Section 230
In 1996, when 40 million people used the internet, a law was passed. By 2019, 4 billion people were online. The law had not changed.
How to read this page. Tap any underlined word to see the precise legal term and a short definition. Expand any "Deeper" box for the evidence and contested points. The main text works on its own — you can skip both and still get the whole argument.
The 26 words
"No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."
These 26 words, Section 230 of the Communications Decency Act, signed into law on 8 February 1996, are the legal foundation of the modern internet. They gave platforms intermediary immunity: the freedom to host and moderate what users post without being treated as the publisher of it. The Electronic Frontier Foundation supported the bill. The intention was reasonable.
Intermediary immunity
The principle that an online service is not legally liable for content its users create, the way a phone company isn't liable for what people say on calls. It is what lets a platform host billions of posts — and moderate them — without being sued over each one. The hard question Section 230 left unanswered: does that immunity also cover the platform's own choice of which posts to amplify?
Sources
- Communications Decency Act, Section 230 (1996) — Legal Information Institute, Cornell.
The gap it created
Section 230 does not merely protect platforms from liability for what their users post. Courts interpreted it to protect platforms from liability for their own algorithmic recommendations — for actively choosing to show you content that contributes to radicalisation, depression, or harm. A platform that amplifies harmful content through its recommendation engine is, under Section 230's interpretation, no more liable than one that merely hosts it passively.
When the law was written, 40 million people used the internet. By 2019, more than 4 billion were online. Platforms had built multi-billion-dollar businesses on algorithmic amplification. The 26-word immunity, written for a different world, applied to this one.
What is changing
US courts are now finding that Section 230 does not protect platforms from liability for their own design choices — the infinite scroll, autoplay, push notifications — as distinct from the content itself. The March 2026 verdicts finding Meta and Google liable for harm to minors were won partly on this argument: not "you hosted bad content" but "you designed a product you knew was harmful." The immunity is not absolute. The design argument is gaining force.
How we know — the content-versus-design distinction courts are drawing
The legal shift turns on a single distinction. Section 230 immunises a platform for third-party content — what users say. It was never obvious that it also immunises the platform's own product decisions — infinite scroll, autoplay, recommendation, notification timing. Recent rulings (a 2025 California decision allowing failure-to-warn claims; the Third Circuit allowing a suit over TikTok's algorithm; the March 2026 verdicts) accept that design is the platform's own conduct, not someone else's speech, and so falls outside the 26 words.
What's still unsettled. Where exactly the line sits between "a recommendation is editorial speech (protected)" and "a recommendation is a product feature (liable)" is being litigated case by case, and appeals are ongoing. The direction is consistent; the precise boundary is not yet fixed law.
Sources
- Communications Decency Act, Section 230 (1996) — Legal Information Institute, Cornell.
- Electronic Frontier Foundation.
- US Congressional Research Service, Section 230: An Overview (R46751).