cv-08581-RS) 2026 U.S.Dist.LEXIS 62629, at *11. ↑
Daniel v. Armslist, LLC (2019) 386 Wis.2d 449, 458. ↑
Dyroff v. Ultimate Software Grp., Inc. (9th Cir. 2019) 934 F.3d 1093, 1100. ↑
Force v. Facebook, Inc. (2d Cir. 2019) 934 F.3d 53, 57. ↑
McCarthy v. Amazon.com, Inc. (W.D.Wash. 2023) 679 F. Supp. 3d 1058, 1075. This portion of ruling was not challenged in McCarthy v. Amazon.Com, Inc. (9th Cir. Mar. 12, 2026, No. 23-35584) 2026 LX 172114, at *6, which reversed the district court’s dismissal of plaintiffs’ products liability and negligence claims and allowed the case to proceed based on Amazon’s actions as a seller. ↑
See Rebecca Tushnet, “Power Without Responsibility: Intermediaries and the First Amendment” (2008) 76 Geo. Wash. L. Rev. 986. ↑
Written Testimony of Dr. Mary Anne Franks, Subcommittee on Communications and Technology of the Committee on Energy and Commerce Hearing on “Holding Big Tech Accountable: Targeted Reforms to Tech’s Legal Immunity” (Nov. 19, 2021), p. 5 https://www.congress.gov/117/meeting/house/114268/witnesses/HHRG-117-IF16-Wstate-FranksM-20211201-U1.pdf. ↑
Id. at p. 7. ↑
Id. at p. 730 (“The United States exported §230 to Canada and Mexico through the United States-Mexico-Canada Trade Agreement, which went into effect on July 1, 2020”). ↑
Witness testimony of Prof. Mary Graw Leary, “Children’s Safety in the Digital Era: Strengthening Protections and Addressing Legal Gaps” (Feb. 19, 2025) Hearing of the U.S. Senate Committee on the Judiciary, https://www.judiciary.senate.gov/committee-activity/hearings/childrens-safety-in-the-digital-era-strengthening-protections-and-addressing-legal-gaps ↑
Pietsch, et al., “The Facebook whistleblower told Congress it should amend Section 230, the internet law hated by both Biden and Trump. Here's how the law works” (2021) Business Insider, https://www.businessinsider.com/what-is-section-230-internet-law-communications-decency-act-explained-2020-5. ↑
See e.g., Fair Hous. Council v. Roommates.com, LLC (9th Cir. 2008) 521 F.3d 1157, 1168 (liability arose from website’s material contribution to discriminatory content); Barnes v. Yahoo!, Inc. (9th Cir. 2009) 570 F.3d 1096, 1107 (liability arose from promise and subsequent failure to remove offending content); Anderson v. TikTok Inc. (3d Cir. 2024) 116 F.4th 180, 184 (recommendation algorithm is platform’s first-party expressive content and thus is not protected by Section 230). ↑
Doe ex rel. Roe v. Snap, Inc. (2024) 144 S. Ct. 2493, 2494 (Thomas, J., dissenting from denial of certiorari) (stating “make no mistake about it—there is danger in delay. Social-media platforms have increasingly used §230 as a get-out-of-jail free card”). ↑
See Gonzalez v. Google LLC (2023) 598 U. S. 617, 621 (declining to address claims Google had violated the Antiterrorism Act by recommending ISIS to YouTube users). ↑
Pietsch et al, “The Facebook whistleblower told Congress it should amend Section 230, the internet law hated by both Biden and Trump. Here’s how the law works” (2021) Business Insider, https://www.businessinsider.com/what-is-section-230-internet-law-communications-decency-act-explained-2020-5. ↑
John Lucas, “AG Moody Joins with Other Attorneys General to Urge Congress to Stop Protecting Illegal Activity on the Net” (May 23, 2019) Capitolist, https://thecapitolist.com/ag-moody-joins-with-other-attorneys-general-to-urge-congress-to-stop-protecting-illegal-activity-on-the-net. ↑
According to Professor Goldman, “there is almost no member of Congress who would vote against a Section 230 repeal, Democrat or Republican.” (“2024 Internet Law Year-in-Review” (Jan. 9, 2025), https://blog.ericgoldman.org/archives/2025/01/2024-internet-law-year-in-review.htm.) ↑
“Herrick v. Grindr: Why Section 230 of the Communications Decency Act Must be Fixed” (Aug. 14, 2019) Lawfare, https://www.lawfaremedia.org/article/herrick-v-grindr-why-section-230-communications-decency-act-must-be-fixed. ↑
Calise v. Meta Platforms, Inc. (9th Cir. 2024) 103 F.4th 732, 739, citing cases. ↑
Doe v. Internet Brands, Inc. (9th Cir. 2016) 824 F.3d 846, 853. ↑
HomeAway.com v. City of Santa Monica (9th Cir. 2018) 918 F.3d 676, 683. ↑
Ibid. ↑
Barnes v. Yahoo!, Inc. (9th Cir. 2009) 570 F.3d 1096, 1109. ↑
Id. at p. 1102. ↑
Calise v. Meta Platforms, supra, 103 F.4th at p. 742. ↑
Barnes, supra, 570 F.3d at p. 1109. ↑
Doe v. Internet Brands, Inc., supra, pp. 852-853 ↑
HomeAway.com, Inc. v. City of Santa Monica (9th Cir. 2019) 918 F.3d 676, 682 (HomeAway). ↑
Lemmon v. Snap, Inc. (9th Cir. 2021) 995 F.3d 1085, 1092. ↑
Gonzalez v. Google LLC (9th Cir. 2021) 2 F.4th 871, 890 (Gonzalez). This case was eventually resolved on the grounds that the plaintiffs did not allege facts sufficient to show a violation of anti-terrorism laws. ↑
In re Apple Inc. Litig. (N.D.Cal. 2022) 625 F. Supp. 3d 971, 994. ↑
Anderson v. TikTok Inc. (3d Cir. 2024) 116 F.4th 180, 184 concluded that a recommendation algorithm is platform’s first-party expressive content and thus is not protected by Section 230. However, the Ninth Circuit has not followed this position, although some Justices have called for it to do so. (Doe v. Meta Platforms, Inc. (9th Cir. 2026) 174 F.4th 1159, Berzon, J. concurring; Nelson, J. concurring.) ↑
New Mexico Department of Justice, “New Mexico Department of Justice Wins Landmark Verdict Against Meta” (Mar. 24, 2026), https://nmdoj.gov/press-release/new-mexico-department-of-justice-wins-landmark-verdict-against-meta/. ↑
Tyler Katzenberger, “Meta, YouTube found liable for social media addiction in landmark trial,” Politico (Mar. 25, 2026), https://www.politico.com/news/2026/03/25/meta-youtube-found-liable-for-social-media-addiction-in-landmark-trial-00844625. ↑
Danielle Keats Citron, “How to Fix Section 230” (2023) 103 B.U.L. Rev. 713, 753. ↑

HR 117

Current Status:

Assembly Floor

Assembly Standing Committee on Privacy and Consumer Protection

News Coverage: