Section 230 of the Communications Decency Act of 1996 is twenty-six words long in its operative core: 'No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.' Those words, codified at 47 U.S.C. § 230(c)(1), are the legal foundation on which every modern user-content platform was built.
Section 230 also contains a second, less-discussed provision at § 230(c)(2) that immunizes good-faith moderation. Together, the two provisions resolve a problem that the pre-1996 case law had created: platforms that moderated user content (Stratton Oakmont v. Prodigy, 1995) were treated as publishers and were liable for everything they hosted, while platforms that did not moderate (Cubby v. CompuServe, 1991) were treated as distributors and escaped liability for content they had no knowledge of. The pre-1996 rule punished moderation. Section 230 inverted that incentive.
What § 230(c)(1) actually says and does
The full text of § 230(c)(1) is: 'No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.' Three terms carry the weight. 'Interactive computer service' is defined broadly at § 230(f)(2) and covers essentially any service that enables computer access by multiple users to a server, including ISPs, hosting providers, social media, search engines, and review sites. 'Information content provider' is defined at § 230(f)(3) as any person responsible in whole or in part for the creation or development of the information.
The combined effect is that a platform cannot be sued in tort for content created by its users. A defamation suit against Google for a defamatory user review on Maps fails at the motion-to-dismiss stage. A suit against Yelp for a defamatory user review fails. A suit against Facebook for a defamatory user post fails. The platform is not the publisher or speaker; the user who posted the content is. Liability lies with the user, not with the platform.
What § 230(c)(2) actually says and does
Section 230(c)(2)(A) provides: 'No provider or user of an interactive computer service shall be held liable on account of any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.'
This is the moderation immunity. It permits platforms to remove user content they consider objectionable without becoming liable to the user whose content was removed. The phrase 'otherwise objectionable' has been read broadly by most courts (Zango v. Kaspersky, 9th Cir. 2009) and is the textual basis on which platforms can remove harassment, hate speech, misinformation, and similar content without facing wrongful-removal suits. Section 230(c)(2)(B) extends the immunity to providers of filtering tools like ad blockers, parental-control software, and anti-spam tools.
What Section 230 does not do
Section 230 does not immunize the original speaker. The user who posts defamatory content remains liable in tort. § 230 protects the platform; the speaker has no protection from § 230 and faces ordinary defamation, harassment, or other tort liability.
Section 230 does not preempt federal criminal law (§ 230(e)(1)), federal intellectual-property law (§ 230(e)(2)), the Electronic Communications Privacy Act (§ 230(e)(4)), or, since FOSTA-SESTA in 2018, federal sex-trafficking law and parallel state laws (§ 230(e)(5)). DMCA copyright takedowns, trademark suits, and federal criminal prosecutions are unaffected by § 230.
Section 230 does not immunize content the platform itself creates. Where a platform authors content (Knowledge Panel summaries written by Google, editorial content on a news site, the platform's own marketing copy), § 230 does not apply because the platform is the information content provider for that content. Roommates.com (9th Cir. 2008) held that where a platform's design materially contributes to the alleged unlawfulness, § 230 does not apply.
The leading cases
Zeran v. America Online (4th Cir. 1997) is the foundational case. The plaintiff was the target of a malicious AOL message-board hoax that listed his phone number as the contact for offensive merchandise. He sued AOL on a distributor-liability theory after notice. The Fourth Circuit held that § 230 forecloses both publisher and distributor liability and that the platform retains immunity even after notice of the unlawful content. Every federal circuit has subsequently followed Zeran.
Fair Housing Council v. Roommates.com (9th Cir. 2008) is the leading case on material development. Barnes v. Yahoo! (9th Cir. 2009) carved out the contract / promissory-estoppel exception where a platform makes specific representations to a user about content removal. Hassell v. Bird (Cal. 2018) held that § 230 prevents enforcement of a defamation judgment against the speaker via removal order against the platform. Force v. Facebook (2d Cir. 2019) applied § 230 to algorithmic recommendation of third-party content.
Gonzalez v. Google and Twitter v. Taamneh (2023) were the most-watched § 230 cases of the modern era. Taamneh resolved on aiding-and-abetting grounds without reaching § 230, and Gonzalez was remanded in light of Taamneh without a § 230 ruling. The combined effect was to stabilize § 230 in the short term.
Section 230 protects the platform; the speaker has no protection from § 230 and faces ordinary defamation, harassment, or other tort liability. The realistic defendant is the original speaker, not the platform.
FOSTA-SESTA: the only successful carveout
The Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA) and Stop Enabling Sex Traffickers Act (SESTA), enacted together in 2018, added § 230(e)(5), which excludes federal sex-trafficking claims under 18 U.S.C. § 1591 and parallel state laws from § 230 immunity. This is the only successful narrowing of § 230 since the original 1996 enactment.
From a doctrinal standpoint, FOSTA-SESTA established that Congress can carve out specific categories from § 230 if it chooses to. Multiple subsequent reform proposals (Justice Against Malicious Algorithms Act, EARN IT Act variants, SAFE TECH Act) have used FOSTA-SESTA as the procedural template, but none has passed.
The reform debate and why it stalls
Section 230 reform is one of the few topics on which both major US political parties have proposed changes - but for opposite reasons. Conservative critics typically argue that platforms moderate too aggressively against viewpoint diversity and that § 230(c)(2)'s good-faith requirement should be tightened. Liberal critics typically argue that platforms moderate too little against harassment, hate speech, and misinformation and that § 230(c)(1) should be narrowed for algorithmically-amplified content.
The structural problem with reform is that the two critiques pull in opposite directions. A reform that limits moderation immunity to address the conservative concern would expose platforms to wrongful-removal suits and incentivize them to moderate less, which directly worsens the liberal concern. A reform that narrows publisher immunity to address the liberal concern would expose platforms to defamation, harassment, and similar suits and incentivize them to moderate more aggressively. No reform proposal since 2018 has resolved this tension.
What Section 230 means for reputation victims
For an individual or business whose reputation has been damaged by online content, the practical implication of § 230 is that the realistic defendant is the original speaker, not the platform. Defamation suits against the platform fail at the motion-to-dismiss stage in nearly every reported case. Suits against the speaker proceed normally and remain viable.
The realistic remedies that operate alongside the litigation track include DMCA takedowns for content infringing the victim's copyrighted material, GDPR delisting requests for EU residents, Google's expanded 2022-2024 personal-information-removal policy, platform-specific content-policy reports, and SEO suppression. The combined approach is more effective than any single channel. Suing the platform almost never works and almost never produces the practical outcome the victim is seeking.
