← Laws & Regulation

Section 230

In 1996, when 40 million people used the internet, a law was passed. By 2019, 4 billion people were online. The law had not changed.

How to read this page. Tap any underlined word to see the precise legal term and a short definition. Expand any "Deeper" box for the evidence and contested points. The main text works on its own — you can skip both and still get the whole argument.

The 26 words

"No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."

These 26 words, Section 230 of the Communications Decency Act, signed into law on 8 February 1996, are the legal foundation of the modern internet. They gave platforms intermediary immunity: the freedom to host and moderate what users post without being treated as the publisher of it. Civil-liberties groups, the Electronic Frontier Foundation among them, fought the rest of the Communications Decency Act in court and had its censorship provisions struck down; the 26 words survived, and the EFF has defended them since. The intention was reasonable.

The gap it created

Section 230 does not merely protect platforms from liability for what their users post. Courts interpreted it to protect platforms from liability for their own algorithmic recommendations — for actively choosing to show you content that plaintiffs and some studies link to radicalisation, depression, or harm, though whether it causes them is contested. A platform that amplifies harmful content through its recommendation engine is, under Section 230's interpretation, no more liable than one that merely hosts it passively.

When the law was written, 40 million people used the internet. By 2019, more than 4 billion were online. Platforms had built multi-billion-dollar businesses on algorithmic amplification. The 26-word immunity, written for a different world, applied to this one.

What is changing

US courts are now finding that Section 230 does not protect platforms from liability for some of their own design choices — parental controls, age checks, the barriers to deleting an account, the failure to warn — as distinct from the content itself. The feed's own features are the contested middle: in 2023 the federal judge in the youth-harm litigation held claims against the endless feed, the recommendation algorithms and notification timing barred, while in 2024 the Third Circuit let a suit over TikTok's recommendations go ahead. The March 2026 Los Angeles verdict against Meta and Google's YouTube was won partly on this argument: not "you hosted bad content" but "you designed a product you knew was harmful." The immunity is not absolute. The design argument is gaining force.

How we know — the content-versus-design distinction courts are drawing +

The legal shift turns on a single distinction. Section 230 immunises a platform for third-party content — what users say. It was never obvious that it also immunises the platform's own product decisions — infinite scroll, autoplay, recommendation, notification timing. Recent rulings (the November 2023 federal decision in the youth-harm litigation, allowing failure-to-warn claims and design claims about parental controls, age checks and account deletion, while holding the endless-feed, recommendation and notification-timing claims barred; the Third Circuit allowing a suit over TikTok's algorithm; the March 2026 verdicts) accept that at least some design is the platform's own conduct, not someone else's speech, and so falls outside the 26 words.

What's still unsettled. Where exactly the line sits between "a recommendation is editorial speech (protected)" and "a recommendation is a product feature (liable)" is being litigated case by case, and appeals are ongoing. The direction is consistent; the precise boundary is not yet fixed law.

GDPR →
Courts & Liability →